In this article
A classic VPN encrypts the connection, but places the remote computer inside the company’s entire network: with a stolen password, the attacker gets in with the same reach. The answer involves three measures, in order: multi-factor authentication on the VPN, limiting what it can reach, and giving most of the team access only to the applications they need. For many small, disciplined SMEs, a well-configured VPN with MFA is still enough. We explain how to tell which case you are in.
Why the 2020 model fell short
In 2020, many companies set up remote working in days: a VPN on the firewall, one password per person, and it worked. The configuration stayed the same; the attacks did not.
The VPN equipment itself became a target. In 2025 Verizon was already highlighting attacks on perimeter and VPN devices. In the 2026 report, exploitation of software vulnerabilities became the most common way in, present in 31% of the breaches analysed.
The tunnel and the hotel key card
The VPN is a tunnel from the laptop to the whole network: servers, shared folders, printers, cameras. Whoever goes through the tunnel is inside. Application-level access works like a hotel room key card: it opens one door, not the building. If the card is stolen, it opens one room, and the time is logged.
The VPN still does one thing well: it stops anyone reading the traffic in a café or hotel. What it does not do on its own is confirm who is on the other end, check whether the computer is up to date or limit what it can reach.
Four ways a VPN becomes an open door
- Stolen credentials A well-crafted phishing attack obtains the password; without a second factor, the VPN accepts it.
- Personal computers The shared, unpatched home laptop brings whatever it carries into the network.
- Lateral movement Once inside, the attacker looks for the file server, the ERP and, above all, the backups. In a flat network nothing stops them.
- Unpatched VPN equipment It is exposed to the internet and scanned automatically as soon as a vulnerability emerges.
Quick test: is your VPN with MFA still enough?
We do not sell complexity to those who do not need it. If you answer yes to every question, the VPN is doing its job:
- Does every connection require a second factor in the phone app, with no exceptions?
- Do only company-owned, managed and up-to-date devices connect?
- Does each group reach only what it needs (accounts only reaching the management software, for example)?
- Do the firewall and the VPN portal receive patches within days, not months?
- Is there a log of who connected, when and from where, and does someone review it?
- Does no supplier have permanent access?
Two or more negative answers indicate that the problem is not the VPN: it is the way it was set up.
VPN or application access, case by case
| Scenario | Is a VPN with MFA enough? | What to do |
|---|---|---|
| Few remote users, all with company laptops | Yes, if well configured | MFA, group-based access, up-to-date firewall |
| Work on personal computers | No | Email and files in the browser, without entering the internal network |
| ERP or management software used remotely | It depends | Publish the application with strong authentication, without opening the network |
| Suppliers with regular access | No | Individual accounts, limited and active only during the intervention |
| Sensitive health, financial or client data | Rarely | Application access with every access logged |
A four-step plan for remote access
Step 1 — A second factor on the VPN
This is the step with the best cost-to-benefit ratio. Most business firewalls support MFA, often integrated with Microsoft 365. The options are in the guide to multi-factor authentication in companies.
Step 2 — Only managed devices inside the network
Personal computers are limited to email and files in the browser, with rules that prevent data downloads. Working with company data is not the same as being inside the infrastructure.
Step 3 — Publish applications instead of opening the network
Email, files, management software and sometimes a remote desktop: none of these requires being on the whole network. Each application published with strong authentication is its own door, with a log. The VPN is kept for those who administer systems.
Step 4 — Reduce the VPN’s reach
Backups, cameras and network management devices should never be within reach of a remote user. The firewall divides the network into zones and only lets through what is needed. Suppliers come in with their own account, MFA and access that is switched off at the end.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Example architecture for 40 workstations
Illustrative scenario: 40 workstations, 10 people working remotely on a regular basis. The recommended configuration would be:
- Email and files In Microsoft 365, with MFA and access conditional on the type of device.
- Management software Published on a remote desktop with strong authentication.
- VPN Reserved for two administrators, with a second factor, in a separate management zone.
- Suppliers Accounts created per intervention and disabled at the end.
In most cases, this can be done with the firewall and licences the company already pays for: the architecture changes, not the bill. The same logic is in Zero Trust for SMEs in 4 steps, and VPN equipment patches should follow an update policy with short deadlines.
Real case: FreshDesign
At FreshDesign, DataRoad installed a next-generation firewall and an encrypted VPN so the team could access servers and internal applications remotely. The project included centralised control of access and permissions, filtering and intrusion prevention, permanent remote monitoring with proactive alerts and two internet connections with load balancing and automatic failover if one carrier fails.
The decisive point: the VPN was not installed and forgotten. The contract includes firewall updates, rule optimisation and monitoring of VPN stability. That is what distinguishes a managed firewall from an open door.
Frequently asked questions
Should I switch off the VPN now?
No. First enable MFA and limit its reach. Then move people to application access. In the end, the VPN remains for administrators only.
Is a VPN with MFA enough for an SME?
It can be, if only company devices connect, each group reaches only what it needs, the firewall is up to date and connections are logged. If any one of these conditions fails, the risk remains high.
Can employees use their personal computer?
For email and files in the browser, with rules against downloads, yes. To enter the internal network, no.
Do I need to buy a new solution?
For most SMEs, no. What is needed is better configuration of the existing firewall and Microsoft 365, and someone managing access on an ongoing basis.
Next step: remote access review in 5 working days
We review the VPN, who connects and to what, supplier accounts and the state of the firewall, and deliver a written plan with fixes in order of priority. No-obligation request. Management of firewalls and cybersecurity and of remote working and mobility is included in the IT Unlimited Premium plans.
More than 10 workstations · support contract · remote, on-site and telephone support. Contact: sales@dataroad.pt.
