What Are the Benefits of a VPN, and What Does It Not Protect?

A virtual private network (VPN) encrypts traffic between a device and a VPN gateway and can give a remote user access to private network resources. That protects data in transit on untrusted networks. It does not clean an infected laptop, stop phishing, or make a service you sign in to forget who you are.

What is the real benefit?

NIST SP 800-77 Rev. 1 describes IPsec as a framework of open standards for ensuring private communications over IP networks, and explains how it provides network-layer security, usually set up through the Internet Key Exchange protocol. In plain terms, the packets between two endpoints are authenticated and encrypted.

That brings three practical benefits:

• Protection on hostile networks. On hotel or cafe Wi-Fi, someone on the same network cannot read or alter the traffic inside the tunnel.
• Private access. A remote worker can reach internal systems that are not exposed to the internet.
• Site to site links. Two offices or a data center and a cloud network can be joined over the public internet.

NIST SP 800-46 Rev. 2, on telework, remote access and BYOD, adds the point that all parts of such setups, including organization-issued and personal devices, should be secured against threats identified through threat models.

What does a VPN not do?

It moves where traffic is encrypted. It does not change what the endpoints do.

• It does not protect an endpoint that already has malware. The malware sits inside the tunnel.
• It does not stop a user from entering a password on a phishing page.
• It does not make a website's server trustworthy. The site still sees your account.
• It adds a trust point: the VPN operator or gateway sees your traffic metadata, so choose it with care.
• Giving a remote device full access to the internal network can turn one stolen laptop into a way in.

Much web traffic is already protected by TLS, so a VPN's benefit on public Wi-Fi is smaller than it used to be. It is still valuable for non-web protocols and for reaching private systems.

When does remote access policy matter more than the VPN?

NIST SP 800-53 control AC-17 Remote Access asks you to establish and document usage restrictions, configuration and connection requirements, and implementation guidance for each type of remote access, and to authorize each type before connections are allowed. The point is that the VPN is a managed path with rules, not a hole.

A constructed example. A finance analyst connects from home with a company laptop and a VPN that lands on a segment with only the accounting application reachable. A contractor on a personal device gets a browser-based session to one system, with no network-level tunnel. The first setup limits what a stolen laptop can reach; the second keeps unmanaged hardware off the network. Both are remote access, with different risk.

How to check or apply this

1. Write down each remote access method you allow and who may use it, as AC-17 expects.
2. Require multi-factor authentication to start any VPN session.
3. Limit what a VPN user can reach to what their job needs, instead of the entire network.
4. Check that devices connecting are managed and patched, or give unmanaged devices a narrower path.
5. Keep VPN gateway software updated, because it sits on the edge and is a high-value target.
6. Log connections and review unusual ones, such as logins from new countries.
7. For personal use, pick a provider carefully and remember it will see where your traffic goes.

Quick check

Sources

• NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
• NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security
• NIST SP 800-53 Rev. 5 control catalog, OSCAL JSON from NIST

Last reviewed: 18 October 2026.