What is a Virtual Private Network (VPN)?

How does a VPN work?

A VPN rests on three mechanisms working together. Encryption converts readable data into ciphertext using strong cryptographic algorithms such as AES-256, so that intercepted traffic is useless without the keys. Tunneling encapsulates the encrypted packets inside other network packets so they can travel safely across the public internet, forming a private pathway between the device and the destination network. Authentication verifies the user or device before the tunnel is established, using credentials, certificates, and ideally multi-factor authentication (MFA). Modern deployments also check the device's security posture before allowing the connection.

In practice, a session follows a simple flow. The user opens the VPN client and authenticates. The client encrypts all outgoing traffic before it leaves the device. The encrypted data travels through the tunnel to the VPN server or gateway, which decrypts it and forwards it to the destination, whether that is an internal application or a website, presenting its own IP address instead of the user's. Responses take the same path in reverse, encrypted again on the way back. To the outside world, the user's location and identity are those of the VPN server; to the user, it feels like being plugged directly into the private network.

Why VPNs matter

Public internet connections in cafes, hotels, and airports are inherently exposed. Unencrypted traffic on shared Wi-Fi can be sniffed, and man-in-the-middle attacks can capture credentials and sensitive data. For businesses, the stakes compound. Remote and hybrid work mean employees routinely reach internal applications, file shares, and cloud environments from networks the company does not control, and regulations from the General Data Protection Regulation (GDPR) to the Payment Card Industry Data Security Standard (PCI DSS) require safeguards for data in transit. A VPN answers both problems: it renders intercepted traffic unreadable and gives the workforce a consistent, authenticated path to corporate resources. It also lets organizations connect branch offices and data centers securely over the internet instead of paying for dedicated leased lines or Multiprotocol Label Switching (MPLS) circuits. That is why VPN technology, despite being decades old (OpenVPN, one of the first widely adopted implementations, dates back to 2001), remains a fixture of enterprise networking.

Types of VPN

Remote access VPN

Connects an individual user's device to a private network over the internet. This is the classic corporate setup for remote workers: the laptop, tablet, or phone becomes a temporary member of the office network, with access to internal servers, databases, and intranet applications as if physically on site.

Site-to-site VPN

Connects two or more entire networks, such as a headquarters local area network (LAN) with branch offices or a data center. Traffic between the sites is encrypted at the gateway level, transparently to users. Site-to-site VPNs are the standard way large organizations interconnect locations without dedicated lines.

SSL VPN (clientless)

Provides access to specific applications through an HTML5-capable browser and the company's login portal, without installing a full client. Useful for contractors, personal devices, and quick access to a defined set of web applications.

Mobile VPN

Designed for endpoints that roam between networks, keeping the secure session alive as the device switches between Wi-Fi and cellular. Widely used in field service, healthcare, and public safety.

Cloud VPN

Connects users or corporate networks directly to virtual infrastructure hosted in cloud environments such as AWS or Azure, securing the pipeline between on-premises operations and cloud workloads.

Personal VPN

The consumer service model: a subscription app that routes personal traffic through the provider's servers for privacy on public Wi-Fi, protection from internet service provider (ISP) tracking, and access to geo-restricted content.

VPN types compared

VPN protocols compared

The protocol defines how the tunnel is created and secured, and it drives the balance between security, speed, and compatibility.

Benefits of a VPN for businesses

For organizations, the value is concrete. A VPN secures remote access, letting employees work from any location with the same resources they would have in the office, protected by strong authentication and, increasingly, device posture checks before the connection is allowed. It protects data in transit, shielding credentials, intellectual property, and internal communications from interception, which directly supports compliance obligations. It interconnects sites at a fraction of the cost of leased lines, and it bridges on-premises environments with cloud platforms securely. It can also enforce policy: traffic routed through the corporate gateway can be inspected, filtered, and logged, giving security teams visibility they would not have over raw internet connections.

A brief history of VPNs

VPN technology grew up with the internet itself. The first tunneling protocols appeared in the mid-1990s with PPTP, created to let dial-up users reach corporate networks. As internet use accelerated through the late 1990s and early 2000s, so did the need to protect the individuals and businesses relying on it, and IPsec became the enterprise standard for encrypted site-to-site links. OpenVPN, released as open source in 2001, marked a turning point. Its strong SSL/TLS-based encryption and its ability to traverse firewalls made secure remote access broadly practical, and it remains widely deployed today. The 2010s brought the consumer VPN boom, driven by privacy concerns and public Wi-Fi risks, and WireGuard modernized the protocol landscape with a minimal codebase and dramatically better performance. The 2020s shift to remote and hybrid work made VPNs critical infrastructure overnight, and simultaneously exposed their structural limits, fueling the current transition toward zero trust models. VPNs are mature, everywhere, and increasingly complemented or replaced by ZTNA for user access.

VPN best practices for businesses

1. Enforce MFA on every VPN login: Stolen credentials are the cheapest way into a network, and a password alone is not a control. Pair MFA with anomaly-based triggers where possible.
2. Patch the gateway as critical infrastructure: Treat VPN appliance advisories as emergencies, not routine maintenance. Newly disclosed vulnerabilities on internet-facing gateways are exploited within days.
3. Check device posture before connecting: Verify OS version, patch level, and endpoint protection status so a compromised laptop does not ride a healthy tunnel.
4. Apply least privilege behind the tunnel: Segment the network so a VPN session reaches only what the user's role requires, limiting lateral movement if an account is abused.
5. Retire legacy protocols: Disable PPTP and other broken protocols, and standardize on IPsec/IKEv2, OpenVPN, or WireGuard with modern ciphers.
6. Collect and monitor VPN logs: Authentication events, session metadata, and gateway logs should flow into the Security Operations Center (SOC) and be correlated with identity and endpoint telemetry. A VPN nobody watches is a blind spot with a public IP address.

What a VPN does not do

VPNs are often oversold, and it is worth naming the limits clearly. A VPN does not make anyone anonymous. Services you log into still know who you are, websites still set cookies, and depending on jurisdiction, providers can be compelled to cooperate with authorities. Encryption and the extra server hop cost some performance, though modern protocols keep the impact small.

More importantly for enterprises, three structural weaknesses matter. First, broad access. A traditional VPN typically connects the user to the network, not to a specific application, so a stolen credential can open far more than it should and enable lateral movement. Second, the VPN gateway itself is an internet-exposed edge device, and exploited VPN and edge appliances have become one of the most common initial access vectors in real-world intrusions, with critical vulnerabilities in major vendors' products actively targeted by both cybercriminal and state-sponsored actors. Third, a VPN secures the tunnel but says nothing about what happens inside it. Malware on an authenticated laptop rides the same encrypted connection as legitimate traffic.

VPN vs. zero trust network access (ZTNA)

These limitations are precisely what zero trust network access was designed to address, and the comparison has become unavoidable in any remote access project. A VPN authenticates once and then connects the user to the network, with implicit trust afterward. ZTNA, the remote-access building block of a zero trust architecture, connects users only to the specific applications they are authorized for, re-evaluates identity, device posture, and context continuously, and never exposes the network or public IP addresses. Many organizations are progressively replacing remote-access VPNs with ZTNA, or running both during a transition. If you keep a VPN, harden it with MFA everywhere, prompt gateway patching, and least-privilege segmentation behind it, and monitor it closely. If you move to ZTNA, the same monitoring logic applies to the new control plane.

Expert insight: your VPN is both a control and a target

A SOC sees something most VPN explainers skip. In current intrusion patterns, the VPN is no longer just a security control; it is one of the attacker's favorite doors. Two routes dominate. The first is exploitation of the appliance itself. Internet-facing VPN gateways and edge devices are relentlessly scanned, and newly published vulnerabilities are weaponized within days. The second is abuse of valid accounts. Stolen or phished credentials are used to simply log in through the VPN, a technique MITRE ATT&CK catalogs under external remote services and valid accounts, which produces no malware and no exploit, just a login that looks almost normal.

Both routes are detectable if the telemetry is watched properly. VPN authentication logs, gateway events, and the network activity behind them are among the highest-value sources a SOC can collect. The Sekoia SOC platform ingests them through more than 300 integrations covering the major VPN, firewall, and identity vendors, and Sekoia Defend applies roughly 1,000 MITRE ATT&CK-mapped detection rules to spot the patterns that matter: impossible travel and anomalous login times, logins from suspicious infrastructure, brute force against the portal, and post-login lateral movement. Detections are enriched with Cyber Threat Intelligence (CTI) from Sekoia Intelligence, where our in-house Threat Detection & Research (TDR) team tracks the exploitation of edge devices and the criminal ecosystem trading VPN credentials, and every new Indicator of Compromise (IoC) is automatically retro-hunted across past events. For European organizations, this comes with a data sovereignty posture that US platforms rarely match. Combined with automated incident response, a suspicious VPN session can be cut and the account disabled in minutes. Keep the tunnel, but watch the door.

‍

Frequently asked questions