A virtual private network protects traffic in transit by creating an encrypted tunnel between a device or site and a gateway. Its real benefits are confidentiality, integrity and authenticated access to a private network. It does not secure the device, stop phishing, or make an untrusted site safe.
What does a VPN actually do?
NIST SP 800-77 Rev. 1, its guide to IPsec VPNs, says a VPN can provide several types of data protection: confidentiality, integrity, data origin authentication, replay protection and access control. VPNs can carry communications across public networks such as the internet and across private ones such as fiber or MPLS networks.
That guide describes the main architectures. Gateway-to-gateway protects traffic between two networks, such as a head office and a branch. Remote access, also called host-to-gateway, connects a single user device to an organization's network. Each choice changes who is trusted and what is exposed.
What are the benefits for a business?
Three stand out. First, it encrypts traffic on networks you do not control, which protects against eavesdropping and tampering on the path. Second, it lets remote staff reach internal systems that are not exposed to the internet, so the internal service never needs a public address. Third, the gateway becomes a place to apply authentication and logging for remote access.
The second one is often the most valuable. Reducing exposed services reduces the attack surface, and CISA's ransomware guidance explicitly advises not exposing services such as remote desktop on the web.
What are the limits?
A VPN does not check what the device is doing. A compromised laptop on the VPN is a compromised laptop inside the network. It does not stop a user from entering a password on a phishing page, and it does not protect data once it reaches the destination.
The gateway itself becomes an attractive, internet-facing target. Keeping it patched and requiring multi-factor authentication matters, and this is why many organizations also look at alternatives that grant access per application. Zero trust network access is the usual category to evaluate.
Consumer VPN services add another limit. NIST's guide warns that on some smartphone platforms, questionable VPN implementations exist whose goal is to monitor or modify the user's traffic before it is protected. When you choose a VPN client, who runs the service matters as much as the cryptography. A consumer VPN moves your trust from the local network to the VPN company.
What is split tunneling?
NIST describes split tunneling as a client not sending all of its traffic to the organization's gateway. Traffic for the organization goes through the tunnel and the rest goes directly to the internet. That saves bandwidth, but it also means the device is on the internet and the internal network at once, so policy should decide when it is allowed.
A constructed example
A 30-person engineering firm stores build servers and a code repository on a private network. Staff connect with a remote access VPN that requires a hardware security key. Split tunneling is off for company laptops, so all traffic goes through the gateway, where it is logged. One engineer travels and uses hotel wi-fi. Her traffic is encrypted to the gateway, so the hotel network cannot read it. Later she clicks a link in a phishing email. The VPN does nothing about that, but the key-based sign-in means the attacker's copy of her credentials cannot be used on the real site.
How to check or apply this
- Decide what you need: site-to-site links, remote access, or per-application access.
- Require MFA at the gateway and patch it quickly. It faces the internet.
- Decide on split tunneling by policy, and document why.
- Check device health before granting access if your product supports it.
- Log connections and review them for impossible travel and odd hours.
- Do not rely on a consumer VPN for work access. Understand who operates the service and what they can see.
Quick check
Does a VPN make me anonymous?
No. It moves visibility from your local network to the VPN operator and the destination still sees your account activity. Anonymity is a different goal.
Is a VPN enough for secure remote work?
No. Pair it with MFA, device security, patching and least-privilege access to internal systems.
Sources
Last reviewed: 18 October 2026.
