What is a VPN and Why Do Most Enterprise Organisations Use Them?
- Samuel Roberts
- 5 days ago
- 4 min read
Most people have heard of Virtual Private Networks (VPN) and, on a high level, most people can explain why one may be used. VPNs have become increasingly popular over the years, allowing users to hide browsing activity, their location and protect their personal data. More specifically, they can allow users to access resources that may only be available in specific locations (if you are from the UK, for example, but on holiday in Australia, and want to watch a BBC TV programme that is only available to British users). There are, of course, many other similar situations in which someone may use a VPN, sometimes with a more sinister reason.
Why, then, would an enterprise company want to use one? And what exactly is happening under the hood that magically, virtually, can make the internet think you’re in a different location entirely?
We’ll answer both questions below and explain why using a VPN is historically more secure for the user, but also how enterprise infrastructure security is drastically changing.
How Does a VPN Work Under the Hood?
A VPN adds an encrypted middle layer to queries sent by the user. It works as follows:
Outbound Connection: The user connects outwardly to the VPN server, which is abstracted away by the VPN client on the user's device.
Encapsulation & Tunnelling: This creates a secure, encrypted tunnel (tunnel being a secure, encrypted pathway that wraps up your data so it can travel safely between your device and a remote server across the public internet) The VPN takes a normal data packet, encrypts it, and wraps it inside a new outer packet with a different routing address. The request made from the user's device to the tunnel is visible, but the communication from this point onward is completely hidden.
Authentication: Before the tunnel opens, the VPN server verifies the user's identity. In an enterprise environment, this typically hooks into central identity systems (like Active Directory) and enforces Multi-Factor Authentication (MFA).
ISP Blindness: The user requests a web page. The user's Internet Service Provider (ISP) cannot see what webpage has been requested because all communication is encrypted and runs through the VPN connection.
IP Masking: The user's IP address appears to be that of the server on which the VPN lives, meaning that all requests made look to have originated from the subnet of the VPN.
This provides two fantastic advantages:
Privacy: Because of this layer of privacy, all data about where the requests are going is encrypted, not just the content of the communication as would be the case with standard HTTPS traffic without a VPN. (Note that enterprises care about privacy and data integrity, not anonymity, as most enterprise VPNs strictly log employee traffic for auditing purposes).
Resource Access: Devices that are not in the same geographic location can behave as if they were on the same network. This means remote working employees can access company resources from home in the same way they would from their office. It also allows companies to securely connect entire branch offices or data centres to each other over the public internet (known as a Site-to-Site VPN).
What are the security flaws of a VPN?
While traditional VPNs have served enterprises well for decades, they suffer from a potential structural security flaw known as the "Castle and Moat" model.
To host a traditional enterprise VPN, you must punch a hole in your network firewall to let remote users in. The VPN gateway sits on the public internet, listening for incoming connections. Even with strict inbound firewall rules, this leaves the gateway exposed to port scans, DDoS attacks, and exploit attempts from hackers. It’s well and good having best in class security but, without expensive DDoS protection, your systems can still become overrun by having to reject / drop millions of unauthorised requests. Even if your system isn’t breached, it can be shut down through sheer fatigue whilst keeping the bad guys out.
Furthermore, once an employee successfully authenticates through the VPN (crossing the moat), they are trusted inside the network (the castle). If a cybercriminal steals an employee's VPN credentials, they gain lateral access to the entire corporate subnet. They can move freely from server to server, scanning infrastructure and deploying malware.
Is there a more secure option?
To solve these potential security holes, the enterprise world is rapidly moving away from traditional VPNs toward Zero Trust Network Access (ZTNA), pioneered by solutions like Cloudflare Tunnels (part of Cloudflare One). I recently blogged about my use of this technology and you can read more about it in this post.
While a traditional VPN forces you to open inbound ports, a Cloudflare Tunnel completely flips the model:
Outbound-Only Connections: You install a lightweight software daemon (called cloudflared) inside your private infrastructure. This could be as simple as running the software on the virtual machine you have used to host your VPN, or running an additional container in your cluster. This daemon reaches out to Cloudflare’s secure global network. Your infrastructure completely vanishes from the public internet,there are no open inbound firewall ports for hackers to scan or attack. When users request resources, they are first forwarded to Cloudflare, Cloudflare has multiple layers of security out of the box, then Cloudflare forwards the request securely down the ZTNA tunnel and into your infrastructure.
Application Access vs. Network Access: Traditional VPNs operate at the network layer (Layer 3), dropping users directly onto your private subnet. Cloudflare Tunnels operate at the application layer (Layer 7). Cloudflare acts as an identity-aware proxy. The user never gets an IP address on your internal network; instead, they are connected exclusively to the specific web app or server they need, keeping the rest of the infrastructure hidden.
Seamless User Experience: Instead of employees launching a clunky VPN client, waiting for it to connect and suffering through high latency caused by back-hauling traffic to a central office. Cloudflare integrates natively with the browser or a lightweight, always-on device agent. Identity is validated instantly in the background using your company's Identity Provider (like Google Workspace).
The downside of using the ZTNA is that Cloudflare decrypts traffic before forwarding it through the tunnel (in order to ensure there is no malicious content), so If you absolutely need privacy from everyone (including Cloudflare), the VPN is the way to go.
As usual, don’t forget to check the RADAPEX blog page and RADAPEX on LinkedIn to read more of our blogs and success stories.
