Corporate VPNs aren&#x27;t OpenSSL, they&#x27;re usually IPSec implementations and not susceptible to heartbleed.<p>&gt;It&#x27;s probably not going to get popped by non-state actors.<p>Not too long ago people were making this argument but including both OpenSSL and OpenSSH. Now its just OpenSSH. Funny how that works. The reality is that layered security is a best practice and just expecting something to be perfect forever because of past performance is a very questionable premise.