Does a Small Business Need a VPN?
5 min read
Say VPN and most people picture the monthly subscription used to watch video from another country. What a company builds is a different thing that happens to share a name, which is why these conversations so often start at cross purposes. A company VPN solves exactly one problem: letting people who are not in the office reach internal resources safely. This piece answers whether you need that at all, when the money is better spent elsewhere, and what you take on the day you switch one on.
1. Two things called VPN, pointing opposite ways
The consumer product routes your connection through a server in another country before it goes out, so the site you visit thinks you are there. The purpose is to change location and hide origin. It has nothing to do with your company's data.
A company VPN points the other way. It sits at the entrance to the office network and lets a machine outside be treated, temporarily, as a machine inside. The purpose is not going out. It is coming back in. Hold on to that sentence and the rest of the decisions follow.
2. What a company VPN actually buys you
Think of it as an encrypted tunnel. Once a laptop connects, it behaves roughly as though it were plugged into a cable in the office and can see internal machines and services. Traffic is wrapped up, so anybody in between sees nothing useful.
Encryption is not the main prize. The real value is that with a VPN in place, those internal services do not have to face the internet at all. Anything not published is not found by the automated scanning that runs across the whole address space every day, and never appears on anybody's list of exposed services. Reducing what is exposed, rather than protecting what is in transit, is the honest description of what you are buying.
One caveat. Wrapping the connection says nothing about the machine at the far end of it. The NIST guide to remote access treats client devices as part of what has to be secured, precisely because they get carried into environments the company does not control. An infected laptop connecting over VPN brings the infection straight into the internal network.
3. When you genuinely need one
The test is simple: where do the things you need live? Things that live inside the office need a route back in when people are away. Things that live in a hosted service were never inside the office network, so a VPN adds nothing.
| What you need to reach | VPN needed | Why |
|---|---|---|
| Internal stock, reporting or ERP systems | Yes | These were rarely designed to face the internet, and publishing them directly carries real risk |
| An office NAS or file server | Yes | Coming in through the network is far safer than exposing the whole appliance |
| Printers, cameras and machinery on the internal network only | Yes | This equipment is patched rarely if ever, which is the last thing you want facing outward |
| Google Workspace or Microsoft 365 | No | These are designed to be reached from the internet, and a VPN in front adds no security |
| The admin panel of your own website | Usually no | It is a public service by design. Two-factor authentication and login rate limits are the answer |
The first three rows share a trait: without a VPN they would have to be published to the internet, and none of them was built for that environment. What the VPN buys, in those cases, is not having to publish them.
4. When the money is better spent elsewhere
Plenty of companies ask about a VPN while their actual situation is this: files in a cloud drive, mail in a hosted mailbox, accounts in a web application, and an office containing some laptops and a printer. There is no internal resource to come back to. A VPN would have nothing to serve and would add one more machine to look after.
The other common argument is that staff use public Wi-Fi and that is dangerous. It carried real weight a decade ago and much less now, because almost everything runs over encrypted connections and passwords being read off the wire is no longer the main risk. Public Wi-Fi still deserves care, and what deserves it now is fake hotspots and phishing pages, neither of which a VPN prevents.
5. The upkeep you take on
A VPN is not finished when it is installed. It becomes a door in your network that faces outward, and doors need looking after. That cost belongs in the decision, otherwise what you have bought is the appearance of security.
Five things to be sure of before you build one
- Somebody owns updates. Security updates get applied within days of release, not months. Without that, none of the other four matter.
- Accounts come from the system you already use. Suspending somebody in one place should end their VPN access too, rather than maintaining a second list that only this system knows about.
- The VPN gets two-factor authentication as well. A VPN protected by a password alone is your internal network locked with a key that may already have leaked.
- Being connected does not mean reaching everything. Split access by department. Accounts staff need the accounting system, not every machine in the building.
- It keeps logs. Who connected, when, and what they reached. On the day something goes wrong, that is the only thing capable of answering the question.
If nobody can commit to those five, a VPN may add more risk than it removes. One that nobody updates, with a password the whole company shares, is an attacker's preferred entrance, because getting through it puts them inside.
6. The alternatives to building one
If only one or two internal systems need reaching from outside, ask the vendor whether a hosted edition exists, or whether the product supports secure access to that single system. Moving one application to a hosted version is often cheaper than standing up a VPN for its sake, and the upkeep goes back to the vendor.
Another approach people reach for is publishing the internal system and restricting the firewall to specific addresses. Between fixed offices that works. Staff working from elsewhere are usually on addresses that change, so the list needs constant editing, and over time these tend to get widened until they no longer restrict anything.
Zero trust, which comes up a lot lately, points somewhere different. The NIST definition of zero trust architecture puts it plainly: no trust is granted to an account or a device merely because of where it sits on the network. Being inside is not a pass. Every request has to establish identity and permission again.
For a small business zero trust is not a product you can buy, it is closer to a principle. Two things get you most of the way: make every system require its own login with two-factor authentication, and split permissions by role. Do those and you have the highest-value part of the idea, without replacing any equipment.
Whether you need a VPN depends on where your things live. Internal systems, a NAS, equipment reachable only from the office network: that makes a VPN a reasonable investment, provided somebody maintains it. If everything is in hosted services, two-factor authentication and disciplined account management will do more than a VPN nobody updates. The worst option is not going without. It is building one and leaving it unattended.
Common questions
- Does a small business need a VPN?
- It depends where your data lives. If the company runs internal stock or reporting systems, a NAS, or equipment reachable only from the office network, and people need those from outside, a VPN is reasonable. If files, mail and accounting all sit in hosted services and there is nothing internal to come back to, a VPN helps very little. In that case two-factor authentication and same-day leaver account handling are the better use of the effort.
- Is a company VPN the same product I can subscribe to?
- No. A consumer VPN routes your connection through a server elsewhere so you appear to be in another country. A company VPN sits at the entrance to your own network and lets outside machines reach internal resources safely. They point in opposite directions. A monthly subscription will not let you open the office NAS, and the two cannot substitute for each other.
- With a VPN in place, can we skip two-factor authentication?
- The opposite. The VPN needs it most, because it is a door that faces the internet, and with only a password in front of it one leaked credential puts somebody inside your network. What they can reach from there is usually more than any single hosted service would expose. Turn it on for the VPN, and do not relax the logins on internal systems just because a VPN sits in front of them.