Network Security
Always-on network security with no gaps — because advisors won't turn on a VPN, so FCI does it for them.
Always-on VPN with cloud-based firewall, on-premise firewall management, IP-based access control, DNS filtering, and centralized network logging — applied consistently across every user, every device, every location. No voluntary compliance. No unprotected traffic. No missing logs.
The Problem
Most firms have no idea what their network actually looks like.
Before COVID, the security model was simple: everyone worked behind a corporate firewall. Traffic was routed through the network, logs were captured, and IT had visibility. That world no longer exists.
Now advisors work from home offices, shared office suites, coffee shops, and hotel Wi-Fi. Everything they access is cloud-based — email, file storage, CRM, custodial platforms. There is no compelling reason for users to connect to a VPN, and the result is predictable: 85% of users don't connect. Their traffic is unsecured, their DNS resolution is uncontrolled, and the regulatory-required network logs that examiners expect to see are simply not being captured.
Some firms believe a commercial VPN solves the problem. It does not. A commercial VPN encrypts the tunnel — and that is all it does. It provides no intrusion prevention, no DDoS protection, no content filtering, no corporate DNS control, and no regulatory-grade logging. It is a retail tool designed for consumer privacy, not financial services compliance.
Meanwhile, the on-premise firewalls that do exist are often neglected. Firmware goes unpatched. Configurations drift. Ports that were opened for a temporary need stay open permanently. And in some offices — particularly smaller branch offices and home offices — there is no business-grade firewall at all.
VPN technology exists at every firm. The problem is adoption. Users don't turn it on because there is no consequence for leaving it off and no benefit they can see. The result: a security control that exists on paper but protects almost no one in practice.
Even when users do connect to a VPN, a commercial VPN only encrypts the tunnel. It provides no DDoS protection, no intrusion prevention, no content filtering, no corporate DNS control, and no centralized logging. Encryption alone is not compliance.
Firewalls require ongoing management: firmware updates, configuration hardening, rule audits, and log collection. Most firms treat them as appliances that were set up once and never touched again. A firewall with stale firmware and default rules is not protection — it is a false sense of security.
When firms needed remote access, the most common approach was opening RDP ports on the firewall. Open RDP ports are among the most exploited attack vectors in financial services. Every open port is a door — and bad actors scan for them continuously.
Most advisors working from home are behind consumer-grade routers with no intrusion prevention, no VPN gateway, no content filtering, and no logging. Without a cloud-based firewall, the firm's network perimeter stops at the office door — and most of the firm works outside of it.
Regulators expect firms to demonstrate network visibility. If 85% of users are not on the VPN, then 85% of network activity is invisible. On-premise firewalls that are not centrally managed produce local logs that no one collects.
What FCI Delivers
Seven capabilities — applied to every user and every network, enforced without asking.
FCI does not offer a VPN and hope users turn it on. FCI does not install a firewall and walk away. FCI enforces network security automatically — every device, every user, every connection — through a combination of always-on VPN with cloud-based firewall for every user and managed on-premise firewalls for every office. No opt-in. No manual steps. No gaps.
When the computer turns on, the VPN is on — and every bit of traffic routes through a cloud-based firewall managed by FCI. This is not a commercial VPN that only encrypts the tunnel. The cloud-based firewall provides DDoS protection, intrusion prevention, content filtering, DNS control, and centralized logging — the full range of capabilities regulators require, delivered to every user regardless of location. Users cannot turn it off — or, where business requirements allow, they can temporarily disable it for 30 minutes before it re-engages automatically.
Once every device has a consistent, known IP through the always-on VPN, FCI can lock down critical systems to those IPs only. Bad actors cannot even reach the login page — they are blocked at the network level before authentication. Even systems that don't support MFA can be secured by IP restriction. Users are compelled to stay on VPN because turning it off means losing access to the systems they need to work.
FCI manages business-grade firewalls across every office location — corporate headquarters, branch offices, and anywhere the firm maintains a physical network presence. Each firewall is assessed, hardened to FCI standards, and monitored continuously. Firmware is kept current. Configuration changes are logged. Rules are audited and tightened. Unnecessary open ports — including RDP — are closed. The on-premise firewall is not a set-and-forget appliance. It is a managed, auditable component of the firm's security posture.
FCI controls DNS resolution for every connected device — through the cloud-based firewall for remote users and through the on-premise firewall for office users. Malicious domains are blocked before they resolve. Web filtering policies are enforced. And every DNS query is logged — providing the kind of network activity evidence that regulators expect. With a commercial VPN, the firm has no idea what domains its users are resolving. With FCI, every query is captured and auditable.
FCI performs both internal and external network penetration testing and vulnerability scanning. Penetration testing simulates real-world attacks to identify exploitable weaknesses — testing what happens when an attacker is already inside the network, not just the perimeter. Vulnerability scanning systematically identifies known weaknesses: missing patches, misconfigured services, outdated software, and open ports. NYDFS now explicitly requires annual penetration testing from both inside and outside the network boundary. SEC, FINRA, and NAIC expect it as part of demonstrating compliance.
FCI maintains a complete inventory of all network infrastructure — on-premise firewalls at every office, the cloud-based firewall infrastructure, and always-on VPN configuration for every device. Each component is tracked with its configuration, firmware version, hardening status, and log collection state. This is the network equivalent of the endpoint asset inventory: accurate, up-to-date, with full history. When a regulator asks what network infrastructure the firm operates and how it is maintained, the answer already exists.
All network activity — VPN connections, DNS queries, on-premise firewall events, cloud-based firewall events, intrusion prevention alerts, and access attempts — feeds into centralized logging. Logs are not stored on local devices where they can be lost, overwritten, or never collected. They are centralized, searchable, and available through the FCI Portal. This creates the continuous evidence that regulators, insurers, and home offices require.
Comparison
Why a commercial VPN is not network security.
Regulators do not ask whether traffic is encrypted. They ask whether the firm controls its DNS, monitors for intrusions, filters malicious content, logs network activity, and can prove all of it. A commercial VPN answers none of those questions.
| Commercial VPN | On-Premise Firewall VPN | FCI Always-On VPN + Cloud Firewall | |
|---|---|---|---|
| DDoS protection | No | Yes (office only) | Yes — every user, every location |
| Intrusion prevention | No | Yes (office only) | Yes — every user, every location |
| Content filtering | No | Yes (office only) | Yes — every user, every location |
| Corporate DNS control | No — VPN provider controls DNS | Yes (office only) | Yes — FCI controls, logs captured |
| Corporate managed | No | Partially | Fully managed by FCI |
| User must turn it on | Yes — and they won't | Yes — and they won't | No — it's always on |
| Covers remote users | Tunnel only — no firewall | No — only in-office users | Yes — cloud-based firewall for all |
| Network logging | Where? Unknown | Local — often uncollected | Centralized |
| Regulatory-grade evidence | No | Partial | Complete |
Network security in a Zero Trust model means enforcing secure, encrypted communication inside and outside corporate networks. Security policies are implemented at the network level — firewall hardening, secure remote communication via always-on VPN with cloud-based firewall, and continuous monitoring. The network cannot be trusted simply because it is internal. Every connection is verified.
How FCI Is Different
Four reasons the same network technology produces different results.
Every IT provider can install an on-premise firewall and set up a VPN. The difference between FCI and everyone else is not the technology — it is mastery, automation, consistency, and persistent proof applied to every connection, every firewall, every day, across every environment FCI manages.
"Before FCI, our advisors had a VPN available but 85% never connected. Our branch firewalls hadn't been updated in over a year. Remote users had no firewall protection at all. Now every device routes through a cloud-based firewall from the moment it powers on, every on-premise firewall is hardened and monitored, and we went from hoping for compliance to proving it."
Interconnection
Network security does not stand alone — it strengthens every other domain.
A secured network is not just about protecting traffic. It becomes an access enforcement layer, a logging foundation, and a control point that strengthens every other domain. Every domain protects every other domain — and network security is the layer that connects them all.
What You Can Prove
Evidence that builds itself — every day, not just on audit day.
Regulators, home offices, and cyber insurance carriers all ask the same question: can you prove your network is secured? FCI produces continuous evidence as a byproduct of how it operates. There is no scramble before an exam. The proof already exists.
Ready to see what network security looks like when every user has a firewall — not just the ones in the office?
FCI works with broker-dealers and branch offices, insurance carriers and agencies, and RIAs. Start with a gap analysis — it is free, takes 30 minutes, and commits you to nothing.