Security · 9 min

Does your small business actually need a VPN? An honest answer

By Xenith Editorial27 July 2026

VPNs are sold to small businesses as an essential security product, usually by companies that sell VPNs. The honest answer is that most small businesses do not need the thing they are being sold, and some need a different thing entirely. It depends on which of two completely different jobs you are trying to do.

The distinction that clears up most confusion: a consumer VPN hides your traffic from the network you are on. A business VPN gives remote staff secure access to internal systems. These are different products solving different problems, and conflating them is why people buy the wrong one.

The two jobs a "VPN" might mean

Job	What it does	Who needs it
Consumer VPN (NordVPN, etc.)	Encrypts your traffic to a remote exit point, hides it from the local network and your ISP	Occasional use on untrusted public Wi-Fi; accessing region-locked content
Business remote-access VPN	Lets a remote employee securely reach servers, files, or systems that live on the company network	Businesses with actual internal infrastructure to reach

If your business runs entirely on cloud services — Google Workspace or Microsoft 365, cloud storage, SaaS apps — you have very little "internal network" to VPN into. That is most small businesses today, and it is why the business VPN is often solving a problem you no longer have.

When you genuinely need a business VPN

You have an on-premises server, NAS, or application that staff must reach from outside the office.
You have equipment or dashboards that should never be exposed directly to the internet.
A client contract specifically requires VPN-based access to their systems.
You have office-only resources and a genuinely remote team.

If one of these is true, the VPN is doing real work: it keeps internal systems off the public internet while still letting your team reach them. That is worth paying for and setting up properly.

When a VPN is a waste of money

Your work is entirely cloud-based. A VPN does not make Google Workspace or your SaaS tools more secure. MFA and strong passwords do that.
You bought it "for security" with no specific threat in mind. Security theatre with a monthly fee.
You think it hides you from everyone. It moves trust from your ISP to the VPN provider. That is sometimes worth it, often not.
You are using it instead of the basics. A VPN on a business that has not enabled MFA is fixing the wrong problem, as our security baseline argues.

The consumer VPN question, honestly

For an individual on public Wi-Fi — an airport, a café — a reputable VPN adds a layer of protection. But its value has shrunk, because almost every serious website now uses HTTPS, which already encrypts your traffic. The VPN mainly hides which sites you visit from the local network, not the contents.

So: mildly useful for frequent travellers on untrusted networks, not essential, and not a substitute for account security. If you buy one, pick a provider with a clear no-logs policy and an independent audit, because you are trusting them with everything your ISP would otherwise see.

What most small businesses actually need instead

Nine times out of ten, the underlying worry behind "should we get a VPN" is really "is our stuff secure," and the answer is a different, cheaper list:

MFA on every important account. This prevents far more real attacks than a VPN.
A password manager so nothing is reused.
Do not expose admin interfaces to the internet. If a device or dashboard should not be public, put it behind proper access control — this is where a VPN or a zero-trust access tool genuinely fits, covered in our office network guide.
Keep software updated.
Tested backups.

The modern alternative: for reaching internal resources, "zero-trust" access tools (including free tiers from major providers) increasingly replace the traditional VPN. They grant access per-application with identity checks, rather than dropping a user onto the whole network. If you are setting this up fresh, look there before buying a legacy VPN.

How to decide in two minutes

Do you have internal systems (a server, NAS, or private dashboard) that remote staff must reach? If no, you almost certainly do not need a business VPN.
Is your team frequently on untrusted public Wi-Fi with sensitive work? A consumer VPN is a reasonable, minor add-on.
Are you considering a VPN mainly "for security" in general? Stop, and do the MFA-and-password-manager list first.

The summary

A VPN is a specific tool for a specific job: reaching internal systems securely, or shielding traffic on untrusted networks. If you have neither problem — and most cloud-based small businesses do not — the money and effort belong in MFA, a password manager, and tested backups, which stop the attacks you will actually face. Buy a VPN when you can name the exact thing it protects, not because a product page told you every business needs one.

No company paid for placement in this article. Verify current prices and terms with each provider before buying.