VPNs for small teams with no IT department
The starting point
A team of three, five or fifteen people usually has nobody dedicated to IT. Security decisions get made by whoever has a spare moment, which is why they should be few and well chosen.
A VPN belongs on that short list, but it is not the first item. It is worth knowing where it sits.
Where a VPN fits
Staff on the move. Sales, field technicians, anyone working from hotels and airports. The benefit there is immediate.
Working from home. Domestic networks shared with other devices, on routers nobody has updated in years.
Access from abroad. If someone travels to a country where certain services are restricted, they can keep working.
What matters more than a VPN
We say this even though we give away a VPN: some measures have a better effort-to-protection ratio.
Two-factor authentication on every account. It stops more attacks than anything else, by a wide margin. Email, banking, management tools: all of it.
A password manager. It removes password reuse, which causes most unauthorised access.
Backups someone has actually restored. A backup that has never been restored is not a backup, it is an assumption.
Automatic updates. On machines and on phones.
If those four are handled, adding a VPN helps. If they are not, start there.
A warning about free VPNs
If a free VPN does not explain how it is funded, the question is unavoidable: running servers costs money, and that money comes from somewhere. In some cases it has come from selling browsing data or inserting ads.
Before installing one on your company machines, look for that explanation. If it is missing, be sceptical. Ours is in free VPN and in what we log.