Remote access used to mean one thing: a VPN that put your laptop on the office network. That model is now often the wrong answer, and understanding why makes the alternatives obvious.
What a VPN actually does
It creates an encrypted tunnel from a device to your network, so the device behaves as though it were plugged in at the office.
That was exactly right when everything lived on a server in the building. Email, files, the accounting system, the line-of-business application — all on site, all reachable only from the local network.
Why most businesses no longer need one
If your email is Microsoft 365, your files are in cloud storage, your accounting is a web application and your CRM is a subscription — none of that is on your network.
A VPN in that situation routes traffic through your office to reach the internet, which adds latency, adds a dependency on your office connection, and protects nothing that was not already protected by the service's own authentication.
The security of those services rests on the accounts: strong authentication, multi-factor, conditional access rules about where sign-ins are permitted from. That is where the effort belongs — see passwords, passkeys and MFA.
When you still need it
On-site servers. A file server, a database, a line-of-business application installed on a machine in your building.
Equipment that must be reached. Building controls, camera systems, industrial equipment, anything with a management interface that must never be exposed to the internet directly.
Address-restricted services. Some suppliers restrict access to specific addresses, and routing through the office satisfies that.
Administrative access. Reaching network equipment for management, which should never be exposed publicly.
The problem with the traditional model
A VPN typically grants network-level access. Once connected, the device can reach everything on the network that its address permits — which on a flat network is everything.
So a compromised home laptop becomes a compromised device inside your network. The tunnel was perfectly secure and it delivered the problem straight past your firewall.
Two mitigations. Segment the network so a VPN connection lands somewhere limited — see VLANs explained. And apply rules to VPN traffic rather than treating it as trusted because it arrived through the tunnel.
The encryption was never the weak point. The weak point is that a traditional VPN grants access to a network rather than to a system.
The modern alternative
Rather than joining a network, access is brokered per application. The user authenticates, the system checks who they are, what device they are on and whether they are permitted, then connects them to that one application.
They never join the internal network. A compromised device can reach the applications that user is entitled to and nothing else.
This is often called zero trust, which is a marketing term for a sensible principle: verify every request rather than trusting anything because of where it came from.
Practically, this can be a cloud-brokered access service, or an application published through a gateway that authenticates each connection. Either is a substantial improvement over network-level access.
Supplier access
The exposure businesses most often overlook.
A supplier needs to support a system, so an account is created and remote access arranged. Years later that access still exists, is shared among their staff, and nobody knows who currently holds it.
What good looks like:
- Named individual accounts, never shared
- Access to the specific system only, not the network
- Multi-factor authentication, enforced
- Time-limited, or requiring approval per session
- Logged, with a record of what was done
- Reviewed at least annually and removed when the contract ends
Ask your suppliers what access they currently hold. The answers are frequently surprising.
Practical requirements whatever you choose
Multi-factor authentication, always. Remote access protected by a password alone is remote access for whoever has that password.
Keep the endpoint patched. VPN appliances are actively targeted because they are internet-facing by definition, and vulnerabilities in them are exploited quickly.
Log connections. Who connected, when, from where, for how long.
Check device health where you can. Requiring a device to be encrypted, patched and running current protection before it connects is now achievable and worth doing.
Have a way to revoke immediately. When somebody leaves, remote access must be removed the same hour, not in the next review — see joiners, movers and leavers.
What to do if you have an old setup
Start by asking what people actually reach through it. Frequently the answer is one or two systems, and everything else moved to the cloud years ago.
If so, you can usually replace network-level access with published access to those specific systems, which is simpler, faster for users and considerably safer.
Our security team reviews and modernises remote access for UK businesses, including supplier access nobody has audited. Start a conversation.
