Home / Knowledge hub / VPN
Knowledge hub
VPN
An encrypted tunnel that links a device or office network to another network.
What it means
A virtual private network, or VPN, creates an encrypted tunnel between a device or a site and another network. Traffic inside the tunnel cannot be read on the way, and the device behaves as if it were on the far network. Companies use it to reach internal systems; individuals use it on untrusted Wi-Fi.
The idea that makes it click: a VPN protects the journey, not the destination. It hides traffic from people along the path. It does nothing about a flaw in the application at the other end, and anyone who gets onto the VPN may be trusted far more than they should be.
Why it matters
Many internal tools sit behind a VPN on the assumption that this makes them safe. That is a gamble. One stolen VPN credential, or one infected laptop already connected, gives an intruder a path to everything the network allows. VPN appliances have also been targeted themselves through zero-day flaws.
For customers and auditors, the question is what a connected person can reach. A flat network where a VPN login opens everything fails the idea of least privilege and makes lateral movement easy after a single compromise. Treat connection as the start of access control, not the end.
How it shows up
You meet VPNs in staff remote access, site-to-site links between offices and cloud networks, and developer access to staging or databases. Typical faults are shared VPN accounts, no multi-factor authentication, unpatched VPN gateways, and former staff whose access was never removed.
Treat the VPN as one layer. Give each person access only to the systems they need, require MFA, patch the gateway promptly and log connections. Do not put an admin panel or a debug interface on the public internet and call a VPN optional. Newer designs move toward zero trust, checking each request, not trusting the network.
Questions people ask
VPN, answered
Does a VPN make our web app secure?
No. A VPN protects traffic between two points and can restrict who reaches an internal service. It does not fix injection, broken access control or logic flaws in the application.
Anyone who can reach the app, including through the VPN, can still try those.
Is a VPN the same as HTTPS?
No. HTTPS encrypts the connection between a browser and one website. A VPN encrypts traffic between your device and the VPN network, often covering everything the device sends.
They protect different stretches of the journey and are commonly used together.
Should internal tools be behind a VPN only?
It is a sensible layer, but not enough alone. Still require sign-in, authorisation checks and logging inside the tool.
If one VPN login is compromised, the tool's own controls are what remain.
What is a site-to-site VPN?
A permanent encrypted link between two networks, such as an office and a cloud network, so systems on each side can talk as if on one network.
The risk is that a compromise on one side can spread to the other unless traffic is limited.
How do we test a VPN setup?
Check the gateway's patch level, whether MFA is required, what each type of account can reach after connecting, and whether old accounts still work.
A test from a normal account tells you more than a configuration review alone.
Sources
Where this comes from
Related
Terms that sit next to this one
Zero trust
Assuming the network proves nothing, and checking every request.
Least privilege
Giving every person and service the minimum access the job requires.
Lateral movement
Moving from the first thing reached to the things worth taking.
Encryption in transit
Protecting data while it travels between a browser and your servers.
MFA
A second proof beyond the password, usually a code or a hardware key.
What does a connected account reach?
We test the web apps and APIs themselves, including what a signed-in account can reach that it should not, because a tunnel does not fix those. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.