How to secure staff working from home: VPN vs ZTNA

A VPN connects a remote worker to your whole office network. Zero trust network access (ZTNA) connects them only to the specific applications they need, after checking who they are and that their device is healthy. That difference matters when a password is stolen: with a VPN, the attacker can reach everything, while with ZTNA they reach only that person's applications, and only from a device that passes the checks. If all your systems are already in the cloud, such as Microsoft 365 or Google Workspace, you may not need either.

Why remote access is a target

In Sophos's 2025 Active Adversary Report, based on its incident response and MDR cases, the most common way attackers got into a network was through external remote services, such as firewalls and VPNs, using valid accounts. That accounted for 56% of cases. Compromised credentials were the top root cause of attacks for the second year running.

In other words, attackers often don't break in. They log in, with a stolen or guessed password, through the same remote access your staff use.

How a VPN works

A VPN (virtual private network) creates an encrypted tunnel from the laptop to a device in your office, usually your firewall. Once connected, the laptop behaves as if it's plugged into the office network.

That's simple and familiar, but it has two weaknesses:

• Access is all or nothing. A connected user can usually reach every system on the network, so a stolen password or an infected laptop can too.
• The VPN device faces the internet. Attackers scan constantly for VPN devices with known flaws, so it has to be patched quickly every time an update comes out.

How ZTNA works

Zero trust network access starts from the opposite assumption: no one is trusted just because they're connected. Each time someone opens an application, ZTNA checks:

• Who they are, with multi-factor authentication.
• Which applications they're allowed, so an accounts assistant gets the accounts system and nothing else.
• Whether the device is healthy, for example that its security software is running and hasn't found a threat.

Your applications stay hidden from the internet, so there's nothing for an attacker to find and probe.

VPN vs ZTNA at a glance

Do you need either?

Many small businesses no longer do. If your email, files and business applications are all in Microsoft 365, Google Workspace or other cloud services, staff reach them over the internet without a VPN at all. Your security then depends on their accounts and devices, which is where the basics below come in.

You do need secure remote access if staff use something that still lives in your office: a file server, an on-premises accounts or practice management system, or a machine they connect to with remote desktop. Never leave remote desktop open directly to the internet: it's one of the first things attackers look for.

The basics every home worker needs

Whatever you use for remote access, each home setup should have:

1. A work laptop managed by the business, not a shared family computer, with device protection and automatic updates.
2. Multi-factor authentication on every account, ideally phishing-resistant methods such as passkeys or an authenticator app with number matching. Identity protection watches for accounts being misused.
3. Disk encryption, so a laptop lost on the way home doesn't become a data breach. Our guide, Lost or stolen work laptop?, explains why.
4. A screen lock after a few minutes, and a reminder that family members don't use the work laptop.
5. A home router that's up to date, with its default admin password changed.
6. A clear way to report problems, such as a suspicious email or a lost device, quickly and without blame.

Where we can help

Our secure remote access service gives staff the applications they need from anywhere, and nothing else, without a traditional VPN. A gateway is built into every Sophos Firewall, or it can run on its own. If you're not sure whether you need remote access at all, talk to us and we'll look at how your staff work now.

< Back to Guides