# VPN vs ZTNA for Remote Work: A Small Business Comparison

Source : https://cybercaribou.com/en/comparisons/vpn-vs-ztna-remote-work · Cyber Caribou

> VPN, ZTNA, conditional access or a cloud virtual desktop: which remote access approach fits your hybrid small business? Risks, costs and prerequisites compared.

For years, remote work came down to three letters: VPN. You installed a client on the laptop, the employee connected and found their network drives just like at the office. Today, vendors talk about ZTNA, zero trust and conditional access, often without explaining what that changes for a 20-person business.

The right question isn't "which technology is newest?" but "what do my staff need to reach, and from which devices?" This comparison builds on our guide to [remote work security](https://cybercaribou.com/en/blog/remote-work-security-business).

- We compare remote access approaches, not products. The criteria draw on publications from the Canadian Centre for Cyber Security, NIST, the UK's NCSC and CISA, plus Microsoft documentation, reviewed in October 2026.
- Criteria: what users can reach, device checks, lateral movement, internet exposure, access to on-premises resources, MFA, deployment effort and cost.
- Prices come from official sites and are given as examples; they exclude tax.
- This comparison is not sponsored.

## Start with an inventory

Before comparing technologies, list what your staff actually use remotely. If everything lives in Microsoft 365 and other cloud services, you may no longer need a tunnel back to the office. If a file server, an on-premises accounting system or a line-of-business application remains, you need a secure way to reach it.

Note the devices too: company-managed laptops, personal phones, a contractor's own computer. The answer narrows your options. A managed device can be checked before it connects; an unmanaged one is better kept away from your data altogether.

That inventory is also the first step in any zero trust effort, according to the Canadian Centre for Cyber Security: know your data, users, devices and applications.

## VPN: simple, but often all or nothing

A VPN creates an encrypted tunnel between the device and the office network. It's convenient, and often already paid for with the firewall. The downside: once connected, the user, or the attacker who stole their password, often sees much of the network.

The Cyber Centre lists the risks: vulnerabilities in VPN equipment, credential harvesting and misconfiguration. Its recommendations are clear: MFA, ideally phishing-resistant; prompt patching; logging; and avoiding split tunnelling as much as possible. This isn't theoretical. Flaws in VPN gateways from several manufacturers appear in the list of most exploited vulnerabilities published by CISA and its partners, including the Cyber Centre. A [patch management policy](https://cybercaribou.com/en/blog/patch-management-policy-small-business) that puts the firewall first is essential.

## ZTNA: access one application at a time

ZTNA applies [zero trust](https://cybercaribou.com/en/blog/zero-trust-small-business-explained) principles: no trust is granted by default, and every connection is authenticated and authorized based on identity, device and context. Staff reach only the application they need, not the whole network. If an account is stolen, the attacker stays boxed in.

The Canadian Centre for Cyber Security calls MFA an essential prerequisite and recommends a gradual transition, running the old and new models side by side where needed. The UK's NCSC warns that legacy services that don't support zero trust can trip up a project late in the game.

## Conditional access: often already in your licence

For a fully cloud-based business, the answer is often already in the licence. Microsoft Entra Conditional Access, part of Microsoft 365 Business Premium, applies rules at every sign-in: require MFA, require a device marked compliant, block certain countries, block legacy protocols. It doesn't cover what's left at the office, though, and one forgotten exclusion can weaken the whole setup.

## Cloud virtual desktop: when the device can't be managed

For a contractor or an employee on a personal device, a virtual desktop such as Windows 365 keeps data off the device. The hosted PC opens from Windows, Mac, iOS, Android or a browser. Billing is monthly and per user, and Microsoft notes that network usage charges may apply.

## How to choose

- **Everything in Microsoft 365?** Conditional access is often enough, with no VPN.
- **A server or software still at the office?** A well-hardened VPN does the job; plan to migrate those resources or move to ZTNA.
- **Contractors or several internal applications?** ZTNA limits each person to what they need.
- **Devices you don't manage?** A virtual desktop keeps data off the device.

In every case, MFA is mandatory on every access path. Our [remediation and hardening](https://cybercaribou.com/en/services/remediation-hardening) service can tighten an existing VPN or support the move to more targeted access.

## FAQ

**Does ZTNA completely replace the VPN?**
Not overnight. The Canadian Centre for Cyber Security recommends applying zero trust principles incrementally and, where needed, running both models side by side during the transition. In practice, you can keep a VPN for a few leftover uses while applications move to more targeted access.

**Should we turn off split tunnelling?**
The Canadian Centre for Cyber Security recommends avoiding it as much as possible, because it creates a bridge between the internet and the secure tunnel. It favours a forced VPN, where all traffic goes through the tunnel. If performance is a concern, discuss specific exceptions with your IT provider rather than opening the tunnel by default.

**Does a consumer VPN protect our remote workers?**
No, it's a different tool. A consumer VPN encrypts the connection to a commercial provider's server; it doesn't give access to company resources or enforce your security rules. Staff access should go through a solution the business controls, with MFA.

**Can a product make us 'zero trust'?**
No. The Canadian Centre for Cyber Security warns against vendors who claim a single product delivers zero trust: it's an approach, not a single technical solution. ZTNA is one piece of it, alongside MFA, device management and an inventory of who can access what.

## Sources

- [Canadian Centre for Cyber Security: Virtual private networks (ITSAP.80.101)](https://www.cyber.gc.ca/en/guidance/virtual-private-networks-itsap80101)
- [Canadian Centre for Cyber Security: A zero trust approach to security architecture (ITSM.10.008)](https://www.cyber.gc.ca/en/guidance/zero-trust-approach-security-architecture-itsm10008)
- [NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)
- [NCSC (UK): Zero trust architecture design principles](https://www.ncsc.gov.uk/collection/zero-trust-architecture)
- [CISA and partners (including the Canadian Centre for Cyber Security): 2023 top routinely exploited vulnerabilities (AA24-317A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-317a)
- [Microsoft Learn: Microsoft Entra Conditional Access (overview and licensing)](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview)
- [Microsoft Learn: What is Windows 365?](https://learn.microsoft.com/en-us/windows-365/overview)
- [Microsoft: Windows 365 Business plans and pricing (Canada)](https://www.microsoft.com/en-ca/windows-365/business/compare-plans-pricing)
- [Sophos: Sophos Firewall licensing (remote access VPN in the Base Licence)](https://www.sophos.com/en-us/products/next-gen-firewall/how-to-buy)
- [WatchGuard: Firebox security services](https://www.watchguard.com/wgrd-products/security-services)
- [Ubiquiti: UniFi Cloud Gateways](https://ui.com/cloud-gateways)
- [Cloudflare: Zero Trust plans](https://www.cloudflare.com/plans/zero-trust-services/)