Business Case for Using VPN

Attractions of VPNs to enterprises include:

• Shared facilities may be cheaper—especially in capital expenditure (CAPEX)—than traditional routed networks over dedicated facilities.
• Can rapidly link enterprise offices, as well as small-and-home-office and mobile workers.
• Allow customization of security and quality of service as needed for specific applications.
• Can scale to meet sudden demands, especially when provider-provisioned on shared infrastructure.
• Can reduce operational expenditure (OPEX) by outsourcing support and facilities.

Distributing VPNs to homes, telecommuters, and small offices may put access to sensitive information in facilities not as well protected as more traditional facilities. VPNs need to be designed and operated under well-thought-out security policies. Organizations using them must have clear security rules supported by top management. When access goes beyond traditional office facilities, where there may be no professional administrators, security must be maintained as transparently as possible to end users.

Some organizations with especially sensitive data, such as health care companies, even arrange for an employee's home to have two separate WAN connections: one for working on that employer's sensitive data and one for all other uses.^{[citation needed]} More common is that bringing up the secure VPN cuts off Internet connectivity for any use except secure communications into the enterprise; Internet access is still possible but will go through enterprise access rather than that of the local user.

In situations in which a company or individual has legal obligations to keep information confidential, there may be legal problems, even criminal ones, as a result. Two examples are the HIPAA regulations in the U.S. with regard to health data, and the more general European Union data privacy regulations which apply to even marketing and billing information and extend to those who share that data elsewhere.