Many employees use their Active Directory credentials to access corporate VPNs, a common and often intentional configuration. And some employees reuse these same passwords for personal VPN services.