What a VPN actually does
A VPN — virtual private network — creates an encrypted tunnel between a laptop and another network, usually your office. Everything inside the tunnel is hidden from whoever runs the Wi-Fi you are on, and the laptop behaves as if it were plugged in at the office.
That solves two real problems: reaching things that only exist in your office, like a file server or a line-of-business application, and hiding traffic on untrusted networks. Note what it does not claim to do: a VPN does not check whether the laptop is patched, does not care whether the password was stolen, and does not limit what a connected user can reach. It is a tunnel, not a guard.
Where the office VPN falls short
The classic office VPN has a structural weakness: once you are in, you are in. It works like a building where the front door has a lock but none of the interior doors do. One stolen VPN password, or one unpatched hole in the VPN box itself, and an attacker is standing on your network with the same freedom your bookkeeper has.
VPN appliances are also a favorite target because they must face the public internet to work, and small businesses patch them slowly. Add the everyday frictions — a personal laptop full of who-knows-what joining your network, connections dropping, everything slowing down because traffic hairpins through the office — and the tool starts working against you.
Zero trust, minus the vendor hype
Zero trust is a buzzword wrapped around a simple idea: never grant access to the whole network, only to specific applications, and check every request. Instead of joining the office network, your bookkeeper connects to the accounting system, and nothing else exists as far as her connection is concerned.
Each request is checked on three counts: who you are, proven by a login with MFA; what device you are on, ideally one the business knows is encrypted and up to date; and what you are allowed to reach, decided per application. Someone who steals a password gets one application at most, not a network to explore. That is the whole concept. Everything else vendors attach to the phrase is packaging.
You may need less remote access than you think
Before choosing between a VPN and anything newer, ask a simpler question: what are you actually connecting to? If your email, files, accounting, and CRM are all cloud services, there may be nothing at the office worth tunneling to. Your security perimeter is the login itself, and money is better spent on strong MFA, a password manager, and device encryption than on any tunnel.
Many DMV small businesses I look at keep a VPN running out of habit, protecting a file server that could move to a cloud drive for 12 to 25 dollars a user per month. Retiring the server and the VPN together is often cheaper and safer than securing either one properly.
A sensible setup for a 5-to-25-person team
For a team that does need remote access to something internal, here is the shape I recommend.
- Put specific applications behind a zero-trust access tool rather than opening the network. Entry-level tiers of these services are free or a few dollars per user per month, and setup is days, not months.
- Require MFA on the identity provider — the Google or Microsoft account everyone signs in with — so every application inherits it.
- Only company-managed or verified devices get access to sensitive systems. A personal laptop can read email; it does not touch the finance share.
- If a legacy system truly requires a network tunnel, keep a VPN for that one system, patch the VPN software the week updates appear, and require MFA on it.
The budget for all of this is commonly 0 to 10 dollars per user per month — less than many teams pay for the support contract on their current VPN appliance.
What to do next
- List everything staff reach remotely, and mark which items live in the cloud versus in your office.
- If the office column is empty, plan to retire the VPN and put the savings into MFA everywhere and device encryption.
- If the office column has one or two entries, price a zero-trust access tool against moving those systems to the cloud, and pick the cheaper path.
- Whatever remains internet-facing — VPN box, remote desktop, anything — gets MFA and a monthly patch check, on the calendar, with a name attached.
- Test the result: have someone try to reach the finance system from a personal laptop. If it works, the doors are still open.
If you want a second pair of eyes on that list, an access review is a short, fixed-price engagement — the kind of thing HashWhales does for small teams across the DMV.