In today’s digital age, securing company communications and data is paramount. While personal VPNs (Virtual Private Networks) such as Nord, Proton and Express VPN are often touted as a solution for online privacy and security, they are not suitable for protecting sensitive business information. Here are several reasons why you should not use a personal VPN for securing business communications and why doing so may expose your business to additional risk.

Business Cloud services already encrypt traffic.
Microsoft 365 and other cloud services use end-to-end encryption to protect data in transit. This means that data is encrypted from the moment it leaves your device until it reaches the cloud service, making it nearly impossible for unauthorized parties to intercept or access it.   This feature ensures that data is secure without the need for an additional VPN layer.

Personal VPN’s are vulnerability to attacks.
Personal VPNs are frequently used by cybercriminals to mask their origin.  They are also not immune to data breaches and attacks.  New vulnerabilities are regularly discovered with personal VPN’s, and if not promptly patched, these weaknesses can be exploited to intercept and manipulate data. This makes personal VPNs a risky choice for securing company communications.

Who do you trust?
When you use a personal VPN, you are tunneling all data through a 3rd party such as Nord, Proton or Express VPN.  In doing so, you are inherently trusting that 3rd party with your information.  Do you trust them more that Microsoft or Google?  Recently, the Cybersecurity and Infrastructure Security Agency (CISA) published guidance which also recommends against using personal VPN’s.

False sense of security.
Using a personal VPN can give employees a false sense of security. While a VPN can mask an IP address and encrypt data in transit, it does not protect against all forms of cyber threats.

Performance and reliability.
Using a personal VPN can degrade performance due to the additional encryption and data routing processes. Cloud services are optimized for performance and reliability, ensuring fast and efficient access to data and applications without the need for a VPN.

If you do choose to use a personal VPN service, we recommend that you close and disable all applications and services that may be communicating with business clouds such as Microsoft 365 and Google Workspace.  Failure to do so may result in your business email account being disabled by your employer.  In addition, Microsoft’s and Google’s enhanced security services may see data from a personal VPN as risky and could block your account as a preventative measure.

In conclusion, while personal VPN services like Nord, Proton and Express VPN are valuable for personal privacy and skirting around international firewalls, they are not necessary for securing traffic to Microsoft 365 and other cloud services. By leveraging the built-in security measures of cloud services, businesses can ensure their data remains secure without the need for additional VPN layers.  The risk that personal VPN’s introduce is greater than the utility that they provide.

If you have any questions or need further guidance on securing your cloud services, please reach out!