Should a company still use a VPN?

For site-to-site links between networks, yes, they remain the standard. For employee remote access, the direction is toward publishing each application behind an identity-aware proxy with single sign-on and a device check, and keeping network-level VPN access for the few administrators who need it.

Does a consumer VPN make me anonymous?

No. It hides your traffic from the local network and your internet provider and shows the sites you visit a different origin address. The VPN provider sees what your internet provider would have, the sites still identify you by login and cookies, and anonymity is a much larger problem than a tunnel solves.

Which VPN protocol should I use?

For corporate deployments, whatever the gateway vendor supports and has recently patched, since the gateways are attacked more than the protocols. Among modern protocols, WireGuard is small and fast and IPsec is the long-standing standard for site-to-site links; both are sound when configured and kept current.

VPN (Virtual Private Network)

Also: VPN, virtual private network, remote access VPN, site-to-site VPN, IPsec, WireGuard

A virtual private network carries traffic through an encrypted tunnel over a public network so that a remote device or site behaves as though it were connected to a private one.

Our take. Two unrelated products share the name. The corporate VPN that puts a laptop on the office network is a legitimate tool with a well-known weakness, which is that it trusts everything once connected. The consumer VPN sold as privacy protection mostly moves your trust from your internet provider to a company you know less about, and the marketing around it is the least honest in consumer security.

The corporate version solves a real problem. An employee at home needs to reach systems that live on the office network, and the internet in between is untrusted. The VPN client on the laptop authenticates to a gateway at the office, the two agree keys, and from then on everything the laptop sends to office addresses travels inside an encrypted tunnel and emerges on the office network as if the laptop were plugged in there. Site-to-site VPNs do the same between two offices, or between an office and a cloud network, with routers at each end and no client software. The protocols are standardised and well studied, and the encryption is not where these systems fail.

They fail at the trust model. Once the tunnel is up, the remote device is on the network, and whatever the network trusts, it trusts the device. A stolen VPN credential, or a compromised laptop that connects legitimately, gives an attacker an employee's seat on the network, which is why VPN gateways have become one of the most attacked classes of device on the internet and why the industry is moving toward access per application through an identity-aware proxy instead of access to a whole network through a tunnel. That shift is the zero-trust argument in its most concrete form, and many organisations run both models at once while they migrate.

The consumer product is a different thing

A subscription VPN encrypts the traffic between your device and the provider's server, then sends it onward as ordinary internet traffic. Your internet provider and the coffee-shop network see only the tunnel; the VPN company sees everything they would have seen. On the modern web, where nearly every site already encrypts its connection, the practical gain is hiding which sites you visit from the local network and appearing to be somewhere else. Claims that it makes you anonymous, protects you from hackers, or secures your banking are marketing, and the honest use case is a hostile local network or a geographic restriction.

Remote access: one device to a network, via a client. The classic corporate case.
Site to site: one network to another, via routers or cloud gateways. How a branch reaches head office, or an office reaches its cloud environment.
Consumer: one device to a provider's exit point. Hides traffic from the local network and relocates its apparent origin; nothing more.

In practice

A company of two hundred people runs a remote-access VPN that every employee uses to reach a file server, a finance application and an internal wiki. Every connected laptop can also reach every other server, the printers, and the building management system, because that is what being on the network means. The redesign publishes the three applications through an identity-aware proxy that requires single sign-on and a managed device, and retires the VPN for everyone except the two administrators who genuinely need network-level access. The employees notice that the client they used to fight with has gone; the attacker who later phishes a credential finds three applications behind a second factor and nothing else.

Often confused with

Zero Trust: A VPN extends trust from the network to the connected device; zero trust withdraws trust from the network and evaluates each request. The identity-aware proxy that replaces a corporate VPN is zero trust applied to remote access.
SSL/TLS: TLS protects a single connection between a client and a server, and nearly every website uses it. A VPN protects all of a device's traffic to a gateway, regardless of what each connection does inside the tunnel.
Firewall: A firewall filters traffic; a VPN carries it. Traffic inside a tunnel passes a firewall unread, which is why the firewall at the tunnel's exit matters more than the one it passed on the way.

Key takeaways

→Corporate VPNs solve remote access and trust too much once connected; per-application access is replacing them.
→VPN gateways are heavily attacked because a credential gives network-level position.
→Consumer VPNs relocate trust to the provider and hide traffic from the local network; the rest is marketing.

Certifications that test this

Vendor exams whose syllabus covers this concept — facts, cost and a preparation path on each page.

More courses from these shelves

A rotating selection from the course directory, drawn from the subcategories where this concept is taught rather than picked for it. Details, price and the provider link are on the course page.

FAQ

Should a company still use a VPN?: For site-to-site links between networks, yes, they remain the standard. For employee remote access, the direction is toward publishing each application behind an identity-aware proxy with single sign-on and a device check, and keeping network-level VPN access for the few administrators who need it.
Does a consumer VPN make me anonymous?: No. It hides your traffic from the local network and your internet provider and shows the sites you visit a different origin address. The VPN provider sees what your internet provider would have, the sites still identify you by login and cookies, and anonymity is a much larger problem than a tunnel solves.
Which VPN protocol should I use?: For corporate deployments, whatever the gateway vendor supports and has recently patched, since the gateways are attacked more than the protocols. Among modern protocols, WireGuard is small and fast and IPsec is the long-standing standard for site-to-site links; both are sound when configured and kept current.

Sources

The primary text this definition rests on. Read it before you trust ours.

RFC 4301, Security Architecture for the Internet Protocol (2005)
Donenfeld, J. A., WireGuard: Next Generation Kernel Network Tunnel (2017)
NIST SP 800-207, Zero Trust Architecture (2020)

Last reviewed 13 September 2026 · Getting Digital

VPN (Virtual Private Network)

In practice

Often confused with

Key takeaways

Certifications that test this

More courses from these shelves

ISO/IEC 42001: Artificial Intelligence Management System

C_THR82: SuccessFactors Performance & Goals Implementation

Networking Full Course & Network + certification

Python And Django Framework For Beginners Complete Course

The Ultimate AWS Networking Training Course: All In One

Salesforce Certified Data Cloud Consultant Practice Exams

FAQ

Sources