Secure remote access: when a VPN is no longer enough

A traditional VPN hands the remote laptop the keys to the whole building. Secure remote access works in layers: MFA, reduced reach and entry only to the apps needed.

Updated 12 October 20266 min read

More than 10 workstations · support contract · remote, on-site and phone support

In this article

A password stolen from an employee working from home can be enough for someone to reach the company's servers, ERP and backups. That is the price of poorly designed remote access. A traditional VPN encrypts the path but leaves the remote laptop with reach over the entire network. Secure remote access is achieved in layers: a second factor on the VPN, reduced reach and, for most people, access only to the applications they need. In a small, well-organised SME, a well-built VPN with MFA can still do the job, the test below tells you whether that is your case.

Is the remote working set up in 2020 still secure?

Almost always, no. In 2020 remote working was born in a hurry: a VPN tunnel on the firewall, one credential per person and the team working from home. Since then the configuration has stayed the same, and attackers have moved on.

The very device serving the VPN has become a target. Verizon drew attention to attacks on edge devices and VPNs in 2025; in the 2026 edition, exploiting software vulnerabilities became the number one way in, seen in 31% of the breaches studied.

A key to the building or a key to the room?

A VPN gives the laptop a key to the whole building, servers, shares, printers, cameras. Application-level access gives a room key: it opens one door, logs the time of each entry and, if lost, the damage stays contained.

The VPN remains useful for one thing: protecting traffic on a public network. On its own, however, it does not prove the identity of whoever connects, does not assess the state of the device and does not restrict where it can go.

How does an attacker get in through the VPN?

Captured password A convincing phishing message is enough; without a second factor, the tunnel opens.
Home laptop Shared with the family and out of date, it brings into the network whatever it already carries.
Lateral movement Inside the network, the intruder looks for files, the ERP and, above all, the backups. Without segmentation, nothing stops them.
Firmware lagging behind The VPN concentrator faces the internet and is scanned by automated tools as soon as a vulnerability is published.

Six questions to tell whether your VPN still does the job

We only recommend changes when they are needed. If every answer is yes, your VPN is doing its job:

Does every connection require confirmation in the phone app, for everyone?
Can only company laptops, managed and kept up to date, connect?
Does each team reach only what concerns it, for example, accounts only the invoicing software?
Are fixes to the firewall and VPN portal installed within days rather than months?
Are connections logged (who, when, from where) and does someone review that log?
Does no external provider have a permanently open connection?

With two or more "no" answers, the flaw is not in VPN technology: it is in how it was configured.

Which remote access solution suits each situation?

Situation	Is a VPN with MFA enough?	Recommended approach
Small remote team, company laptops only	Yes, if well configured	Second factor, per-team profiles, firewall up to date
Use of personal computers	No	Email and documents in the browser, with no access to the internal network
Management software used outside the office	It depends	A published application with strong authentication, network closed
Frequent external providers	No	Named, restricted accounts, enabled only during each job
Clinical, financial or client information	Rarely	Application-level access with individual logging

How do you move to secure remote access in four steps?

1. Switch on the second factor

It is the measure with the highest return for the lowest cost. Business firewalls support MFA, often linked to Microsoft 365. Compare the options in our guide to MFA for businesses.

2. Let in managed devices only

Personal computers are limited to email and documents in the browser, with policies that block downloads. Using company information does not require being inside the infrastructure.

3. Publish applications, not the network

Email, documents, management software and, where needed, a remote desktop can be served without giving access to the whole network. Each application exposed with strong authentication has its own door and its own log. The VPN is reserved for those who administer systems.

4. Shrink the VPN's reach

Backups, video surveillance and network management consoles always stay out of remote reach. The firewall divides the network into zones and lets through only what is essential. Providers come in with their own credential, MFA and a connection that closes when the job is done.

What does this look like in a 40-workstation company?

An illustrative example: 40 workstations, 10 of them regularly remote. The architecture we propose:

Email and documents On managed Microsoft 365, with MFA and access conditional on the device.
Management software Served through a remote desktop protected by strong authentication.
VPN Only for two administrators, with a second factor, in an isolated management zone.
Providers Credentials created for each job and disabled at the end.

As a rule, it can be done with the firewall and licences the company already has: the design changes, the bill does not. The same reasoning drives the four-stage Zero Trust model, and VPN firmware should follow an update policy with tight deadlines.

What difference does a managed firewall make? The FreshDesign case

For FreshDesign, DataRoad implemented an NGFW and an encrypted VPN that gives the team remote access to internal servers and applications. The project combined central management of access and permissions, filtering and intrusion prevention, continuous remote oversight with early alerts, and two internet links with load balancing and automatic failover to the second operator.

What made the difference was the operation after installation. The contract covers firewall updates, regular rule tuning and monitoring of VPN stability. That is what separates a managed firewall from a door left open.

Frequently asked questions about secure remote access

Should we switch the VPN off immediately?

No. Start by switching on MFA and reducing reach, then move the team to application-level access and finally leave the VPN only for those who administer systems.

For an SME, is a VPN with MFA enough?

It can be, provided only company laptops connect, each team reaches only what it needs, the firewall is up to date and connections are logged. Fail a single condition and the risk is high again.

Is it safe to work on a home computer?

For email and documents in the browser, with downloads blocked, it is acceptable. For getting into the internal network, it is not.

Do we have to buy a new platform?

For the vast majority of SMEs, no. What is missing is better configuration of the firewall and Microsoft 365 they already have, and someone managing access continuously.

Next step: a remote access audit in 5 working days

We review the VPN, who connects and to which systems, provider credentials and the state of the firewall, and deliver a written plan with fixes ranked by priority. Request a no-commitment proposal. Management of managed firewalls and network security and of remote working and mobility is included in the IT Unlimited Premium plan.

More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.

Secure remote access: when a VPN is no longer enough

Is the remote working set up in 2020 still secure?

How does an attacker get in through the VPN?

Six questions to tell whether your VPN still does the job

Which remote access solution suits each situation?