In this guide · 8 sections
- 01What a business VPN actually does
- 02When a small business no longer needs a VPN
- 03When you still need remote access
- 04The risk of exposed VPN gateways: lessons from FortiBleed
- 05Zero trust access options and what they cost
- 06Consumer VPNs vs business access
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Probably not, if everything you use is a cloud app protected by MFA. You need remote access only for systems inside the office, such as a file server or a legacy accounting program. If you do, use MFA, keep the gateway updated, or consider a zero trust access tool. Consumer VPN apps do not secure business access.
What a business VPN actually does
A business VPN (virtual private network) creates an encrypted tunnel from a staff laptop to the office network. Once connected, the laptop behaves as if it were plugged in at the office, and can reach the file server, printers and internal software.
That last point is both the benefit and the risk. A traditional VPN usually gives a connected user access to the whole office network, not just the one system they need. If an attacker gets a VPN login, they get the same access.
| Type | What it protects | Typical use |
|---|---|---|
| Business remote-access VPN | Access from outside into the office network | Reaching a file server or on-premises software |
| Site-to-site VPN | A permanent link between two offices | Branch offices sharing one system |
| Zero trust network access (ZTNA) | Access to specific apps, checked per user and device | Replacing or narrowing a remote-access VPN |
| Consumer VPN app | Your browsing traffic on an untrusted network | Personal privacy on public Wi-Fi |
When a small business no longer needs a VPN
If your team works in cloud services, the VPN often has nothing left to protect. Email, documents and chat in Microsoft 365 or Google Workspace, accounting in Xero, and payments in Stripe are all reached over encrypted HTTPS from anywhere. Routing that traffic through the office first adds delay and a single point of failure.
In that setup, security comes from protecting the accounts and devices instead:
Secure remote work without a VPN
This matches the zero trust idea described in NIST's SP 800-207: no implicit trust is granted to a user or device just because of where it sits on the network.
When you still need remote access
Some things only exist inside the office. Common examples for small Singapore businesses include a shared NAS or file server, desktop accounting or payroll software installed on one office PC, a CCTV recorder, or a clinic or industry system that runs on a local server.
If staff need these from home, you need some form of remote access. The choice is how: a traditional VPN on your firewall, or a newer zero trust access tool. Often the better long-term answer is to move the system to the cloud, so the question goes away.
Firewall VPN (FortiGate, Sophos, etc.)
- Often already included in the office firewall
- Gives network-wide access once connected
- The gateway is exposed to the internet and must be patched
- Needs MFA added and tested
Best for: Offices that already own a business firewall and have someone to maintain it.
Zero trust access tool
- Users reach only the apps they are allowed
- No open inbound port on the office firewall in typical set-ups
- Checks identity, and often device health, on every connection
- Monthly per-user cost on most business plans
Best for: Small teams that need access to one or two internal systems.
The risk of exposed VPN gateways: lessons from FortiBleed
VPN gateways sit on the edge of your network and accept logins from the whole internet. That makes them a prime target. CSA's advisory AD-2026-007 of 22 June 2026 described a leaked database of credentials for over 70,000 FortiGate devices, gathered through brute-force, dictionary and credential-stuffing attacks on internet-facing admin and VPN portals.
Fortinet said this was not a new vulnerability but reused and guessed passwords on devices without MFA. The lesson applies to every brand: a VPN with a weak password and no MFA is an open door, and an unpatched one can be worse.
If you run a FortiGate, our FortiBleed checklist covers how to check whether your device was listed and what to reset.
Zero trust access options and what they cost
Zero trust network access tools connect a user to a specific app or server after checking who they are, usually with your Microsoft or Google login and MFA. Most work without opening an inbound port on your office firewall. Two examples with published pricing, approximate, as of October 2026:
- Tailscale: its pricing page lists a free Personal plan for individuals (up to 6 users) and a Standard plan for teams at US$8 per user per month.
- Cloudflare Zero Trust: Cloudflare's zero trust plans page offers a free plan to start, with paid small business and enterprise plans above it.
Microsoft and Google also offer app access features within some business plans. Which one fits depends on what you need to reach and which identity system you already use. Test with one internal system and two users before you switch everyone.
Consumer VPNs vs business access
Consumer VPN apps, the kind advertised for streaming and privacy, solve a different problem. They encrypt traffic between your laptop and the VPN company's servers, which hides your browsing from whoever runs the café or hotel Wi-Fi.
A consumer VPN helps with
- Privacy on untrusted public Wi-Fi
- Hiding browsing from the local network operator
It does not
- Give access to your office systems
- Stop phishing or stolen passwords
- Replace MFA or device security
- Make a hacked laptop safe
Most business apps already use HTTPS, so on public Wi-Fi the bigger risks are fake login pages and unpatched laptops. A consumer VPN is optional for staff who travel often; it is not a security control for your company data.
Do it yourself or get help?
Start by listing what staff actually connect to from outside the office. If the answer is only cloud apps, focus on MFA and device security and consider switching the old VPN off. If there are internal systems, decide whether to move them to the cloud, put them behind a zero trust tool, or keep a properly secured VPN.
Our Security Health Check (S$290) gives you a written review of your domain, website, email and Microsoft 365 or Google Workspace settings, with a plain-English fix list ranked by risk. If you are also redoing the office network, our guide to office network and Wi-Fi set-up covers the firewall and Wi-Fi side.
Frequently asked questions
Usually not for those services. Microsoft 365 and Google Workspace are reached securely over HTTPS from anywhere, and a VPN adds little protection. What matters more is MFA on every account, sign-in rules where your plan supports them, and secure, updated devices. You may still need remote access for systems that only exist in the office.
It can be, if it is set up well. Every VPN user should have MFA, the firewall or gateway must be kept updated, and accounts for leavers must be removed promptly. CSA's June 2026 FortiBleed advisory showed how VPN gateways with weak passwords and no MFA were attacked at scale.
It is a way of giving each user access to specific apps or servers, after checking who they are and often whether their device is healthy, instead of putting them on the whole office network like a traditional VPN does. NIST describes zero trust as granting no implicit trust based on network location alone.
It is optional. A consumer VPN hides browsing from the public Wi-Fi operator, but most business apps already use HTTPS. It does not stop phishing, protect stolen passwords or give access to office systems. MFA, updated devices and care with login pages matter more.
Possibly, once you have checked who uses it and for what. List the internal systems people reach through it, move or replace those, and then disable the VPN and remove its accounts. An unused VPN that is still reachable from the internet is a risk with no benefit.