What Is a VPN and Do You Still Need One in 2026?
VPNs have been part of business IT for years, but the way organisations use them is changing.
For a long time, the explanation was simple:
“A VPN encrypts your internet connection and keeps you safe on public Wi-Fi.”
That is only part of the story.
For businesses in 2026, a VPN is primarily a way of providing secure connectivity between remote devices, offices and private company resources. The NCSC describes VPNs as encrypted network connections that allow remote users to securely access an organisation’s services across untrusted networks.
But modern cloud services, Microsoft Entra ID, Conditional Access and Zero Trust Network Access mean a traditional VPN is no longer automatically the best answer for every organisation.
So what does a VPN actually do, what does it not do, and does your business still need one?
What Is a VPN?
VPN stands for:
Virtual Private Network.
A VPN creates an encrypted connection — often called a tunnel — between two points.
For example:
Employee laptop → Company network
or:
Office A → Office B
The encrypted connection allows information to travel across the public internet while being protected between those VPN endpoints.
For a remote employee, this may provide access to internal resources such as:
File servers.
Business applications.
Internal websites.
Remote desktops.
Databases.
Printers.
Legacy systems.
The current Hamilton Group article correctly describes VPNs as a way of giving authorised remote users access to private business resources.
There Are Different Types of VPN
When people say “VPN”, they can mean very different things.
Remote-Access VPN
This is probably the most familiar business use.
An employee working from home or travelling opens a VPN client and establishes an encrypted connection back to the company.
They may then be able to access resources that are not directly available over the public internet.
Site-to-Site VPN
A site-to-site VPN connects entire networks.
For example:
Harrogate office ↔ York office
Traffic between those sites travels through an encrypted tunnel.
This can be useful when offices need to communicate securely over normal internet connections.
Consumer Privacy VPN
Services advertised heavily to consumers are somewhat different.
They generally route internet traffic through the VPN provider’s infrastructure, primarily changing where internet traffic appears to originate and providing an encrypted tunnel between the device and that provider.
That is not the same problem as:
“How do we securely give an employee access to our internal accounting server?”
Businesses therefore need to be clear about what problem they are actually trying to solve.
Does a VPN Make Public Wi-Fi Safe?
A VPN can provide valuable protection when using an untrusted network because traffic between the device and VPN endpoint is encrypted.
But the old advice that a VPN is the only thing standing between you and catastrophe on café Wi-Fi is too simplistic.
A significant amount of modern web traffic already uses HTTPS, meaning communication between your browser and the website is encrypted.
A VPN adds another layer and can protect traffic that needs to travel to your organisation’s private network.
But it does not magically turn an unsafe computer into a safe computer.
If the laptop:
Has malware.
Is badly out of date.
Has been stolen.
Uses compromised credentials.
Allows an attacker to authenticate.
then a VPN does not solve those problems.
The important principle is:
A VPN protects a connection. It does not automatically protect everything happening at either end of that connection.
A VPN Does Not Stop Phishing
This is probably one of the biggest misunderstandings.
Suppose an employee receives a convincing Microsoft 365 phishing email.
They click it.
They enter their password into a fake login page.
The VPN may be working perfectly.
The employee has still handed their credentials to the attacker.
Likewise, a VPN does not automatically stop:
Malicious attachments.
Credential theft.
MFA fatigue attacks.
Social engineering.
Unsafe browser extensions.
Compromised accounts.
Ransomware.
That is why VPN access needs to sit alongside controls such as EDR, strong authentication, patching, device management and user awareness.
A VPN Should Not Mean “Welcome to the Whole Network”
This is where the traditional VPN model has increasingly come under scrutiny.
Historically, VPN access often worked like this:
Authenticate.
Connect.
Become effectively attached to the corporate network.
The problem is that once somebody is inside that network, they may be able to see far more than they genuinely need.
The NCSC’s remote-access architecture guidance distinguishes between traditional VPN-based remote access and Zero Trust approaches, recommending that organisations with predominantly cloud-based services seriously consider Zero Trust architectures rather than automatically building new traditional VPN environments.
A better question is therefore:
Does this employee need access to the network?
or:
Do they simply need access to one application?
Those are very different things.
The Zero Trust Alternative
Zero Trust is based around the principle that access should be granted according to what a user and device are actually authorised to do rather than assuming that being “inside the network” makes something trustworthy.
That can mean evaluating:
Who the user is.
Which device they are using.
Whether that device is managed.
Whether it meets security requirements.
Which application they want to access.
Whether MFA has been completed.
Whether access appears risky.
Then access can be restricted to the specific resource required.
This reduces the opportunity for an attacker to move around the network after compromising one user.
Microsoft Entra Private Access and VPN Replacement
For businesses heavily invested in Microsoft technology, this area has changed considerably.
Microsoft Entra Private Access is now positioned as a Zero Trust Network Access solution that can provide access to private applications without requiring a traditional VPN. Microsoft explicitly describes VPN replacement as one of its primary use cases.
Rather than broadly connecting somebody to an internal network, organisations can publish specific internal resources and apply Conditional Access policies to them.
Microsoft’s current architecture allows organisations to move from broad VPN-style connectivity towards more granular per-application access, where users receive only the resources they actually need.
For some organisations, that can offer a much stronger long-term architecture than a conventional “connect and enter the network” VPN.
Does That Mean VPNs Are Dead?
No.
Traditional VPNs still make sense in many environments.
The NCSC specifically notes that VPN-based remote access can remain appropriate where organisations have significant on-premises or legacy infrastructure.
For example, you may still need VPN connectivity for:
Legacy business applications.
Internal file servers.
Specialist engineering systems.
Older databases.
Remote infrastructure administration.
Site-to-site connectivity.
Industrial or operational systems.
Networks that cannot easily move to modern identity-aware access.
The correct question isn't:
“Are VPNs old?”
It is:
“Is a traditional VPN the most appropriate way to give this user access to this resource?”
Sometimes the answer is absolutely yes.
Sometimes it isn't.
Secure the VPN Itself
A VPN gateway can also become a valuable target for attackers.
It is normally internet-facing by design, and a compromised edge device can potentially provide direct access into an organisation.
That makes VPN security particularly important.
In April 2026, the NCSC highlighted the continued targeting of routers and other internet-facing infrastructure and advised organisations to pay particular attention to VPN and remote-access connections, implement Zero Trust policies and reduce unnecessary internet-facing exposure.
Businesses should therefore treat their VPN infrastructure as security-critical.
That means:
Keep VPN appliances and software patched.
Internet-facing vulnerabilities deserve rapid attention.
Use MFA.
A stolen password should not automatically provide remote network access.
Restrict access.
Only employees who genuinely need VPN access should have it.
Remove old accounts quickly.
Former employees should not retain remote access.
Use strong cryptography.
The NCSC updated its IPsec guidance in December 2025 and recommends modern cryptographic profiles, with older configurations reserved for legacy equipment that cannot yet be migrated.
Monitor authentication.
Unexpected VPN logins should be visible and investigated.
What About Split Tunnelling?
VPNs can generally be designed so that:
All internet traffic passes through the corporate VPN
or
Only traffic destined for company resources passes through it.
The latter is often known as split tunnelling.
There are trade-offs.
Routing everything through the corporate network can provide greater central visibility and filtering but may also consume significant bandwidth and introduce unnecessary latency.
Split tunnelling can improve performance by allowing ordinary internet and cloud traffic to travel directly.
The correct configuration depends on your architecture and security requirements.
There is no universal setting that is right for every business.
VPN Security Starts With the Device
Imagine you build an excellent VPN.
Strong encryption.
MFA.
Modern firewall.
Perfect configuration.
Then an employee connects using a laptop that has not been updated for 18 months.
You still have a problem.
Remote access should ideally be combined with managed endpoints.
That may include:
Endpoint Detection and Response.
Microsoft Defender.
Disk encryption.
Patch management.
Device management.
Strong authentication.
Application controls.
Security monitoring.
In Microsoft environments, device compliance can also be incorporated into Conditional Access decisions.
The idea is simple:
Being able to enter the right password should not necessarily be enough to connect a completely untrusted device to sensitive company resources.
When Your Business Probably Still Needs a VPN
A VPN may still be a sensible solution if employees need access to:
Internal servers.
Legacy applications.
On-premises file shares.
Network devices.
Private databases.
Infrastructure-management tools.
Other resources that are not designed for direct internet access.
Site-to-site VPNs may also remain entirely appropriate for connecting offices and private networks.
When You Might Not Need One
If almost everything your business uses is already SaaS, the answer can be different.
Suppose employees work almost entirely through:
Microsoft 365.
SharePoint.
OneDrive.
Teams.
Cloud CRM.
Cloud accounting.
Browser-based business applications.
In that environment, routing everybody back into the office network before they can access cloud applications can become unnecessary.
Modern identity-based controls, managed endpoints and Zero Trust access may provide a better architecture.
The NCSC notes that Zero Trust can be particularly effective for organisations with few or no on-premises services.
What a VPN Does — and Doesn't Do
A useful way to think about it is:
A VPN CAN:
Encrypt traffic between VPN endpoints.
Provide remote access to internal resources.
Connect separate networks securely.
Protect data travelling over an untrusted connection.
Hide private internal systems from direct internet exposure.
A VPN DOES NOT AUTOMATICALLY:
Stop phishing.
Stop malware.
Make an infected laptop safe.
Protect stolen passwords.
Secure badly configured internal systems.
Replace MFA.
Replace endpoint security.
Provide a backup.
Make users trustworthy simply because they connected successfully.
It is one security control, not an entire cyber-security strategy.
What About Hamilton Group HG Secure?
Hamilton Group's current VPN service, HG Secure, can provide clients with secure VPN connectivity where remote access to private business resources is appropriate.
But the important part is choosing the right architecture around it.
For some organisations, traditional VPN access may still be exactly what is required.
For others, the better direction may involve Microsoft Entra Private Access, Conditional Access, managed endpoints and more granular Zero Trust access.
Technology should fit the business rather than the business being forced into whichever remote-access solution happens to be familiar.
Do You Need a VPN in 2026?
Possibly.
But don't buy one simply because somebody told you every business needs a VPN.
Start with:
What are employees trying to access?
Where does that resource live?
Which users actually need access?
Which devices should be permitted?
Can we give users only the resources they require?
How will we authenticate them?
How will we monitor access?
Then choose the technology.
That may be a traditional VPN.
It may be Zero Trust Network Access.
It may be a combination of both.
For many organisations, that hybrid approach will remain completely sensible for years.
Secure Remote Access With Hamilton Group
Hamilton Group can help businesses design secure remote-access solutions around their actual infrastructure rather than applying the same VPN configuration everywhere.
We can help with HG Secure VPN access, firewalls, remote working, Microsoft Entra ID, Conditional Access, Microsoft Entra Private Access, managed devices, EDR, Microsoft 365 security, networking and wider cyber security.
We can also review an existing VPN environment to identify old accounts, unnecessary network access, ageing hardware or software and opportunities to move towards more granular Zero Trust access.
And when your employees need assistance, our aim is to make first contact on IT support requests within 15 minutes.
Call Hamilton Group on 0330 043 0069 or visit hgmssp.com to speak with one of our IT and cyber-security experts.