Business VPN: When You Need One and When You Don't
Many people see a VPN as the standard answer to every remote-work question. In reality, it solves one very specific problem, and if you don't have that problem, it tends to create new ones.
You need a VPN when employees have to access resources from outside that live on the company network: a server, network drives, an inventory system with a local database, machine controls or network printers. The VPN creates an encrypted tunnel for this, through which the remote device works as if it were sitting in the office.
If your business works exclusively with cloud services (Microsoft 365, web-based business applications, cloud storage), you usually don't need a VPN. These services are already reachable over encrypted connections and secure access through sign-in and multi-factor authentication.
What a VPN does
Three things, clearly separated:
- It encrypts the connection between the device and the company network, so data can't be intercepted in transit.
- It gives access to internal resources that are deliberately not reachable from the internet.
- It gives the remote device a company IP address, which matters for some business applications that restrict access by IP.
What a VPN explicitly does not do
This is where most misunderstandings arise:
A VPN doesn't clean up an infected device. Quite the opposite: it connects a possibly compromised laptop directly to the company network. Without endpoint protection and device management, the VPN becomes an open invitation.
A VPN doesn't replace access rights. Once you're in the tunnel, you're on the network. Whether you're allowed into the HR folders is decided by permissions, not by the VPN.
A VPN doesn't protect cloud services. Microsoft 365 doesn't become more secure because access runs through a tunnel. There, multi-factor authentication and conditional access provide the protection.
The most important rule: a VPN is only as secure as the device at the other end. A personal laptop with no encryption, outdated updates and software of unknown origin doesn't belong in a tunnel to the company network.
The three common variants
| Variant | What for | Note |
|---|---|---|
| Client-to-site | Individual employees on the road or working from home | The standard case; software on every device |
| Site-to-site | A permanent connection between two locations | Runs on the routers, not on the devices |
| Zero trust / ZTNA | Access to individual applications instead of the whole network | The more modern approach, see below |
The alternative: access to applications instead of the network
The conceptual weakness of a classic VPN: once someone is in, they're on the entire network. A hijacked account or an infected device then has the same freedom of movement as a computer in the office.
Newer approaches, often called zero trust network access, turn this around: instead of opening up the network, they grant access to individual applications. Every access is checked: who is connecting, from which device, and what state that device is in. An unmanaged personal device then simply doesn't get into the accounting system, even if the username and password are correct.
For businesses with only a few internal applications, this is often the better solution: a smaller attack surface, and usually more convenient for users because nobody has to start a tunnel manually.
If you set up a VPN: what matters
- Multi-factor authentication for VPN access. A VPN that opens with a username and password alone is an open gate with a curtain in front of it.
- Only allow managed devices. Company devices with encryption, an up-to-date operating system and endpoint protection; no personal computers.
- Decide on split tunneling deliberately. Should all internet traffic run through the company, or only access to internal resources? The first gives you more control, but costs bandwidth and speed.
- Clean up access regularly. Former employees and old test accounts should be deactivated immediately. In practice, this is the most common gap.
- Turn on logging. Who was connected, and when? In an emergency, that's the crucial question.
Four questions to help you decide
Answer these four questions and the answer usually becomes obvious:
- Are there applications or data that live only on a server in your office?
- Do employees need to access them from outside?
- Are the devices used for access company devices under your management?
- Do you have more than a handful of internal applications?
Yes to the first two questions: you need secure remote access. A no to question three should be fixed first: device management before remote access. A no to question four suggests looking at application-based access instead of a classic VPN.
Frequently asked questions
Does my business need a VPN?
You need a VPN when employees have to access servers, network drives or other resources on the company network from outside. If you work exclusively with cloud services such as Microsoft 365, you usually don't need one.
Does a VPN make remote work secure?
Only partly. A VPN encrypts the connection, but it doesn't make an infected or poorly maintained device secure. It even connects that device directly to the company network. That's why managed devices with encryption, current updates and endpoint protection are a prerequisite.
What's the difference between a VPN and zero trust?
A classic VPN grants access to the entire network. Zero trust network access grants access only to individual applications and checks the user, the device and the device's condition every time. That shrinks the attack surface considerably.
Are a username and password enough for VPN access?
No. Multi-factor authentication should always be enabled for VPN access. A VPN that opens with just a username and password is useless once credentials are stolen.
