A computing system configured to detect and handle malicious network tunneling, the computing system comprising: a computer processor; and a computer readable storage medium storing program instructions configured for execution by the computer processor in order to cause the computing system to: access a first log including a listing of one or more first source addresses assigned to a corresponding one or more remote users granted access to a network via VPN connections; access a second log including a listing of one or more second source addresses that requested outbound data connections from the network and a listing of one or more destination addresses identified by the outbound data connections; identify a first address included in both the first log as a first source address and in the second log as a destination address; determine user data associated with the first address, the user data including one or more of a user identity, a user role, a user geographic location, or a user access level; determine traffic data associated with the first address, the traffic data including information regarding any connections from the network initiated by the first address; generate a risk score based on at least the determined user data and the determined traffic data, the risk score at least partly indicative of a likelihood that the traffic data includes one or more malicious tunneling connections; and terminate the one or more identified malicious tunneling connections and/or generate an alert if the risk score exceeds a threshold value. a computer processor; and a computer readable storage medium storing program instructions configured for execution by the computer processor in order to cause the computing system to: access a first log including a listing of one or more first source addresses assigned to a corresponding one or more remote users granted access to a network via VPN connections; access a second log including a listing of one or more second source addresses that requested outbound data connections from the network and a listing of one or more destination addresses identified by the outbound data connections; identify a first address included in both the first log as a first source address and in the second log as a destination address; determine user data associated with the first address, the user data including one or more of a user identity, a user role, a user geographic location, or a user access level; determine traffic data associated with the first address, the traffic data including information regarding any connections from the network initiated by the first address; generate a risk score based on at least the determined user data and the determined traffic data, the risk score at least partly indicative of a likelihood that the traffic data includes one or more malicious tunneling connections; and terminate the one or more identified malicious tunneling connections and/or generate an alert if the risk score exceeds a threshold value. access a first log including a listing of one or more first source addresses assigned to a corresponding one or more remote users granted access to a network via VPN connections; access a second log including a listing of one or more second source addresses that requested outbound data connections from the network and a listing of one or more destination addresses identified by the outbound data connections; identify a first address included in both the first log as a first source address and in the second log as a destination address; determine user data associated with the first address, the user data including one or more of a user identity, a user role, a user geographic location, or a user access level; determine traffic data associated with the first address, the traffic data including information regarding any connections from the network initiated by the first address; generate a risk score based on at least the determined user data and the determined traffic data, the risk score at least partly indicative of a likelihood that the traffic data includes one or more malicious tunneling connections; and terminate the one or more identified malicious tunneling connections and/or generate an alert if the risk score exceeds a threshold value.