How a traditional VPN works
A VPN, or virtual private network, creates an encrypted tunnel between a remote device and the office firewall. Once connected, the laptop behaves as if it were plugged in at a desk: it can reach file servers, printers, accounting software and anything else on the internal network, subject to whatever rules the firewall applies.
VPNs have served small businesses well for years, and they remain a reasonable option, especially for reaching an on-premises server. Their weakness is the castle-and-moat model. Once someone is inside the tunnel, they are trusted. If an attacker steals a VPN password, or a staff laptop is infected, that broad access goes with them. VPN appliances themselves are also a frequent target, with serious flaws discovered in popular products in recent years.
What zero trust means
Zero trust is an approach rather than a single product. The idea is simple: never assume a connection is safe because of where it comes from. Each request to use an application is checked against who the person is, whether they passed multi-factor sign-in, whether their device is managed and healthy, and sometimes their location or the time of day. Access is then granted to that one application, not to the whole network.
In practice, a staff member opens an app or a web portal, signs in with their work account and multi-factor prompt, and the system confirms their laptop is encrypted and up to date. If everything checks out, they reach the accounting system. They do not get a path to the printers, the cameras or the server management screens, because they never needed it.
Why the difference matters for a small office
Most cyber incidents in small businesses start with a stolen password or a malicious email attachment. With a broad VPN, a stolen login can become a foothold on the whole network. With zero trust, the same login fails without the second factor, fails on an unmanaged device and, even if it succeeds, only reaches a limited set of applications.
There is a practical benefit too. Zero trust tools usually do not need a VPN client that staff must remember to connect, and they work the same in the office and at home. That consistency reduces support calls about the VPN not connecting from a hotel or a client's Wi-Fi.
Where many offices already are
If your business runs mostly on Microsoft 365 or Google Workspace, you may already be using elements of zero trust without calling it that. Cloud email, files and Teams are reached directly over the internet, protected by sign-in rules such as multi-factor authentication, conditional access and device compliance checks. In that setup, the VPN is often only needed for one or two remaining on-premises systems.
Those remaining systems are often the best place to start. An old accounting package on a local server might be moved to a cloud version, published through a secure gateway, or reached through a hosted desktop, after which the VPN can be retired or restricted to a few administrators. Each option has trade-offs in cost and convenience, and the right one depends on how the software is licensed and how many people use it.
Choosing an approach
Keep a VPN if you rely heavily on a local server and are not ready to change, but tighten it. Require multi-factor sign-in, limit which internal systems each group can reach, keep the firewall firmware current and remove accounts for people who have left. Review the connection logs occasionally for unusual times and places.
Move towards zero trust as you modernise. Strengthen identity first with multi-factor sign-in and conditional access, manage company devices so their health can be checked, and shift applications to the cloud or behind an access gateway. The transition can happen gradually over a year or two without disrupting staff. Communicate each step to staff in advance so a new sign-in prompt does not look like a phishing attempt.
Questions to ask before you change
Which systems do remote staff actually need? Which of those still live on a local server? Are company laptops managed and encrypted? Do contractors or personal devices need access, and if so to what? The answers determine whether a tightened VPN, a zero trust tool or a mix of both is the sensible next step.
Whatever you choose, document who has remote access and to what, and make removing that access part of every staff exit. Forgotten remote accounts are one of the quieter ways businesses get breached. Check remote access accounts against your current staff list every few months; it takes minutes and regularly finds an account that should have been closed. Include contractors and suppliers, such as a software vendor who was given VPN access for an upgrade years ago and never had it removed.
In short
- A VPN puts a remote laptop inside the office network with broad access.
- Zero trust checks the person and device and grants access app by app.
- Stolen passwords do far less damage under zero trust.
- Cloud-based offices often only need a VPN for one or two legacy systems.
- Remove remote access as part of every staff exit.