A business VPN encrypts traffic between a user or site and your network and lets remote staff reach internal resources. It does not verify that a device is healthy, limit what a logged in user can reach, or stop phished credentials. Treat it as one layer, not a perimeter.
What is a business VPN used for?
Two uses dominate. A site to site VPN connects offices or a cloud network over the internet. A remote access VPN lets an individual device join the network from anywhere. NIST SP 800-77 Revision 1 covers IPsec VPNs for these cases and also discusses alternatives and when each may be appropriate.
Common benefits are protecting data in transit across untrusted networks such as public wifi, reaching internal systems that are not exposed to the internet, and presenting a stable source address to partners.
What are the limits?
It protects the path, not the endpoint. The tunnel encrypts traffic from the device to the gateway. If the device is infected, the VPN extends the infection's reach into your network.
It does not fix weak authentication. A phished password plus no second factor gives an attacker a working tunnel.
It often grants too much. Many deployments drop the user onto a flat network. One compromised account then sees far more than it needs. Pairing a VPN with segmentation and per application access narrows that.
The gateway is a target. It is internet facing by design, so unpatched VPN software is an obvious way in. Keep it on a fast patch schedule, expose only the services you need, and watch its logs.
It adds a hop. All traffic may route through a central point, which can slow some work and create a single point of failure.
Does a VPN hide you from everyone?
A VPN hides your traffic from the local network and from observers between you and the gateway. It does not hide it from the VPN operator, and it does not make a website trust you. For a business, that is acceptable: the point is private access to your own resources, not anonymity.
Constructed example: the contractor laptop
A contractor gets VPN access for a one month project on a personal laptop. The laptop already carries credential stealing malware. The attacker waits for the VPN to connect, then scans the internal address range and finds a file server open to every VPN user. The VPN worked as designed. The failure was granting a flat network and accepting an unmanaged device.
Better: put contractors in a separate group that reaches only the project systems, require device checks where possible, and expire the access on the project end date.
What should you ask before relying on one?
Ask who runs the gateway and how fast they patch it. Ask whether logins are tied to your identity provider so leavers lose access the same day. Ask what a user can reach after connecting, and whether those rights match the job. Ask how you would know if a session was misused: where the logs go and who reads them. And ask what happens if the gateway is down, since remote staff may be unable to work.
When is a VPN the right tool?
It fits well for reaching legacy systems that only live on an internal network, for linking offices and cloud networks, and for protecting traffic on untrusted networks. It fits poorly as the only control for cloud applications that already use their own strong login and encryption. For those, per application access and device checks often give tighter control with less friction.
How to check or apply this
- Inventory every VPN gateway and the software version it runs, and set a patch deadline.
- Require multi factor authentication for every remote login.
- Map what each VPN group can reach. Cut broad ranges down to the systems each role needs.
- Log VPN sessions and alert on odd times, locations and volumes.
- Review who has access every quarter and remove leavers and expired contractors.
- Decide whether some applications should be reachable through per application access instead of a full network connection.
Quick check
Does a VPN replace a firewall?
No. A VPN protects the connection. A firewall and segmentation decide what traffic is allowed once connected.
Is a VPN enough to secure remote work?
No. You also need strong authentication, device management, patching and limits on what each user can reach.
Sources
- NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
- RFC 4301, Security Architecture for the Internet Protocol
Last reviewed: 18 October 2026.
