TL;DR:
- A VPN encrypts traffic between your device and the VPN server — it protects you on untrusted networks like public Wi-Fi, but it doesn’t protect you from phishing, malware, or most modern cyber threats
- The business VPN use case (connecting remote workers to office resources) has been largely replaced by cloud services and Zero Trust tools like Cloudflare Access and Tailscale
- Most small businesses need the right VPN for the right use case — and should not rely on a VPN as their primary security tool
The VPN market does a good job of creating anxiety about internet privacy and positioning itself as the solution. For individual consumers on public Wi-Fi, that narrative has some validity. For small businesses thinking about their overall security posture, VPNs are one narrow tool with specific use cases — and often not the highest-priority thing to spend money on.
What a VPN Actually Does
A Virtual Private Network creates an encrypted tunnel between your device and a VPN server. Traffic from your device goes into that tunnel, emerges at the VPN server, and then travels to its destination on the public internet. From the destination’s perspective, your traffic is coming from the VPN server’s IP address, not your own.
What this means in practice:
- Your local network (ISP, coffee shop router) cannot read your traffic — it’s encrypted inside the tunnel
- Websites see the VPN server’s IP, not your real IP — your device’s location and IP address are hidden from websites
- Everything between the VPN server and the destination is NOT protected — regular internet traffic from the VPN server onward
Point 3 is what most VPN marketing glosses over. If you visit a website over HTTPS (which is virtually everything now — see that padlock icon), the connection from your browser to the website is already encrypted regardless of whether you’re using a VPN. A VPN on modern internet adds a second layer of encryption, but the first layer (HTTPS) already protects your data from anyone sitting between you and the website.
When a VPN Is Genuinely Useful for Small Businesses
1. Using Unencrypted Public Wi-Fi
Airport lounges, hotel Wi-Fi, coffee shop networks — these are the legitimate VPN use case. When you use Wi-Fi you don’t control, the operator of that network can see your unencrypted traffic and potentially intercept it. A VPN encrypts that local segment.
However: This threat is now largely mitigated by HTTPS everywhere. Most of the traffic that matters (your email, your cloud apps, your banking) is already encrypted at the application layer. The residual risk (DNS queries revealing which sites you visit, connection metadata) is real but modest.
Verdict: A VPN on public Wi-Fi is a reasonable precaution if you’re connecting to anything sensitive. Don’t stress if you forget occasionally — HTTPS already protects the content of your communications.
2. Accessing Resources at a Physical Office Remotely
If your business has servers, file shares, or internal tools at a physical office that need to be accessible from outside, a site-to-site or remote-access VPN is the traditional solution. A remote worker connects to the VPN, their device appears on the office network, and they can reach internal resources.
This was the dominant business VPN use case. For most small businesses in 2026, it’s become less relevant because:
- File storage is on SharePoint, Google Drive, or Dropbox — accessible from anywhere without VPN
- Email is in Microsoft 365 or Google Workspace — no VPN required
- Line-of-business software is SaaS — also no VPN required
If you genuinely have on-premises servers that remote workers need to access, a VPN makes sense. But check whether you actually have this requirement before paying for one.
3. Restricting Access to Specific Internal Systems
Some businesses want to limit access to certain systems (admin panels, internal dashboards, databases) to specific IP addresses or require users to be “on the network” to access them. A VPN accomplishes this by giving remote workers a stable IP that can be whitelisted.
The modern alternative to this is Zero Trust Access tools, which are often better: users authenticate (with MFA) to access specific applications, without being placed on the full network. Cloudflare Access, Tailscale, and Twingate all offer this model with free or low-cost tiers for small teams.
What a VPN Does NOT Protect You From
This is the crucial part that gets omitted from most VPN marketing:
Phishing: A VPN does not protect you from clicking a malicious link in an email. You can be fully connected to a VPN and get completely phished. The encrypted tunnel between your device and the VPN server is irrelevant once you voluntarily hand your password to a fake login page.
Malware: If malware is already on your device, a VPN does nothing. The malware communicates through the encrypted VPN tunnel along with your legitimate traffic.
Compromised websites: If you visit a legitimate website that has been compromised to serve malware, the VPN doesn’t help. You navigated to the right URL; the content was malicious.
Data breaches at services you use: Your email provider, your bank, your SaaS tools — if they suffer a breach, your VPN connection to them has no bearing.
Social engineering: Fraudulent phone calls, fake supplier invoices, invoice redirection scams — these exploit human behaviour, not network vulnerabilities.
This isn’t a knock on VPNs — these are just not the threats VPNs are designed for. The threats that most commonly harm small businesses (phishing, ransomware via email attachments, business email compromise) are not network-layer threats that a VPN addresses.
Tailscale: The VPN Worth Considering for Small Teams
If you do need remote access to internal resources, Tailscale is the tool to evaluate in 2026. It’s architecturally different from traditional VPNs: instead of routing all your traffic through a central server, it creates encrypted peer-to-peer connections between your devices using WireGuard.
Why it’s better than traditional VPN for most small businesses:
- Free for up to 3 users: The free tier covers most small teams needing secure access to a server or NAS at the office
- No “always-on” central server to maintain: Connections are peer-to-peer; you don’t need to set up and maintain a VPN server
- Easy to use: Works on Windows, Mac, iOS, Android — installation takes minutes
- Split tunneling by default: Only traffic destined for your Tailscale network goes through the tunnel; regular internet traffic goes directly
For a small business with a physical server at the office and remote workers who occasionally need access, Tailscale’s free tier is often all you need.
Choosing a Consumer VPN for Personal Use
If you want a VPN for personal browsing privacy or for using public Wi-Fi safely, the established options with transparent no-logging policies are:
- Mullvad VPN: Gold standard for privacy — accepts cash payment, no email required to sign up, regularly audited. Around £4/month.
- ProtonVPN: Swiss-based, audited, strong privacy reputation. Has a limited free tier.
- IVPN: Privacy-focused, independently audited, reasonable pricing.
Avoid “free” VPNs — the business model is typically selling your browsing data, which defeats the purpose.
The Better Investment for Most Small Businesses
The security controls that address the threats actually most likely to harm your business:
- Multi-factor authentication on email, banking, and line-of-business apps — blocks 99%+ of account takeovers
- Good backups (tested, offsite) — the only reliable defence against ransomware
- Email filtering (Microsoft Defender, Google’s built-in filtering, or a third-party like Mimecast) — catches most phishing before it reaches inboxes
- Security awareness — helping your team recognise phishing attempts
A VPN sits below all of these in terms of risk reduction per pound spent for most small businesses. Get the fundamentals right first. If you have a specific use case — remote access to office resources, public Wi-Fi usage, or geographic content access — then a VPN is worth the modest cost. If you’re thinking of a VPN as your primary security tool, redirect that budget to MFA and backups instead.