What is a VPN, and does your business still need one?
How business VPNs work, where they still make sense, and why many organisations are replacing them with zero trust access.
By the Telappliant team
A VPN creates an encrypted tunnel between a device and a network, so remote staff can reach internal systems as if they were in the office. It solved the right problem for a decade. The question now is whether your applications still live somewhere a tunnel needs to reach.
How a business VPN works
The device authenticates to a concentrator, usually the firewall, and traffic for internal networks is routed through an encrypted tunnel. Split tunnelling sends only internal traffic down the tunnel; full tunnelling sends everything, which gives you inspection at the cost of performance.
Where a VPN still earns its place
- Line-of-business applications hosted on premise or in a private data centre
- Access to file servers, print services and management interfaces
- Site-to-site links between offices
- Engineering and management access to network equipment
Why it is being replaced
Most work now happens in Microsoft 365 and other cloud services, which the tunnel does not need to reach. Worse, a VPN grants broad network access once a user is in, so a stolen credential becomes a foothold on the whole network. Unpatched VPN appliances have also been among the most exploited entry points of recent years.
Zero trust network access, briefly
ZTNA publishes individual applications rather than networks. Each request is authorised on identity, device posture and context, so a compromised account reaches one application rather than everything. For a hybrid estate it usually runs alongside a shrinking VPN rather than replacing it overnight.
If you keep a VPN, do these
- Patch the appliance urgently; VPN gateways are actively targeted
- Enforce MFA on every VPN login without exception
- Restrict what the tunnel can reach with internal segmentation
- Require device compliance, not just a username and password
- Log and review connections, especially from unusual locations
Consumer VPNs are a different thing
Advertised privacy VPNs protect traffic on hostile networks and change your apparent location. They do not provide access to company systems, and they are not a security control for a business estate.
Next steps
Frequently asked questions
Was this article helpful?
