What Is a VPN, and Do You Need One?

By J. Mesa

VPN advertisements promise to make you anonymous, block hackers, and protect your identity. A VPN does none of those things on its own. It does one useful job well, and knowing what that job is tells you whether you need to pay for one.

What is a VPN?

A VPN, or virtual private network, is a service that creates an encrypted connection between your device and a server run by the VPN provider. Your internet traffic travels through that encrypted tunnel to the provider’s server and goes out to the internet from there.

How does a VPN work?

Without a VPN, your traffic passes through the local network and your internet provider on its way to a website. Each of them can see which sites you connect to. The website sees your IP address, which reveals your provider and your rough location.

With a VPN turned on:

1. Your device encrypts the traffic before it leaves.
2. The local network and your internet provider see only scrambled data going to the VPN server.
3. The VPN server decrypts the traffic and sends it to the website.
4. The website sees the VPN server’s IP address in place of yours.

You have moved your trust. Your internet provider can no longer see your browsing, and the VPN company now can.

What does a VPN protect you from?

• Snooping on untrusted networks. On hotel, airport, and coffee shop Wi-Fi, a VPN stops the network operator and other users from watching where your traffic goes.
• Tracking by your internet provider. Your provider can’t log the sites you visit.
• Exposure of your IP address. Websites and services see the VPN’s address.
• Location limits. A VPN can make you appear to be in another region.

What does a VPN not protect you from?

This list matters more than the first one.

• Phishing. A VPN delivers a fake sign-in page to you through an encrypted tunnel. You can still type your password into it. See our guide to spotting a phishing email.
• Malware. A VPN does not scan what you download.
• Weak or reused passwords. An attacker with your password signs in from anywhere.
• Tracking by the sites you use. Google, Facebook, and advertisers identify you by your login, your cookies, and your browser, with or without a VPN.
• Data breaches. A VPN has no effect on how a company stores your information.
• Anonymity. The VPN provider knows who you are and can see your traffic. Websites you sign in to know who you are.

Do I need a VPN at home?

For security, most people do not. Nearly every website and app now encrypts its own traffic with HTTPS, the padlock in your browser. Your home network is one you control. A VPN at home adds privacy from your internet provider and little else.

Spend the effort where it counts first: a strong, unique password for each account, multi-factor authentication, and software updates.

Do I need a VPN on public Wi-Fi?

It helps, and the risk is smaller than the ads suggest. Because of HTTPS, a snoop on the coffee shop network can’t read your banking session or your email. The snoop can see which sites you visit, and a fake hotspot can steer you toward a fraudulent page.

A VPN closes those gaps. So does using your phone’s hotspot or cellular data. If you travel often and work from shared networks, a VPN is a reasonable purchase. Our post on staying safe on the go covers the rest.

What is a business VPN?

A business VPN serves a different purpose from the consumer products in the ads. It connects a remote employee’s computer to the company’s private network, so the employee can reach file servers, accounting systems, and other internal resources from home or the road. Your firewall or a dedicated service provides it, and your IT team controls who may connect.

A consumer VPN hides your browsing from the local network. A business VPN extends your office network to an authorized person. Buying consumer subscriptions for your staff does not give them secure access to the office.

How do I secure a business VPN?

A VPN is a door into your network, and attackers know it. VPN devices sit among the most common entry points for ransomware.

• Require multi-factor authentication for every VPN login. A VPN protected by a password alone is one stolen password away from a break-in.
• Patch the VPN device quickly. Vendors release fixes for serious flaws several times a year, and criminals scan the internet for unpatched devices within days.
• Give each person an account. No shared logins. Disable the account the day someone leaves.
• Limit what the VPN reaches. A remote bookkeeper needs the accounting system and nothing else.
• Allow company-managed devices only, where you can. A family computer full of malware should not join the office network.
• Review the logs for logins at odd hours and from unexpected countries.
• Replace hardware the vendor no longer supports.

Do small businesses still need a VPN?

It depends on where your systems live. If your email, files, and accounting all run in cloud services such as Microsoft 365, Google Workspace, and QuickBooks Online, your staff reach them directly over HTTPS, and a VPN adds little. Protect those logins with multi-factor authentication.

If you keep a server, a records system, or network storage in the office, remote staff need a secure way in. A VPN is the traditional answer. Never expose Remote Desktop straight to the internet as a shortcut.

Newer “zero trust” access tools take a different approach. They verify the person and the device, then grant access to one application at a time and not to the whole network. Ask your IT provider whether one fits your size and budget.

How do I choose a consumer VPN?

If you decide to buy one, check these points.

• Independent audits. Look for a published audit of the provider’s no-logs claim by a named outside firm.
• Clear ownership. You should be able to learn who runs the company and where it operates.
• Modern protocols, such as WireGuard or OpenVPN.
• A kill switch that blocks traffic if the VPN connection drops.
• A paid plan from a known provider. Running servers costs money. A free VPN often pays its bills by collecting and selling your browsing data, which defeats the purpose.
• No outsized promises. Be wary of any product that claims to make you anonymous or “unhackable.”

Are free VPNs safe?

Many are not. Studies of free VPN apps have found data collection, advertising trackers, and in some cases malware. A few reputable providers offer limited free tiers supported by their paid customers. Outside of those, avoid free VPN apps, above all on a device that holds work email.

Does a VPN slow down my internet?

Somewhat. Your traffic takes a longer route and gets encrypted along the way. With a good provider and a nearby server, most people notice little difference for browsing and video calls.

Is using a VPN legal?

In the United States, yes. A handful of countries restrict or ban them, so check before you travel. A VPN does not make an illegal act legal, and it may violate the terms of a streaming service.

Your next step

List the systems your staff reach from outside the office and how they connect to each one. For every remote connection that relies on a password alone, add multi-factor authentication this month. Cerberus Cybersecurity reviews remote access as part of our risk and compliance assessments and writes remote work policies your team can follow. Contact us to get started.