Picture a six-person design studio. Two people work from home most weeks, one travels, and the rest come into a small office with a file server in the corner. Someone needs to reach that server from a kitchen table two states away. The old answer was a VPN. The newer answer is zero trust.

This is a comparison for teams without a security department. The question is not which technology is theoretically better. It is which one you can run well on a Tuesday afternoon when the person who set it up is on holiday.

What a VPN actually gives you

A VPN is a tunnel. The client on the laptop connects to an appliance at the office, and for that session the laptop behaves as though it were plugged into the office switch. That single idea explains both its appeal and its weakness.

The appeal is real. Set it up once, hand out credentials, and everything on the internal network simply works: file shares, printers, that inventory application nobody wants to replace. If your people need to reach on-premises systems, few things beat that simplicity.

The weakness is the same feature seen from the other side. The tunnel is the authorization. Once someone is inside it, they are inside — and anything the network can reach, they can attempt to reach. A reused password, a laptop left in a taxi, a phished session token: each becomes a wide door. VPN appliances are also a well-worn target for attackers, and small teams are not always quick to patch them. One key opening the whole building is convenient until the key is copied.

What zero trust actually means

Zero trust is a habit more than a product. Instead of asking "is this person on our network?", you ask "is this person, on this device, right now, allowed to reach this specific application?" Every request gets evaluated, and nothing is trusted just because of where it came from.

For a small business, that usually means assembling a few pieces:

• An identity provider that handles logins and multi-factor authentication.
• Single sign-on across the apps you already use, so accounts live in one place.
• An identity-aware proxy or zero-trust network access service in front of internal tools, so a tool is only reachable after a successful login.
• Device checks where you can manage them: disk encryption on, updates applied, screen lock enforced.

The office network stops being the boundary. Each application becomes its own small door with its own lock.

Cost, in money and in admin time

VPN looks cheaper at first. Many firewalls include a VPN server, so the licence may already be paid for. What you don't spend in money, you spend in time: creating accounts, distributing profiles, explaining why the client disconnects on hotel Wi-Fi, and reissuing credentials when someone leaves.

Zero trust usually arrives as a subscription priced per user per month, and it often stacks on top of an identity provider that also charges per user. That sounds expensive until you count what it replaces. If you were paying for a separate remote-access tool, a password manager, or a support contract to keep the tunnel healthy, some of that cost moves rather than grows. Several identity providers have small-team tiers, and bundling identity with device management can cost less than two separate products.

The honest comparison is not price list against price list. It is total effort over a year. A VPN needing a two-hour fix every month is not free. A zero-trust setup nobody on staff understands is not cheap either, whatever the invoice says.

Complexity and the skills question

VPN is a known quantity. Almost anyone with basic IT experience can install a client and open a tunnel, and the mental model — you are either on the network or you are not — fits neatly in your head.

Zero trust asks for more. You need to understand identities, groups, application publishing and policy rules. You need to decide what "trusted device" means for a team mixing company laptops with personal phones. Getting that wrong is easy, and the mistakes are quiet ones.

If nobody in the business enjoys this work, consider a managed service provider who already runs zero-trust stacks. Paying for that expertise is usually cheaper than learning it during an incident.

The security trade-offs, honestly

VPN risks tend to be structural: a flat network where one compromised laptop can see everything, credentials that grant broad access, appliances needing patches, and split-tunnelling setups that quietly send traffic somewhere unexpected.

Zero trust risks tend to be configuration risks. Policies written too broadly — "all staff can reach all internal apps" — recreate the same flat access inside a nicer interface. Sessions can be stolen after login, so multi-factor authentication and short session lifetimes matter. The identity provider becomes the thing worth protecting: if that account falls, everything behind it is exposed. Device trust is the weakest link for small teams, because enforcing it across personal phones is often more trouble than it is worth.

Zero trust does not remove the need to think about access. It moves the thinking from the network cable to the login.

A practical way to choose

Most small teams do not have to pick a side. Work through these questions:

1. What are people reaching? Only cloud apps, or on-premises systems too? Cloud-only teams rarely need a VPN at all.
2. Who administers it? If that is a part-time role, favour the option with fewer moving parts and safer defaults.
3. What sits on the other side of the tunnel? A single file server is low risk. A flat network carrying finance systems is not.
4. Can you enforce device health? If not, lean harder on strong authentication and per-application access.
5. What breaks if it fails? Pick the design whose failure mode you can survive and explain to your team.

A common middle path: keep the VPN for one legacy on-premises system and put identity-aware access in front of everything web-based. Then, over a few months, publish internal apps one at a time behind the proxy and watch how often anyone genuinely needs the tunnel.

Start with identity, then shrink the tunnel

Whichever route you take, the first step is the same: turn on multi-factor authentication everywhere, get your accounts into one identity provider, and remove access the day someone leaves. That work pays off under either model and makes the next decision much easier to see.

Then pick one application — not all of them — and put it behind per-application access. Test it for a month with a handful of people. If it holds up, move the next app. If it does not, you have learned that with one tool instead of a company-wide outage.

For most small businesses, the destination is not "VPN or zero trust". It is a smaller tunnel, a stronger login, and access granted per application rather than per building.

Photo: Sergei Starostin / Pexels