The office network used to be the boundary. Now the boundary is a set of identities and devices scattered across the county, and most small businesses are still protecting the building.
When everything lived on a server in the office, security had a shape: a firewall between inside and outside. Remote work dissolved that. The applications are in the cloud, the people are anywhere, and the data is on laptops you may not own.
The instinct is to rebuild the old shape with a VPN. That is usually the wrong tool, applied for the right reasons.
What a VPN does and does not do
A VPN encrypts traffic between a device and your network. That is genuinely useful if the thing being reached is *on* your network.
If your email, files and applications are in Microsoft 365, the traffic already goes to Microsoft over TLS — routing it through your office first adds latency and a bottleneck without adding protection. And a VPN authenticates the connection, not the device: a compromised laptop with a valid VPN client is a compromised laptop with a tunnel into your network.
What replaces it
- Identity as the control point. Conditional Access decides per sign-in — who, from where, on what device, how risky.
- Device compliance as a condition of access, so an unpatched or unencrypted laptop loses access rather than quietly continuing.
- MFA that resists phishing, particularly for administrators and finance.
- Company data separated on personal phones, so it can be removed without touching anything personal.
- A VPN kept only for the specific things that genuinely live on your network — a line-of-business application, a file server you have not yet moved.
The home network question
Businesses worry about staff home Wi-Fi. It is worth less attention than it gets: if the device is encrypted, patched and enrolled, and the applications use TLS, a weak home network is a modest risk.
The larger risks are the ones that feel more ordinary — the family laptop used for work, the personal phone with company mail and no screen lock, the document downloaded to a desktop and forgotten.
Practical starting points
- Establish which devices actually hold company data. Most businesses cannot answer this, and the answer is usually higher than expected.
- Require a screen lock and disk encryption, and verify rather than ask.
- Enrol company-owned devices; use app protection policies on personal ones.
- Turn on Conditional Access, starting with a report-only policy so you can see the impact before enforcing it.
- Have a written joiner and leaver process. The most common remote-work exposure is not an attacker; it is somebody who left three months ago and still has access.
That last one is worth dwelling on. Every business we assess has at least one account belonging to somebody who no longer works there. It costs nothing to fix and it is the exposure most likely to be exploited by someone who already knows what you have.
Frequently asked
Do we still need a VPN?
Only for what genuinely sits on your own network. If everything is in Microsoft 365, a VPN for everyday work adds latency and a single point of failure without adding much protection. Keep it scoped to the applications that need it.
Can staff use personal laptops?
They can, with app protection policies keeping company data inside a managed boundary that can be removed independently. It is a compromise: less control than a company device, considerably better than nothing, and far more likely to be accepted.
How do we handle someone leaving?
Revoke sessions, disable the account, remove company data from their devices, and transfer mailbox and file ownership before deleting anything. Deleting the account first destroys data you may need and can break shared files.