A VPN for a small team is a different purchase than a VPN for one laptop

Most small teams buy a VPN the way they buy antivirus: skim a features list, compare the first-year price, and get on with the week. The mistake only becomes visible later, when the renewal lands and nobody can say what the subscription is actually protecting. What decides whether the plan is still worth paying in year two is a different set of questions than the ones the sales page answers.

Start with whose traffic you are protecting

There are two very different purchases hiding behind the word "VPN" and they have almost nothing in common. The first is a router-level tunnel for a fixed office: everything behind that router shares one connection and one subscription. The second is a client on every laptop, phone and tablet that leaves the building — the sales rep on hotel Wi-Fi, the accountant working from a coffee shop, the owner checking the till from a phone.

If your team never leaves the office network, the first option covers the whole building in one decision. The moment anyone works away from the desk, you are buying the second, and the number of devices in your team — not the size of the provider's network — becomes the ceiling you hit first.

The server count is the least useful number on the page

A network of 5,800 servers spread over 60 countries sounds decisive. Treat it as a proxy for something else: how likely you are to find a fast, uncongested endpoint near the people who need one. A country carrying 440 of those servers will behave completely differently from a country where the provider has a handful, and the difference shows up on a Tuesday afternoon, not in a benchmark.

The question worth asking is narrower and easier to answer: does the provider run endpoints in the places your team connects from and the places your suppliers and banks expect to see you? Everything else on that page is marketing arithmetic.

The features that actually earn their keep

• A kill switch. When the tunnel drops, traffic stops instead of escaping in the clear. This is the single feature that turns a VPN from a convenience into a control.
• Split tunnelling. Route the office printer and local file server around the tunnel and keep everything else inside it, so encryption does not break the tools your staff already use.
• A double-hop route. Two servers, two layers of encryption. It costs speed — expect a loss in the region of 20 to 30 percent — and it is the right setting for whoever handles payroll, financial records or client legal files.
• A private mesh between devices. A direct, encrypted link between your own machines, with no server in the middle, is the cleanest way to reach a machine at the office from home. Up to 10 devices can sit in one of these networks, which is enough for a small team and not enough for a growing one.
• Threat filtering. Malware, phishing and tracker blocking inside the tunnel can replace a separate security subscription for some teams, provided you check that the filtering covers the files your staff actually download.
• An audited no-logs policy. Independent audits matter more than a badge on the homepage. Look for named auditors and years — this segment has reports from 2018, 2020 and 2022 — and read the scope of what was actually verified.

Where a consumer plan quietly runs out

The plan that looks perfect for a founder is usually capped at 10 simultaneous connections and one login per device. Two owners, a bookkeeper and a handful of phones exhausts that before the business has finished growing, and there is no dedicated address on the consumer tier for the supplier portal that only accepts connections from a known IP.

That is the moment to stop comparing consumer reviews and price a business tier instead. The features are unglamorous — more seats, fixed addresses, admin controls — but they are the ones that decide whether the rollout survives the second month.

Speed, read the way a buyer should read it

Test figures are usually presented as badges. Read them as two columns instead: how the provider behaves close to home, and what survives a long haul.

On a nearby endpoint, a well-run service should deliver hundreds of megabits in both directions with almost no loss. Across an ocean, expect the numbers to fall and, more importantly, expect some packet loss to appear. Distant connections still land in a range that carries video calls and file uploads comfortably — the figure to watch is the loss percentage, because that is what a finance team notices when a month-end upload keeps stalling.

The price you pay in year two

Entry pricing across this category sits in the region of 3.49 a month on a 2-year commitment for the basic tier, 4.49 for the tier that adds advanced threat protection and the device mesh, and 5.49 once a password manager and 1TB of storage are bundled in. Every tier comes with a 30-day money-back guarantee.

Two things worth writing down before you commit. First, renewal pricing is routinely 2 to 3 times the introductory rate, so budget the second term rather than the first. Second, the top tier only makes sense if you would otherwise pay for those extras separately — bundle a password manager and storage you were already buying and the arithmetic changes; bundle them and keep paying for both, and you have simply bought the same thing twice.

A 30-day test that settles the question

Use the guarantee window as a real trial rather than a formality.

• Run the test in a normal working week, not a quiet one, so the tunnel meets the traffic it will actually carry.
• Put every device on at once and find the connection ceiling before you fall in love with the plan.
• Exercise the two or three tools that matter most — voice calls, large uploads, remote access to the till or the accounting system.
• Break the tunnel on purpose. Disconnect the endpoint and confirm that traffic stops rather than leaking.
• Read the renewal price on the checkout page, not the promotional banner, and put a note in the calendar for the week the first term ends.

If the trial passes all of that, the decision is settled. If one item fails, it will fail again in month seven, when changing providers costs far more than changing your mind during the guarantee.

Who should not buy one

A business that never leaves a fixed office network and stores nothing sensitive outside it is paying for a solution to a problem it does not have. So is a one-person operation whose only remote work happens through a customer's own systems.

The honest test is whether your team connects from networks you do not control — hotels, airports, cafés, shared coworking spaces, a relative's home router. If the answer is yes, the subscription is a control, not a luxury. If the answer is no, a password manager and disciplined email hygiene will protect you better for less.

What a VPN does not cover

A tunnel protects data in transit. It does not stop a convincing invoice-fraud email, it does not recover a laptop that is stolen at the airport, and it does not replace backups. Most small businesses that get hurt are hit through an email or a payment instruction, not through an intercepted connection.

That is why the sensible stack is layered: a tunnel for the connections you do not control, e-signature and document controls for the paperwork that moves money, and a backup habit for everything you could not afford to lose. Budget for the layers rather than trying to make one product do all three jobs.

FAQ

Is a VPN enough security for a small business?
It is one layer, and a useful one: it protects data in transit on networks you do not control and hides your traffic from the local network. It does not stop a phishing email, a stolen laptop or a fraudulent payment request, so it belongs alongside email hygiene and backups rather than in place of them.

How many devices can we connect at once?
Consumer plans in this category typically allow 10 simultaneous connections per account, which suits a small team that shares logins sensibly. Once phones, tablets and a spare laptop push you past that, price the business tier instead of buying a second personal subscription.

Do we need the business tier, or is the consumer plan enough?
You need the business tier when you require fixed IP addresses for a supplier portal, per-user accounts with admin controls, or more seats than the consumer cap allows. For a team working entirely on laptops and phones, the consumer plan covers the job.

Does the price stay the same after the first term?
Usually not. Introductory rates are followed by renewal pricing that commonly runs 2 to 3 times higher, so compare the second year rather than the promotion. Note the renewal date during the guarantee window, while you can still walk away.

Should we pick a provider by server count?
No. Coverage matters only where you actually connect, and congestion on popular endpoints matters more than the total. Check the countries your team works from, then test speeds on a normal working day.

If you take one thing away: the buying decision is about how many devices leave your building, who handles the sensitive files, and what the second year costs. The features list is the easy part to read and the least useful part to decide on.