What a VPN actually does, in plain terms
A VPN creates an encrypted tunnel between a device and a specific network or service, protecting the traffic inside that tunnel from being read or tampered with on the network in between. That is genuinely useful for some situations and irrelevant for others, which is why 'do we need a VPN' does not have one universal answer.
When a VPN is genuinely worth it
A VPN earns its place when there is a real, specific need for a protected connection to a private resource.
- Remote staff need to reach an internal server, file share, or line-of-business application that is not otherwise exposed to the internet
- Staff regularly connect from untrusted networks (hotel Wi-Fi, client offices) to access sensitive internal systems
- A compliance or client requirement specifically calls for VPN-protected access to certain data
When a VPN is not the tool you need
Many small businesses install a VPN out of general security instinct when a different control would actually solve their problem better.
- If everything you use is already cloud-based (Microsoft 365, Google Workspace, a SaaS line-of-business app), those services are already reached over encrypted HTTPS, and a VPN adds little beyond what strong MFA and Conditional Access already provide
- A VPN does not protect against phishing, malicious downloads, or weak passwords; a common myth is that 'the VPN handles security', but a VPN only protects the connection, not the endpoint or the user's judgment
- Split-tunnel VPN configurations that route only some traffic through the tunnel can create confusing gaps in protection if misconfigured
If you do set one up, configure it properly
A poorly configured VPN can create a false sense of security while leaving real gaps.
- Require MFA to connect to the VPN itself, not just a static password
- Avoid split tunnelling where possible, since it can bridge an open network connection with your secure tunnel
- Keep VPN client and gateway software patched; VPN appliances are a common target for exploitation when left outdated
- Log and periodically review VPN connection activity for unfamiliar locations or times
A simpler alternative many small businesses miss
For businesses whose only goal is 'staff should be able to work safely from anywhere', modern cloud identity controls, MFA everywhere, Conditional Access policies, and device compliance checks often solve the problem more effectively than a traditional VPN, without the overhead of maintaining VPN infrastructure at all.
Frequently asked questions
Do we need a VPN just to use public Wi-Fi safely?
It helps, since it encrypts your traffic on an untrusted network, but avoiding sensitive logins on public Wi-Fi entirely, or using your phone's cellular hotspot instead, solves the same problem without needing dedicated VPN infrastructure for occasional use.
Is a free consumer VPN app good enough for business use?
Generally not recommended for business data. Free consumer VPN providers vary widely in trustworthiness and some log or sell traffic data, which defeats the purpose. Business use calls for a properly configured business VPN or, more often today, cloud identity controls instead.
Can a VPN slow down our internet connection?
Yes, since traffic routes through an additional encrypted hop, which can add latency depending on the VPN provider and server location. This is a real tradeoff to weigh against the specific problem the VPN is meant to solve.