By Mike Chen · January 27, 2025

TL;DR: What Actually Secures a Remote Work VPN Setup

A secure remote-work VPN needs four things: AES-256 encryption, enforced MFA, a tested kill switch, and a written offboarding revocation workflow. SOC 2 CC6.6 and HIPAA §164.312(e)(1) both require encrypted transmission controls with audit evidence. A consumer VPN client won't satisfy either. Installing the app is 10% of the work.

Why Most Remote-Work VPN Configs Fail an Audit

Here's the gap that catches teams: your VPN is running, but it's not auditable. Auditors don't want screenshots. They want logs, revocation records, and access reviews tied to named humans.

I see the same three failure points on almost every pre-audit review. No centralised access logs. No MFA on the VPN authentication step itself. No documented revocation process when someone leaves. Those three findings alone can push a SOC 2 Type II report from clean to qualified.

The IBM Cost of a Data Breach Report 2023 puts the average cost of a breach involving stolen or compromised credentials at $4.62 million, and credential abuse remains the top initial attack vector in the Verizon 2023 DBIR. That's not FUD, it's math. If your VPN is protected only by a password, you're one phishing kit away from a very expensive Monday.

A VPN that works is not the same as a VPN that passes an audit. The gaps that come up most often are no SIEM ingest from the gateway, MFA enforced only at the SSO layer rather than on the VPN itself, and an offboarding process with no fixed deadline. All three are fixable long before an auditor arrives.

VPN Protocol Comparison: OpenVPN vs WireGuard vs IPSec vs SSL/TLS

Protocol choice matters more than most buyers think. Here's the honest breakdown.

WireGuard is the fastest and has the smallest attack surface. The WireGuard codebase sits around 4,000 lines. OpenVPN is closer to 600,000. Fewer lines means fewer places for a CVE to hide. NordLayer and Perimeter 81 both offer WireGuard-based tunnels (NordLayer calls theirs NordLynx).

OpenVPN is the most auditable option. It's been battle-tested for two decades, the logs are verbose, and it slots into SOC 2 CC7.2 monitoring requirements without much extra work. It's slower than WireGuard but you can live with that on a 50-person team.

IPSec is what Cisco AnyConnect runs on top of (along with SSL/TLS via DTLS). It's hardware-friendly, integrates with existing firewalls, and it's a pain to configure. Worth it if you already own the Cisco stack.

SSL/TLS VPNs are firewall-friendly because they ride HTTPS ports. Consumer products often use this. The problem: many consumer SSL/TLS VPNs don't export audit logs in a format your SIEM can parse.

For SOC 2 or HIPAA work, I default to WireGuard or OpenVPN. IPSec if the client already has Cisco infrastructure and doesn't want to rip it out.

Per-Seat Cost vs Security Uplift

Here's what the named tools actually cost as of January 2025, pulled from vendor pricing pages:

• NordLayer: $8 to $14 per user per month depending on plan
• Perimeter 81: $8 to $16 per user per month plus a gateway fee
• Cisco AnyConnect (Secure Client): roughly $30 to $50 per user per year at SMB scale, plus ASA or Firepower infrastructure
• ExpressVPN for Teams / consumer tier: around $8 per user per month with no admin console worth mentioning

Why does Cisco cost more? You get deep MDM integration, RADIUS and LDAP support, granular per-application policy, and posture assessment. If you're already running a SOC 2 Type II program with 200+ endpoints, that's justified. For a 60-person Series B startup, it's overkill.

Where consumer VPNs fail isn't security, it's administration. No centralised admin console. No SCIM provisioning from Okta or Azure AD. No audit log export. That's not "good enough for a small team," that's a compliance non-starter.

Decision rule: if you've got 50+ seats and any compliance obligation, the $6 per user per month premium over a consumer tool pays for itself the first time you avoid an audit finding. A single SOC 2 finding remediation typically runs $5,000 to $15,000 in consultant time. That's the math.

Also worth reading if you're weighing this build-vs-buy question: managed security services vs in-house.

Enforcing VPN Policy at Scale

Setup is the easy part. Enforcement is where teams lose audit points.

Always-on VPN via MDM. Use Jamf for macOS and iOS, Microsoft Intune for Windows. Configure the VPN profile so users can't disable the client without triggering an alert in the console. Intune runs about $6 per user per month bundled with Business Premium. Jamf is around $4 per device per month at volume.

Kill switch configuration. A kill switch drops all network traffic if the VPN tunnel drops. Critical for HIPAA ePHI transmission, because without it, a dropped tunnel means plaintext leakage. Test it by disconnecting the tunnel mid-session and verifying no traffic flows. Do this quarterly and log the result.

DNS leak protection. A DNS leak happens when your DNS queries route outside the VPN tunnel, exposing which sites users visit. Test at dnsleaktest.com. NordLayer, Perimeter 81, and Cisco AnyConnect all have built-in DNS leak protection. Verify it's actually enabled in your config, don't assume.

Split tunneling risk. Split tunneling excludes some traffic from the VPN for performance. The compliance exposure is real: if you exclude corporate SaaS traffic from the tunnel, you may void your SOC 2 encryption-in-transit control coverage. Document exactly what's split and why.

Monthly access review. Pull the active VPN user list. Cross-reference against your HR system. Flag any account not tied to an active employee. Takes 20 minutes. Closes one of the most common audit findings before it lands.

The Offboarding Gap

This is the most underserved risk in every VPN guide I've read. Everyone covers onboarding. Nobody covers revocation.

The Verizon DBIR has flagged former employees and contractors as a consistent insider threat vector for years, and unrevoked VPN credentials are the most common vehicle.

Here's the workflow that satisfies SOC 2 CC6.2 and CMMC AC.L2-3.1.1:

1. HR marks the employee terminated in the HRIS
2. That event triggers an automated ticket in ServiceNow, Jira Service Management, or (at minimum) a Slack alert to the IT channel
3. IT disables the VPN account within 1 hour
4. Revocation is confirmed in the VPN audit log
5. The action is documented in the quarterly access review record

The 1-hour SLA isn't arbitrary. SOC 2 CC6.2 language on "timely" access revocation is what auditors interpret, and the industry consensus for terminated employees is under 24 hours for lower-risk systems and under 1 hour for privileged access, which VPN counts as.

The easiest way to close this gap: tie VPN provisioning to your identity provider via SCIM. Okta Workforce Identity runs about $6 per user per month for the base SSO tier. When HR marks someone terminated in Workday, Workday pushes to Okta, Okta deprovisions the VPN via SCIM, and the audit log records it. No manual step, no gap.

Orphaned VPN accounts are a standing risk in remote-work environments. A contractor account left live after the contract ends is a saved credential waiting to be stolen along with the laptop. Wire the VPN to your identity provider and the account dies with the contract instead of months later. Pair this with our multi-factor authentication best practices guide and you close two of the top five audit findings simultaneously.

When VPN Alone Isn't Enough: ZTNA and SSE

Time for the honest conversation. If more than 60% of your stack is SaaS (Microsoft 365, Salesforce, Workday, GitHub), routing that traffic through a VPN adds latency without adding meaningful security. Employees notice. Then they bypass it.

Zero Trust Network Access (ZTNA) flips the model. Instead of "you're on the network, you can reach everything," it's "prove who you are and what device you're on before every resource request." Identity plus device posture on every connection.

Named tools and current pricing:

• Cloudflare Zero Trust: free tier up to 50 users, then around $7 per user per month
• Zscaler Private Access: enterprise-only, typically $15 to $25 per user per month
• Palo Alto Prisma Access: quote-based, expect enterprise pricing

ZTNA doesn't replace VPN for on-prem data centre access. Hybrid shops usually need both: VPN for the physical infrastructure, ZTNA for the SaaS and internal web apps. Don't let a vendor tell you it's either/or.

BYOD note: MDM enrolment is a prerequisite for ZTNA to work properly. Without device posture checks, ZTNA is just SSO with extra steps. Enforce enrolment or the whole model breaks.

For CMMC Level 2 and SOC 2, ZTNA architectures satisfy the access control criteria more cleanly than flat VPN configs, because the audit trail is per-resource instead of per-session. If you're running Cisco AnyConnect for on-prem legacy plus Cloudflare Zero Trust for SaaS, you've got a defensible architecture. See our SOC 2 readiness playbook for how this maps to Trust Services Criteria.

VPN Security Checklist for IT Admins

Print this. Tape it to your monitor. Every item maps to a compliance control:

• AES-256 encryption enabled (SOC 2 CC6.6, HIPAA §164.312(e)(1))
• MFA enforced on VPN auth (SOC 2 CC6.1, HIPAA §164.312(a)(2)(i))
• Kill switch configured and quarterly tested (HIPAA §164.312(e)(1))
• DNS leak protection verified via dnsleaktest.com (SOC 2 CC6.6)
• Split tunneling policy documented, reviewed annually (SOC 2 CC6.6)
• VPN logs exported to Splunk or equivalent SIEM, 12-month retention (SOC 2 CC7.2)
• Access provisioning tied to Okta or Azure AD via SCIM (SOC 2 CC6.1)
• Offboarding revocation SLA documented, under 1 hour (SOC 2 CC6.2, CMMC AC.L2-3.1.1)
• Non-compliant device policy enforced via Jamf or Intune MDM (SOC 2 CC6.7)
• Quarterly access review scheduled and evidenced (SOC 2 CC6.3)

Splunk pricing context: enterprise ingest runs around $150 per GB per day. Splunk Cloud for SMB deployments starts around $2,000 per month. If that's too rich, Elastic Security or Wazuh will get you started for a fraction of the cost, though you'll spend engineering time on tuning.

Speaking of tuning: we tune our clients' SIEM rules instead of running defaults. The industry average time from compromise to detection is 204 days per the IBM report. Every MSP has a SOC. Not every SOC is actually watching.

If you're within 90 days of a SOC 2 or HIPAA audit and don't know whether your VPN configuration will hold up to evidence review, book a free 30-minute audit with Mike. We'll tell you exactly what an auditor will flag before they do. If you're specifically in Middle Tennessee, our cybersecurity services in Nashville team handles VPN and ZTNA rollouts weekly. And if ransomware is the bigger fear driving your VPN review, start with ransomware protection for mid-market companies.

FAQ

Is a consumer VPN like ExpressVPN or NordVPN sufficient for a 50-person remote team? No. No centralised admin console, no audit log export, no SCIM provisioning from Okta or Azure AD. Not a SOC 2 or HIPAA-viable option regardless of the encryption strength.

What's the difference between VPN and ZTNA? VPN grants network access: once you're on the tunnel, you can reach the resources the tunnel routes to. ZTNA grants per-resource access based on identity and device posture, checked on every request. ZTNA is better for SaaS-heavy stacks. VPN is still needed for on-prem infrastructure.

How quickly should VPN access be revoked when an employee leaves? SOC 2 CC6.2 expects timely revocation. Best practice is under 1 hour for privileged access, automated via IdP offboarding through SCIM.

Does using split tunneling violate HIPAA? It can. If ePHI traffic is excluded from the tunnel, you lose the encryption-in-transit control required by HIPAA §164.312(e)(1). Document what's tunnelled and confirm ePHI is always inside.

What VPN protocol is most secure for business use? WireGuard for performance and small attack surface. OpenVPN for maximum auditability and compliance logging. IPSec where existing hardware compatibility is required.

How do I enforce VPN usage on employee devices without controlling personal traffic? Deploy always-on VPN on corporate-managed devices via Jamf or Intune, scoped to corporate traffic only using per-app tunnelling. Personal traffic stays off your logs, corporate traffic stays inside the tunnel.