Remote work has become the norm in companies, and with it the VPN. An accountant connects to the accounting server from home, a project manager to the file server from a client’s office, a supplier to the warehouse system to update an application. All of them go through the same VPN, often with the same password that someone set four years ago.
At the same time you hear that VPN is “outdated” and everyone is moving to Zero Trust. The reality is simpler: a VPN is still a perfectly good solution for many companies if it is set up properly, but it has limits that are worth knowing as the company grows.
In this article we explain how a company VPN actually works, why without a second authentication factor it is more dangerous than having none, where its capabilities end, what Zero Trust means without the jargon and how to decide which model suits you now.
How a company VPN works and what it actually does
A VPN (virtual private network) creates an encrypted tunnel between an employee’s computer and the company network. Once connected, the employee is effectively sitting in the office: they see servers, printers, shared folders and internal applications. This solves two problems. First, data is encrypted on the way, so public hotel Wi-Fi is no longer a threat. Second, internal systems do not have to be exposed to the internet, since they are reachable only through the tunnel.
But it is important to understand what a VPN does not do. It checks who is connecting only at the moment of login. It does not check whether the computer being used is secure. And a connected employee usually gets access to the whole network, not just to the systems they need. An accountant who needs the accounting server also sees the file server, the warehouse system and every other computer in the office.
Why a VPN without 2FA is an open door
This is the most common problem we find when we take over VPN maintenance. The VPN is protected only by a username and password. The password is often the same as the e-mail password. The e-mail password leaked a year ago through some external portal where the employee registered with a work address.
The result: an attacker with a leaked password connects to the VPN from anywhere in the world and ends up inside your network with the same rights as the employee. This is exactly how most ransomware attacks begin, not through a sophisticated break-in but through a VPN with a known password.
A second authentication factor (2FA) removes this condition: without confirmation on a phone or a hardware key, the password is worthless. This is not an extra recommendation but the minimum requirement without which a VPN should not be switched on. In the VPN solutions we manage, 2FA is mandatory from day one, and for ERP hosting customers a VPN with 2FA is included in the service.
Two more things must go together with 2FA: separate accounts for each person (not a “shared accounting VPN account”) and revoking access on the same day an employee or supplier leaves.
Where the limits of a VPN are
Even a properly configured VPN has limits that become visible as the company grows.
A flat network. A connected employee sees everything. If their computer is infected, the malware sees the same through the tunnel. Network segmentation reduces this, but it requires constant maintenance.
An unverified device. A VPN lets in an employee’s personal computer with an outdated system and no antivirus in exactly the same way as a company-managed laptop.
Cloud systems. More and more company applications run not on an office server but in the cloud: Microsoft 365, CRM, accounting. They do not need the VPN, but they remain reachable with just a password if nobody has set up an access policy.
Suppliers and partners. Every external supplier gets a VPN account that gives access to the entire network for the sake of one system. A year later there are ten such accounts and nobody knows which are still needed.
If you recognise at least two of these situations, the VPN is no longer the main security solution, only one part of it.
Zero Trust in plain words
Zero Trust is not a product you can buy. It is a principle: trust nobody simply because they are inside the network. Every access to every system is checked separately, using three questions:
- Who is connecting? The user is verified with a password and 2FA, and their account is active.
- From which device? The device is known, up to date, has working protection and an encrypted disk.
- To what? The employee gets access only to the system they need, not to the whole network.
In practice this means that the accountant connects directly to the accounting system, not to the network. The system checks their identity and the state of their computer and lets them into accounting only. If the computer does not meet the requirements, access is denied, regardless of whether they are sitting in the office or at home.
In a Microsoft environment a large part of this principle is already there: Entra ID conditional access checks the user and the device at every sign-in to Microsoft 365 and other connected applications. For older internal systems that run only on an office server, application gateways are used, which expose a single application rather than the whole network.
Zero Trust is not the opposite of a VPN. In many companies they work together: Zero Trust access to the cloud and core applications, and a VPN to the remaining internal systems, but already with 2FA, device checks and a segmented network.
When a VPN is enough and when it is time to move
A VPN with 2FA is enough when the company has up to a few dozen employees, one or a few internal servers, all employees use company-managed computers and external supplier access is rare and controlled. In that case the main thing is not to change the technology but to maintain the existing one: update the VPN equipment, review accounts, monitor logins.
It is worth thinking about a move to a Zero Trust model when:
- The number of employees and devices is growing, and some of the devices are personal.
- Your core systems are already in the cloud, and the VPN is used only for a few older servers.
- You have many external suppliers who need access to one specific system.
- NIS2 or DORA applies to you, and those rules speak directly about access control, the principle of least privilege and device management.
- An incident has happened, or nearly happened, in which someone connected to the VPN with someone else’s credentials.
The move is not a single project. It usually happens in stages: first 2FA and account hygiene, then conditional access to Microsoft 365, then device management, and finally application gateways in place of a broad VPN. Each stage brings benefit on its own.
How MDP CLOUD maintains a VPN
A VPN is not a one-time installation but a system that ages. Our VPN network management covers what most often remains undone: updates of VPN equipment and software, because VPN gateway vulnerabilities are among the most frequently exploited; a monthly review of accounts and removal of departed employees and suppliers; 2FA for everyone without exception; login monitoring that reports logins at unusual times or from unusual places; and network segmentation, so that a VPN user sees only what they need. When the company is ready, we gradually add conditional access and device management to the same VPN, without halting work and without starting from scratch.
Where to start
- Check whether your VPN has 2FA. If not, this is the first and most important step, and it can be done within a few days.
- Pull the list of VPN accounts and disconnect all whose owners you can no longer name. Replace shared accounts with personal ones.
- Check the firmware version of your VPN equipment and whether the manufacturer still supports it. Unsupported VPN equipment is an open door even with 2FA.
- List the systems employees actually connect to through the VPN. It often turns out that half of them are already in the cloud and do not need the VPN.
- If nobody can maintain this continuously, VPN network management or broader IT support for companies takes over these jobs as daily routine.
A VPN is not outdated. What is outdated is a VPN without 2FA, without maintenance and with accounts that nobody reviews. That is a good place to start.
