Business VPN: What It Protects and Where Its Limits Are
A business VPN encrypts remote workers' traffic and can restrict access to company services. At the same time, VPN credentials become a key to everything the VPN connects to. A VPN can also slow connections down, and it needs upkeep. This guide shows how to get the benefits without the biggest risks.
A business VPN is an encrypted connection from an employee's device to a server the company manages or has chosen. It protects traffic on networks nobody in the company has checked, such as hotel or café WiFi. But a VPN is not simply an extra layer of protection. It brings risks of its own, and they are worth knowing before you roll one out.
This guide draws on Cloudflare's Learning Center articles on business VPNs and VPNs in general. Cloudflare sells Zero Trust as a VPN replacement, so its articles are clear about the limits of VPNs. We also explain what those limits mean for a business rolling out a VPN.
The difference between consumer and business VPNs, and setting one up on a phone, are covered in the guide mobile VPN for business.
What businesses use VPNs for
Cloudflare divides business VPNs into two groups. A remote access VPN connects an individual user's device to the company network. A site-to-site VPN joins several offices into one network, so users in the office don't need to switch on a VPN themselves. When they leave the office, they lose that access.
A third option is a commercial VPN, which routes the user's traffic to the internet through the provider's servers. In the version built for business use, the company manages users and settings centrally. If the service includes a dedicated IP address, the company's own services, such as an admin panel or a server, can be opened only to that address. This is done with an IP allowlist.
In every model the goal is the same: traffic containing company data does not travel unencrypted over the open internet.
Risk 1: VPN credentials open everything
According to Cloudflare, the biggest security risk of a VPN is its credentials. If an attacker obtains a remote employee's VPN credentials, they can reach all applications and data on the network the VPN connects to. Cloudflare compares this to a castle and moat: once attackers cross the moat, the whole castle is in danger. One compromised account or device is enough.
The risk grows if the VPN has its own logins that nobody manages. Someone leaves the company, but their VPN login stays active because it wasn't on the leaver's checklist.
How to reduce the risk:
- Enforce two-factor authentication for every VPN user. A password alone is then not enough.
- Connect VPN sign-in to your company's identity management, if you have one. When a user is disabled there, their VPN access ends too.
- Don't open the whole network with the VPN if the user needs only one service. Limit access to the services people need for their work.
- Use a different password for the VPN than anywhere else. Credential stuffing is explained in the guide a strong password won't protect you if you use it everywhere.
Risk 2: a VPN slows connections down
When traffic goes through a VPN server, the route gets longer. According to Cloudflare, a cloud-based VPN adds latency to every request between the employee and the network, because the VPN server sits in a different place from the company network.
In practice, the delay shows up in video calls and large file transfers. Two settings help. Choose a VPN server close to the user or to the service. Use split tunnelling, so that only part of the traffic goes through the VPN. Split tunnelling does mean that some traffic travels outside the VPN, so decide deliberately which traffic goes into the tunnel.
Risk 3: cloud services don't go through the VPN
Many of a company's tools are cloud services rather than systems on its own network. According to Cloudflare, these applications usually don't work through a traditional business VPN and rely on their own security tools instead. The company's IT team doesn't fully control those tools and can't always see who is logging in.
So a VPN does not protect a login to Microsoft 365 or your accounting software. There, protection comes from the service's own two-factor authentication and from using a unique password for every service. If a cloud service lets you restrict logins by IP address, the VPN's dedicated IP adds a further layer.
Risk 4: someone has to maintain it
According to Cloudflare, VPNs take a lot of effort to maintain. The VPN app must be installed on every remote employee's device and kept up to date. If the VPN server is on the company's own premises, the hardware has to be replaced when it can no longer withstand current threats or when more users join.
In a small business, the upkeep often falls to one person who has other work to do. You can hand the upkeep to a service where the vendor maintains the servers and the apps are deployed to devices in a managed way. Managed deployment uses MDM tools such as Intune, Jamf or Google Workspace.
What about Zero Trust?
Cloudflare recommends a Zero Trust model in place of a VPN. In Zero Trust, no user is trusted by default. In practice, access is checked separately for each application. The model solves some of the VPN's problems, especially the way one login opens the whole network.
Zero Trust is not a single product. It is a way of building access control, and rolling it out takes planning. For many small businesses, a sensible start is a managed VPN, enforced two-factor authentication and restricted access. The same principles can be extended later.
What a VPN doesn't do
A VPN protects traffic in transit. It doesn't stop phishing, where an employee enters their password on a fake sign-in page. It doesn't replace updates or email security either. These are covered in the guide mobile VPN for business and the guide on SPF, DKIM and DMARC.
Cloudflare also points out that a VPN is only as trustworthy as its provider. All your traffic passes through the provider. Choose one whose owner and home country are known.
A managed VPN from ResaHost
ResaHost delivers a managed VPN service for businesses with Proton VPN for Business. The vendor is Proton AG, a Swiss company based in Geneva. We handle the rollout, users and settings.
From the Proton VPN for Business admin panel, two-factor authentication can be enforced for the whole organisation. The VPN can be kept always on, and a kill switch cuts the connection if the VPN drops. Apps can be deployed to devices with MDM tools. The VPN Professional plan includes dedicated IP addresses, network segmentation, access rules and an audit log, as well as SSO with Okta, Microsoft Entra ID and Google Workspace. Pricing is agreed in a quote based on the number of users. The service page is currently in Finnish, so contact us for a quote.
Sources
- Cloudflare: What is a business VPN? https://www.cloudflare.com/learning/access-management/what-is-a-business-vpn/ (read 19 October 2026)
- Cloudflare: What is a VPN? https://www.cloudflare.com/learning/access-management/what-is-a-vpn/ (read 19 October 2026)
- Cloudflare: VPN security https://www.cloudflare.com/learning/access-management/vpn-security/ (read 19 October 2026)
- Proton VPN for Business features: ResaHost service page /palvelut/vpn/, vendor information at proton.me/business/vpn
Frequently asked questions
Does a small business need a VPN?
Yes, if employees use public networks or if you want to open company services only to a specific IP address. If all your tools are cloud services, each service's own two-factor authentication matters more.
What is the biggest risk of a VPN?
Credentials. According to Cloudflare, an attacker who obtains a remote employee's VPN credentials can reach all applications and data on the network the VPN connects to. That is why two-factor authentication should be enforced for everyone.
Does a VPN slow down my connection?
It can, because traffic goes through the VPN server. A nearby server and split tunnelling reduce the delay.
Does Zero Trust replace a VPN?
It can, but Zero Trust is a way of building access control rather than a single product. For a small business, a managed VPN with enforced two-factor authentication is often a faster start.