monitoring user activity for one or more user interactions performed while connected to a Virtual Private Network (VPN);

generating a user impact score that measures potential impact if credentials of the user maintained access to the VPN by assigning weighted values to the user's access to sensitive information, the user's communication patterns demonstrating access to management, the user's decision making ability, transactions of the user, and system admin capabilities of the user;

determining a respective user interaction of the one or more user interactions deviates from established user interactions based on location of the user, times the user accesses the VPN, and biometrics of the user;

assigning each interaction of the user a weighted score that represents a real time risk of impact based on the actions performed; and

in response to the generated user impact score and weighted score that represents the real time risk of impact based on the actions performed exceeding a threshold level of risk authenticating the user's identity before allowing an action to perform the respective user interaction via random selection of an authentication measure; and

in response to a failed reauthentication of the user's identity, terminating connection to the VPN.