Last updated: May 1, 2026
A VPN is a tunnel: take a packet, encrypt it, wrap it in a new outer packet, ship it over the internet, decrypt at the other side. Easy in concept; the security depends entirely on the cryptographic handshake and the policy you put around it. This module compares the three VPN protocols you will actually meet in 2026 — IPsec for site-to-site, OpenVPN for legacy remote access, WireGuard for everything modern — and demystifies the IPsec phase 1/phase 2 model that confuses every beginner.
What "VPN" actually means in 2026
Three patterns are all called “VPN” but solve different problems. Site-to-site VPN connects two networks (HQ to a branch office, on-prem to a cloud VPC) so hosts on either side can talk as if on the same backbone. Remote-access VPN connects a single user’s laptop to a corporate network so they can reach internal apps. Consumer VPN (NordVPN, ProtonVPN, Surfshark) tunnels traffic through a third-party endpoint to anonymise or geo-shift the user — a fundamentally different threat model from corporate VPN. This module focuses on the first two; consumer VPN is briefly addressed in M16 alongside the ZTNA comparison.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.