Choose an enterprise VPN by properties you can test: the protocol, how devices authenticate, which client runs, whether the tunnel is forced, and what happens when it fails. Feature lists matter far less. This guide names no vendors and ranks none.
1. Do you need one at all?
The UK NCSC says a VPN adds little if you have fully adopted zero-trust networking, and that you do not need one if none of its benefits apply. NIST's zero trust publication (SP 800-207) frames the alternative: access decisions per request, based on identity and device state, rather than network location. Many companies run both for years, with a VPN for legacy services and zero trust for new ones.
2. Which protocol?
TLS and IPsec dominate. NCSC recommends IPsec because it is an open standard and any compliant client can talk to any compliant server, with clients built into many operating systems. TLS VPNs usually need a third-party client and server from the same vendor, because how TLS is used to build a VPN is not standardized, though they can cross NAT and firewalls more reliably. NCSC sees very little difference in risk between the two. Interoperability is the real tiebreaker: it decides how easily you can switch products later.
3. How do devices authenticate?
Ask whether the product supports per-device certificates with hardware-backed keys. NCSC recommends client certificates over pre-shared keys, since one certificate can be revoked alone. Also ask how revocation reaches the gateway, and how quickly.
4. Which client runs on the device?
Native clients update with the operating system and are generally reliable but limited. NCSC notes third-party clients raise the risk of poor integration and of traffic leaking outside the tunnel, and add one more package to patch. If a product needs its own client, ask for its update mechanism and its history of security fixes.
5. Is the tunnel forced?
Only traffic routed through the VPN is protected. A forced tunnel blocks all other traffic when the VPN is down, which is safer and more disruptive. Optional tunnels let users avoid monitoring. Check how the product handles public Wi-Fi sign-in pages under a forced policy.
6. What happens when it fails?
NCSC warns that a VPN failure can cause organization-wide outages. Ask about high availability, how many concurrent sessions the gateway handles, and what the failover looks like in a test, not in a slide.
7. How is the gateway kept safe?
The gateway faces the internet. Ask how fast the supplier ships security fixes and check the supplier's products against CISA's Known Exploited Vulnerabilities catalog. A flaw listed there has evidence of exploitation in the wild, which is different from a flaw that is merely scored high.
A scoring sheet you can copy
Give each candidate a pass, partial or fail on each question, and record the evidence next to it: a documentation link, a test result, a support answer in writing. Two candidates with the same score often differ on question 6, which is the one nobody tests until an outage.
A constructed example: a 300-person company shortlists two products. Both support IPsec with certificates. One needs a separate client, and its update channel is manual. The other uses the built-in client but cannot split tunnel. The team chooses the native-client product, because patching a client across 300 laptops was the cost they could not afford, and handles split tunnelling with routing rules on the gateway.
How to check or apply this
- Write what the VPN must protect and who must reach what.
- Run the seven questions against each candidate and save the evidence.
- Pilot with ten users, including one on a mobile connection and one on hotel Wi-Fi.
- Run a failover test before signing.
- Plan the exit: how you would move to zero-trust access later without a rip-and-replace.
Quick check
Is a TLS VPN less secure than an IPsec VPN?
According to the NCSC, with all other things equal there is very little difference in risk. IPsec is recommended mainly because it is an open standard with built-in client support.
Should a VPN be forced or optional?
NCSC generally recommends forcing traffic through it, because an optional tunnel lets users evade monitoring. The cost is more friction when the VPN cannot connect.
Sources
- NCSC, Virtual Private Networks (VPNs) device security guidance
- NIST SP 800-207, Zero Trust Architecture
- NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
- CISA, Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
