PCC Learning Center · Tech Guides
What Is a VPN?
A virtual private network creates an encrypted connection between a device or location and another network. For a business, it is commonly used to provide controlled remote access to internal resources.
The Short Answer
VPN stands for virtual private network. It uses encryption to create a protected connection, often called a tunnel, across a network the organization does not control, such as the public internet.
When an employee works remotely, a business VPN can connect that employee’s device to approved systems inside the company network. A VPN can also connect two business locations or connect an office network to a cloud environment.
Plain-English comparison: A VPN is like a protected passage through a public area. The passage helps prevent outsiders from reading the traffic moving through it, but the business must still decide who may enter and which doors they may open after arrival.
How a Business VPN Works
- The employee starts the VPN client or the managed device connects automatically.
- The VPN service verifies the user, device or both.
- The device and VPN gateway establish an encrypted connection.
- Traffic covered by the VPN policy travels through that connection.
- Network rules determine which internal resources the employee can reach.
A secure connection does not mean unrestricted access. The VPN gateway, firewall and identity policies should limit each person to the resources required for their work.
Common Business VPN Uses
Remote-access VPN
An individual employee connects from a managed laptop to the company network. This is the arrangement most people mean when discussing a work VPN.
Site-to-site VPN
Two networks, such as an office and a branch location, maintain an encrypted connection between their gateways. Employees may use the connection without starting a VPN client themselves.
Cloud connectivity
A business network may connect to resources hosted in a cloud environment through a VPN gateway. Whether this is the right design depends on performance, availability, security and application requirements.
Business VPN Versus Consumer VPN
| Business VPN | Consumer privacy VPN |
|---|---|
| Provides access to an organization’s approved networks or resources. | Routes internet traffic through a commercial provider’s network. |
| Managed by the business or its technology provider. | Purchased and controlled by the individual user. |
| Uses company identity, device and access policies. | Usually focuses on changing the visible internet address and encrypting traffic to the provider. |
| Should be monitored as part of business security operations. | Does not provide access to internal company systems unless separately configured. |
A consumer VPN does not automatically make internet activity anonymous. The VPN provider can become another party the user must trust, and websites may still identify users through accounts, cookies, device information and other methods.
VPN Versus Remote Desktop
A VPN creates a network connection. Remote desktop allows a person to control another computer from a distance. They solve different problems and may be used together.
Exposing remote desktop directly to the public internet creates significant risk. If remote desktop is required, access should be restricted through a secure VPN or modern remote-access gateway, protected with MFA and monitored.
Full Tunnel and Split Tunnel
Full tunnel
All covered internet and business traffic travels through the company VPN while connected. This can improve inspection and policy enforcement, but may increase bandwidth use and affect performance.
Split tunnel
Only traffic destined for selected business resources uses the VPN; other internet traffic goes directly to the internet. This can improve performance but requires careful routing and security decisions.
Neither approach is universally correct. The decision should reflect the organization’s applications, network capacity, monitoring capabilities, device controls and risk.
What a VPN Protects
- Traffic traveling through the VPN tunnel from interception on an untrusted network
- Internal resources from being directly exposed to every internet user
- Remote connections by requiring authentication before network access
- Connections between offices, remote workers and selected cloud networks
What a VPN Does Not Replace
- MFA: A stolen password can still give an attacker valid VPN access if a second factor is not required.
- Endpoint security: A compromised laptop can carry malicious activity through an encrypted connection.
- Patch management: VPN gateways and clients must be updated; attackers actively target vulnerable remote-access systems.
- Access control: Connecting to the network should not grant every employee access to every system.
- Cloud-application security: Many Microsoft 365 and other SaaS sign-ins occur directly over the internet and require their own identity controls.
- Monitoring: Connection logs and unusual remote-access behavior still need review.
Important: Encryption protects the connection; it does not prove that the person, device or activity using the connection is safe.
Why Traditional VPN Access Can Create Risk
A traditional VPN may place a remote device inside a trusted network boundary. If access is broad, a compromised account or device may be able to reach more systems than the employee needs.
CISA and international partners recommend that organizations evaluate modern approaches such as zero-trust network access, Secure Service Edge and Secure Access Service Edge. These approaches can provide more application-specific access and visibility than a traditional network-level VPN. That does not make every VPN obsolete; it means the access design should match the resources and risk rather than assuming that one tunnel should reach everything.
Questions a Business Owner Should Ask
- Who is allowed to use the VPN, and is access removed promptly during offboarding?
- Is MFA required for every remote user, including administrators and vendors?
- Are only managed, encrypted and security-monitored devices allowed to connect?
- Which systems can each user or group reach after connecting?
- Is the VPN gateway patched, supported and protected from unnecessary internet exposure?
- Who reviews connection logs and investigates unusual activity?
- Do we know when a device has stopped receiving VPN or security updates?
- Is full tunneling or split tunneling used, and why?
- Would application-specific or zero-trust access reduce our exposure?
- What is the fallback plan if the VPN service or internet connection fails?
The Business Takeaway
A VPN can provide secure remote connectivity, but it is only one part of the access design. Strong authentication, managed devices, limited permissions, current software, monitoring and clear ownership determine whether the connection is actually safe.
The practical question is not simply, “Do we have a VPN?” Ask, “Who can connect, from which devices, to what resources and under whose monitoring?”
Sources and Further Reading
Is your remote access broader than it needs to be?
PCC can help you review who can connect, which devices are trusted, what resources are reachable and whether a more limited access model would reduce risk.