Risks of Using a Personal VPN at Work

Quick Verdict: Is it Allowed?

Generally, No.

On a company-issued device, installing a personal VPN (like NordVPN or ExpressVPN) is almost always a violation of the Acceptable Use Policy (AUP). IT administrators treat unauthorised encryption tunnels as severe security risks because they bypass firewalls, content filters, and malware scanners.

On a personal device (BYOD) connected to the Guest Wi-Fi, it is usually acceptable and highly recommended for your own privacy. However, never install a personal VPN on a device managed by your employer without explicit written permission.

Risk Level (Corporate Device): High (Disciplinary Action)

Risk Level (Guest Wi-Fi): Low (Safe)

Corporate VPNs vs. Personal VPNs

It is vital to distinguish between the two types of VPNs found in a business environment:

• Corporate VPNs (Allowed): Tools like Cisco AnyConnect, Palo Alto GlobalProtect, or OpenVPN Access Server. These are provided by your company to securely connect remote workers into the office network. Using these is required and safe.
• Personal VPNs (Banned): Commercial apps like Surfshark or Proton VPN. These tunnel traffic out of the network to hide activity from your employer. This is known as "Shadow IT" and is what gets employees in trouble.

What Your Employer Will See

Many employees believe a VPN makes them invisible to IT. On a managed device, this is dangerously incorrect. Because the IT department controls the hardware (the laptop itself), they can see activity before it gets encrypted by the VPN.

Real World Consequences

Ignoring IT policies has led to dismissal for many employees. While specific "fired for VPN" headlines are rare (companies usually cite "policy violation"), the following cases illustrate the severity of unauthorised software use.

• Wells Fargo Dismissals (2024): In a high profile case reported by HR Grapevine, over a dozen employees were fired for using "simulation" tools (mouse jigglers) to fake activity. This mirrors VPN usage as it falls under "unethical behaviour" and "tampering with company equipment."
• UK Tribunal Ruling (2025): A recent Employment Tribunal awarded £14,000 to an employee for unfair dismissal over personal browsing. However, the key takeaway for employers was to ensure disciplinary procedures are strictly followed. If your contract explicitly bans VPNs, a tribunal is less likely to rule in your favour.
• The "Insider Threat" Logic: A case study by CFC Underwriting highlighted a bank hack caused by a vulnerable VPN. This explains why IT teams are ruthless: an unpatched personal VPN on your laptop could be the gateway for ransomware that costs the company millions.

How IT Detects You

You cannot hide a VPN connection from a competent IT department. They use sophisticated tools to spot anomalies:

1. Endpoint Agents: Software like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint runs on your laptop. It catalogues every installed application and running process. It will instantly alert admins if "NordVPN.exe" is launched.
2. Deep Packet Inspection (DPI): Next-generation firewalls (NGFW) inspect the structure of network packets. They can identify VPN protocols like WireGuard or OpenVPN even if the content is encrypted.
3. Traffic Spikes: A sudden surge of encrypted traffic going to a known commercial VPN IP address stands out on network logs compared to normal web browsing.

Common Myths About Workplace VPNs

There are several misconceptions that often lead employees to make poor decisions regarding shadow IT. Let's debunk the most frequent myths:

• Myth: "If I only use it for five minutes, IT won't notice."
  Truth: Modern endpoint detection and response (EDR) solutions log process executions instantly. The moment the VPN service starts, an alert is queued for the Security Operations Centre.
• Myth: "Split tunnelling will keep my work apps visible and hide the rest."
  Truth: While split tunnelling routes traffic differently, the endpoint agent still monitors all local device activity, including the creation of the split tunnel itself.
• Myth: "My company is too disorganised to monitor this."
  Truth: Most businesses use automated tools. It does not require a human sitting at a desk watching your traffic; the software automatically flags unauthorised behaviour.

Can You Get Fired?

Yes. In many companies, circumventing security controls is classified as "Gross Misconduct."

• Data Exfiltration Risk: IT teams treat unauthorised VPNs as potential data theft tools. If you are tunnelling out, they cannot see if you are uploading confidential client lists or trade secrets to a private server.
• Malware Bypass: A personal VPN creates a "blind spot" in the corporate firewall. If you download a virus through that tunnel, it enters the internal network without being scanned, potentially infecting the entire company.
• Breach of Contract: Most employment contracts include an Acceptable Use Policy (AUP) that explicitly forbids installing unauthorised software or bypassing network filters.

Risks for Small Businesses (SMBs)

The risks aren't limited to large corporations. In fact, using a VPN in a small office can be even more disruptive:

• Bandwidth Hogging: Small businesses often have limited internet bandwidth. If one employee uses a VPN to stream 4K video or download large files, it effectively hides the traffic type but consumes the bandwidth, slowing down the internet for the entire office.
• MSP Alerts: Many small businesses hire Managed Service Providers (MSPs) to look after their IT. These external IT companies use monitoring tools that trigger alerts for "unknown software installations." The MSP will bill the business owner for investigating the "security incident," which often leads to an awkward conversation between the boss and the employee.

Who to Ask for Permission

If you have a legitimate need for a VPN—for example, to research competitor websites from different geographic locations—do not just install one. Follow the proper chain of command:

1. IT Helpdesk: Submit a formal ticket requesting access to specific geo-blocked resources. They may be able to whitelist the site or provide a dedicated, monitored machine for research.
2. Line Manager: Explain the business justification. If your manager approves, they can advocate for an exception with the security team.
3. Information Security Officer (CISO): In larger firms, policy exceptions must be signed off by the security team. They may audit the specific VPN software to ensure it complies with company standards before allowing it.

Best for Personal Devices on Guest Wi-Fi

If you are using your own personal smartphone or laptop on the office "Guest" network, using a VPN is actually a good security practice. It isolates your personal traffic from the open guest network.