Most small and medium-sized businesses in the UK still manage remote access with a single VPN appliance. It worked well enough when most employees sat at desks and worked from home occasionally. Today, with hybrid working the norm, cloud applications replacing on-premise software, and cyber attackers treating VPN tunnels as the fastest route into a business network, that single tool no longer fits.

The question is no longer whether VPN is obsolete. It is about when a traditional VPN still makes sense — and when a Zero Trust approach, usually delivered through Zero Trust Network Access (ZTNA), is the better investment.

This article compares the two models in practical terms, so you can decide which fits your business.

Why this choice matters for SMEs

A VPN creates an encrypted tunnel between a remote device and your internal network. Once a user authenticates, they are inside — and inside is generally treated as safe. That design worked when the office network was the only place your important data lived.

Zero Trust operates on a different principle: never trust, always verify. Each access request — whether from the office, a home laptop, or a coffee shop — is checked independently. Identity, device health, and context are evaluated before any access is granted, and access is limited to the specific application or resource needed.

The NCSC describes this shift clearly in its zero trust architecture guidance. The agency's position is that network location alone should never determine who gets access to what. Remote access is the point where that verification either happens or is bypassed — and for many SMEs, it is currently being bypassed.

For owner-managed businesses with 10 to 25 users, the decision between these two models has a direct impact on three things:

Security exposure — how much damage a stolen password or compromised laptop can cause User experience — how much friction employees encounter when accessing the tools they need Operational cost — the total spend on licences, infrastructure, and management time

How VPN works and where it falls short

A traditional virtual private network extends your office network outward to remote users. The user connects once, authenticates, and gains access to servers, shared drives, and internal applications.

For many small businesses this has been good enough for years. The limitation is that it conflates "the user is authenticated" with "the user is safe to access everything." That is the gap attackers exploit.

Advantages of VPN for SMEs

Simplicity. A VPN appliance or cloud-based virtual private network is a single tool that most small IT teams understand. Setup is straightforward, and staff rarely need training.

Encryption. VPNs encrypt all traffic across untrusted networks, which means data travelling over home broadband or public Wi-Fi is protected in transit.

Lower initial cost. If your business already has a firewall with VPN capabilities built in, the marginal cost of adding remote users is small. Many SMEs start with what they already have.

Limitations that matter

Overly broad access. Once inside the VPN, a user can reach any system on your internal network that they are permitted to access. If credentials are compromised, an attacker walks right in.

No continuous verification. A VPN checks identity once at login. It does not re-evaluate the device's health, the user's behaviour, or changes in location during the session.

Poor fit for cloud applications. VPNs were designed to route traffic back to a central office network. When your accountancy software lives in the cloud and your email is on Microsoft 365, forcing traffic through a VPN tunnel adds latency and complexity without adding value.

Lateral movement risk. If a compromised laptop connects through a VPN, the attacker gains a pathway to every internal system the compromised account has permissions for. Several Business Email Compromise and ransomware incidents reviewed by UK authorities began with a stolen VPN credential.

How Zero Trust works for remote access

Zero Trust is not a single product you install. It is an architectural approach that treats every access request as untrusted until verified. In practice, most SMEs implement this through ZTNA — Zero Trust Network Access — platforms that gate access at the application level rather than the network level.

Under a ZTNA model, an employee connecting from home does not enter a shared network space. Instead, they request access to a specific application — say, Microsoft 365 or a customer relationship management system. That request is evaluated against policies that consider who the user is, whether their device meets health requirements, and the context of the connection.

If the request passes, access is granted — but only to that one application. A second request for a different resource triggers a fresh evaluation. The connection is never automatically trusted because it was trusted once before.

Advantages of Zero Trust for SMEs

Granular access control. Users access only the applications they need. A sales assistant cannot reach HR records, and a contractor cannot see payroll data — regardless of which device or network they are using.

Reduced blast radius. If a device is compromised or credentials are stolen, the attacker is limited to whatever specific applications that compromised identity is permitted to reach. The entire internal network is not exposed.

Better fit for cloud-first setups. ZTNA platforms are designed for modern workloads. They work natively with SaaS applications, Microsoft 365 environments, and hybrid infrastructures that include both on-premise and cloud resources.

Continuous verification. Identity, device posture, and context are re-evaluated on each request. Suspicious behaviour can trigger additional checks or block access entirely.

Challenges to be realistic about

Planning overhead. Zero Trust requires you to know who needs access to what. If you do not already have that clarity — and many SMEs do not — the initial planning phase takes time and effort.

Legacy application compatibility. Older on-premise systems that rely on broad network access may need gateways, proxies, or adaptation to work within a ZTNA framework. Not every tool is ZTNA-ready.

Cost above baseline VPN. ZTNA solutions typically carry higher licence costs than a basic VPN. For very small teams with simple requirements, the return on investment may not justify the spend — yet.

VPN vs Zero Trust: Key Differences at a Glance

Which model should your business use?

Most SMEs do not need to make an all-or-nothing decision today. The practical answer depends on three factors: the size of your team, where your applications live, and your exposure to risk.

When VPN alone may still be reasonable

A traditional VPN can be a sensible choice if:

• You have fewer than 15 remote users

• Most of your critical systems are inside your office, with minimal cloud or SaaS applications

• You already have strong endpoint security, regular patching, and basic network segmentation

• You are not subject to sector-specific regulations requiring granular access controls

If you keep using VPN, tighten your configuration: enforce multi-factor authentication for every VPN connection, apply firewall rules that limit which systems VPN users can reach, and ensure you have clear offboarding processes to revoke access immediately when someone leaves or changes role.

When Zero Trust should be your next step

A ZTNA approach becomes the better fit when:

• A significant portion of your workloads live in cloud services

• Contractors, external IT providers, or suppliers regularly connect into your systems

• Staff work from multiple locations and devices, including personal machines

• You have already experienced, or are concerned about, lateral movement attacks

• You are reviewing cyber insurance or preparing for government tender requirements — insurers and procurement teams are increasingly asking about access control and network segmentation

A practical transition path

You do not have to rip out your existing VPN and replace everything overnight. The sensible approach is incremental.

First, map your critical applications and data. List every system your staff needs — accounting software, CRM, file storage, email, any industry-specific portals. Mark which are on-premise and which are cloud-hosted.

Second, define who needs access to what. Group staff by role, document which applications each group truly requires, and remove "nice to have" access. This step alone often reduces your attack surface more than any new software.

Third, tighten your VPN while you plan the shift. Restrict VPN access to only the necessary internal resources. Enable MFA. Enforce modern encryption standards.

Fourth, pilot a ZTNA solution for one or two high-value applications. Start with the system that carries the most risk or is accessed by the widest range of users. Test the user experience before expanding.

Fifth, introduce device posture checks. Require antivirus, operating system patches, and disk encryption on every device before access is granted — regardless of whether that device connects via VPN or ZTNA.

Sixth, review your approach annually. As more systems move to the cloud, reassess whether your central remote access tool still matches your architecture.

How Zero Trust relates to Cyber Essentials and insurance

Cyber Essentials does not mandate a specific technology for remote access. It requires that you demonstrate controls over how remote users access business resources. That can be achieved through a VPN with proper MFA, a ZTNA platform, or a cloud-based access gateway — provided the five technical controls are satisfied.

What Cyber Essentials does assess is whether your remote access configuration meets those controls under technical audit. A VPN that lacks MFA, allows unrestricted access to internal systems, and does not enforce endpoint security will not pass the plus-level technical assessment. A Zero Trust approach, by contrast, tends to align more naturally with the scheme's requirements because it enforces identity verification, least-privilege access, and continuous monitoring by design.

Cyber insurance providers take a similar view. Insurers increasingly ask prospective policyholders about their remote access controls, device management practices, and network segmentation. Businesses that can demonstrate granular access controls and continual verification — hallmarks of a Zero Trust approach — often receive more competitive terms than those relying on a single VPN with basic authentication.

Getting started: your next step

If you are not sure which model your business needs, the answer does not come from buying a new tool first. It comes from understanding what you currently have and where the gaps are.

A Security Triage Call with Infinite Cloud IT is a focused session to review your remote access setup against your actual requirements — not a generic sales pitch. We will map your current architecture, identify the risks that matter most for a business your size, and agree a practical plan to close the gaps.

Book a Security Triage Call to find out whether your remote access model is fit for purpose.

FAQ

Can I use VPN and Zero Trust together?

Yes. Many SMEs run a hybrid approach — keeping VPN for legacy on-premise systems that are not yet ZTNA-ready while using Zero Trust access for critical applications and cloud services. This lets you tighten security where it matters most without forcing an overnight migration of every system.

Is Zero Trust too expensive for a small business?

The cost depends on which tools you already use. Microsoft 365 Business Premium and above include Entra Conditional Access, which delivers core Zero Trust capabilities — identity verification, device compliance checks, and risk-based access controls — within your existing subscription. The real expense is usually in the configuration and ongoing management, which is where specialist IT support adds value. Standalone ZTNA platforms carry higher licence costs but may not be necessary if your cloud stack is already Microsoft-centric.

Does Cyber Essentials require Zero Trust?

No. Cyber Essentials does not mandate any particular technology for remote access. It requires you to demonstrate that you control how remote users access business resources. A well-configured VPN with MFA, tight firewall rules, and endpoint security can satisfy the scheme. A Zero Trust approach simply tends to align more naturally with those requirements because it enforces granular access and continual verification by design.

When should an SME move from VPN to Zero Trust?

The trigger is usually one or more of the following: your workload has shifted significantly to cloud applications, you have contractors or third parties accessing your systems regularly, staff use diverse devices and locations, or you face insurance or procurement requirements that demand granular access controls. If any of these apply, a ZTNA approach is worth a proper review.

What is the biggest mistake SMEs make with remote access?

Assuming that VPN provides enough security on its own. A VPN encrypts traffic in transit, which is valuable, but it does not verify identity continuously, check device health, or limit access to specific applications. That combination of overly broad access plus no ongoing verification is the gap that attackers exploit most frequently.