What Is a VPN? Virtual Private Networks Explained

How VPNs Work

A VPN client on the user's device establishes an encrypted tunnel to a VPN server or concentrator. All network traffic from the device is routed through this tunnel, encrypting it from the originating device to the VPN endpoint. From the VPN endpoint, traffic continues to its destination on the corporate network or internet, originating from the VPN server's IP address rather than the user's actual IP address.

Enterprise VPN vs. Consumer VPN

Enterprise VPNs — Cisco AnyConnect, Palo Alto GlobalProtect, Fortinet FortiClient — provide authenticated remote access to corporate networks. A remote employee connects through the VPN, authenticates with corporate credentials and MFA, and gains network-level access to corporate resources. All traffic between the employee's device and the corporate network is encrypted.

Consumer VPNs — NordVPN, ExpressVPN, Mullvad — are privacy tools that encrypt consumer internet traffic and route it through the VPN provider's servers, masking the user's IP address from websites and ISPs. They provide no access to corporate networks and are irrelevant to corporate security posture except as a potential policy concern when employees use them on corporate devices.

Split Tunneling

VPN split tunneling routes only traffic destined for corporate networks through the encrypted VPN tunnel, while traffic destined for the public internet goes directly from the user's device without VPN protection. Full tunnel VPN routes all traffic through the corporate network, giving security teams visibility into employee internet activity but increasing bandwidth consumption and latency. Most enterprise VPN deployments use split tunneling for performance reasons, which means internet-bound traffic from remote employee devices bypasses corporate security controls entirely.

VPN Security Limitations and Attack Vectors

VPN Vulnerabilities

VPN appliances are among the most targeted internet-facing systems in enterprise environments, for a simple reason: a successfully exploited VPN gives an attacker authenticated network access equivalent to a legitimate remote employee. This makes VPN appliances high-value targets for nation-state and criminal actors. Critical vulnerabilities in Pulse Secure VPN, Fortinet FortiGate, Citrix ADC, and Ivanti Connect Secure have been actively exploited in campaigns targeting government agencies, healthcare organizations, and critical infrastructure operators. CVE-2024-21887, a command injection vulnerability in Ivanti Connect Secure, was exploited by nation-state actors against US government agencies before a patch was available.

The Network Access Problem

The fundamental architectural weakness of VPN is that it grants network-level access — not application-level access. A remote employee connecting through VPN typically gains access to the entire corporate network segment their VPN policy permits, not just the specific applications they need. An attacker who compromises VPN credentials or exploits a VPN vulnerability gains the same broad network access. This stands in stark contrast to the principle of least privilege, which holds that users and systems should have access only to what they specifically need.

Zero Trust Network Access: The VPN Replacement

Zero Trust Network Access — ZTNA — is the architectural approach replacing VPN for corporate remote access. Rather than granting network-level access after authentication, ZTNA grants application-level access to specific resources based on continuous verification of user identity, device health, and contextual signals. An employee using ZTNA to access a financial reporting application gets access only to that application — not to the network segment containing it, adjacent servers, or other resources.

ZTNA eliminates the lateral movement opportunity that VPN creates. An attacker who compromises credentials in a ZTNA environment gains access to the specific applications the compromised user could access — not to the broader corporate network. Palo Alto Prisma Access, Zscaler Private Access, Cloudflare Access, and Microsoft Entra Private Access are the leading ZTNA platforms.

What PE Operating Partners Should Assess

For portfolio company remote access assessment: What VPN platform is deployed and when was it last patched? Are critical vulnerabilities in the deployed VPN version known and remediated? Is MFA required for VPN authentication? Is split tunneling configured, and what traffic bypasses corporate security controls? Is there a roadmap for migrating from VPN to ZTNA architecture? These questions reveal whether remote access represents a critical exposure point in the security posture.

Related Reading

• DNS Security — the resolution layer VPNs depend on
• Zero Trust Security — the architectural shift away from VPN-style perimeter
• Network Segmentation — the segmentation discipline VPNs partially implement

What is a VPN and how does it work?

A Virtual Private Network creates an encrypted tunnel between a user's device and a network endpoint (a corporate VPN concentrator or a commercial VPN provider's server), protecting the confidentiality of network traffic and routing it through the VPN endpoint rather than the user's actual network. Originally developed for remote corporate access, VPN now also includes consumer privacy use cases.

What is the difference between consumer VPN and enterprise VPN?

Consumer VPNs (NordVPN, ExpressVPN, Mullvad) are privacy tools that mask the user's IP address from websites and ISPs. They provide no access to corporate networks. Enterprise VPNs (Cisco AnyConnect, Palo Alto GlobalProtect, Fortinet FortiClient) provide authenticated remote access to corporate networks with corporate credentials and MFA, granting network-level access to internal resources.

Is a VPN secure?

VPNs encrypt traffic between the device and the VPN endpoint, but a VPN does not make the device or the user secure. VPN appliances themselves are among the most targeted internet-facing systems for nation-state and criminal actors because a successfully exploited VPN provides authenticated network access. Critical vulnerabilities in Pulse Secure, Fortinet, Citrix, and Ivanti VPN products have been actively exploited against government and healthcare targets.

Why are enterprises moving away from VPN?

VPN grants network-level access after authentication, meaning a compromised credential or exploited VPN appliance provides access to a broad network segment rather than just the specific applications a user needs. This is incompatible with the principle of least privilege. Zero Trust Network Access (ZTNA) replaces VPN with application-level access based on continuous verification of identity, device health, and context — eliminating the lateral movement opportunity that VPN creates.

What is ZTNA and is it better than VPN?

Zero Trust Network Access (ZTNA) grants application-level access to specific resources rather than network-level access to a network segment. An employee using ZTNA to access a financial reporting application gets access only to that application — not to the network containing it, adjacent servers, or other resources. ZTNA eliminates the lateral movement opportunity VPN creates. Leading platforms include Palo Alto Prisma Access, Zscaler Private Access, Cloudflare Access, and Microsoft Entra Private Access.

What is VPN split tunneling and is it safe?

Split tunneling routes only traffic destined for corporate networks through the VPN tunnel, while internet-bound traffic goes directly from the device without VPN protection. Full tunnel routes all traffic through the corporate network. Split tunneling reduces bandwidth consumption and latency but means internet-bound traffic from remote devices bypasses corporate security controls entirely — which is why many security-conscious organizations require full tunnel for sensitive workforces despite the performance cost.

How can a compromised VPN credential cause a major breach?

VPN grants network-level access equivalent to a legitimate remote employee. An attacker with compromised VPN credentials gains the same broad network access — and can then move laterally to high-value systems that the compromised user did not directly access. Multiple major breaches including the 2021 Colonial Pipeline ransomware incident began with a compromised VPN credential for an account that did not have MFA enabled. Phishing-resistant MFA on VPN authentication is now table stakes for any organization with remote access.

Real-World Example: Ivanti VPN Exploited by Nation-State Actors 2024

In January 2024, CISA issued an emergency directive requiring US federal agencies to disconnect Ivanti Connect Secure and Policy Secure VPN appliances after multiple critical vulnerabilities were disclosed and actively exploited. The exploiting threat actors — attributed to Chinese nation-state groups — used the vulnerabilities to gain unauthenticated remote code execution on VPN appliances, then moved laterally into agency networks. CISA's directive was unusual in its urgency: agencies were required to disconnect the appliances regardless of patch status because the attackers had developed techniques for persisting through the factory reset process.