End-user experience with "enterprise" VPNs (GlobalProtect currently) leaves me much more trusting of WireGuard and OpenSSH, despite the Enterprise thinking SSH is too insecure to use without the VPN.

Early on, I looked at the GlobalProtect client we were supposed to use on GNU/Linux (x86 only, amongst other things). I found it linked a well-obsolete openssl (I don't recall the CVE count), and was even unlawful because it violated the openssl licence conditions. Then I see the CVEs on these things. People who use them find the proprietary clients keep breaking with no notice for no apparent reason. Openconnect has just worked through all that when I've had to use GP rather than WireGuard. (Openconnect also allowed me to use Cisco's corporate VPN to test the Linux-based stuff they tried to sell us and insisted I had to use an MS Windows machine to connect. Thank you OC maintainers!)