Let’s be honest. When you’re building a business from scratch, your tech stack is the last thing you want to overthink. There’s product-market fit to work out, investors to pitch, a team to build and a runway that never feels long enough. Anything you add had better justify itself.
There is one piece of infrastructure that founders tend to wish they had set up earlier. Not a SaaS platform or a productivity app. Something more basic than either.
Table of Contents
The Exposure You’re Not Thinking About
Entrepreneurs are constantly in motion. Investor calls from airport lounges. Term sheets reviewed in hotel business centres. Pitches from co-working spaces in three cities in a week. It is the appealing part of the job, and it also means your most sensitive material regularly crosses networks you did not configure and cannot verify.
Emails, attachments, financial documents, pitch decks, proprietary code. All of it moving through infrastructure operated by someone you have never met, on a connection whose name you took at face value.
Public network guidance from the Cybersecurity and Infrastructure Security Agency makes the underlying point clearly: the difficulty with an open network is not usually dramatic interception, it is how little the user knows about who operates the connection and what it records. Their recommendation is to use encryption for anything sensitive.
What Is Actually Possible on an Open Network
Being precise here matters, because the risks are frequently overstated and that leads people to dismiss the whole subject.
- Traffic observation: most web traffic is encrypted these days, so the contents of what you send are usually not readable. What stays visible is the pattern: which services you connect to, how often, and for how long. Over a session that reveals a fair amount about what you were doing.
- Rogue access points: an attacker can stand up a network with a plausible name and wait for devices to join. This is a real technique, and phones set to connect to familiar names automatically will do so without asking.
- Session hijacking: if an attacker obtains session cookies, they can act as you on services where you are already signed in. Modern browsers and sites have made this harder than it once was, but it has not gone away.
For a founder, the consequences scale badly. A pitch deck reaching a competitor before a round, or access to investor correspondence, is not a nuisance. It is a material problem at exactly the moment you can least absorb one.
What a VPN Actually Does
A vpn for business builds an encrypted tunnel between your device and the internet. On a network you do not control, that means the local operator and anyone else connected sees one protected connection rather than a running record of every service your device reached.
The second benefit is that your IP address, which reveals approximate location and can be used to build a profile over time, is no longer directly visible to the sites and services you use. That reduces how easily third parties can correlate your activity across sessions.
Both of those are worth having if you work from unfamiliar networks regularly. Neither is dramatic, and that is rather the point: the value is in removing a routine exposure rather than defeating a sophisticated attack.
Choosing One Worth Trusting
Not all providers are equivalent, and the free options that surface in app store searches frequently come with trade-offs that defeat the purpose: activity logging, throttling, and privacy policies written to permit rather than prevent. When the traffic you are protecting is commercially sensitive, the provider matters more than the feature list.
- A no-logs policy verified by independent audit, not merely asserted on the homepage.
- Current encryption: AES-256 or WireGuard rather than vague claims about strength.
- Performance good enough to leave on: a tool people disable because it slows them down protects nothing.
- Server coverage where you actually work, which matters if you or your team travel.
- Transparency about ownership and jurisdiction, because that determines who can compel a provider to hand over data.
Where It Stops
Worth being straight about the limits, because a founder who believes a VPN covers everything will skip the things that matter more. It protects traffic in transit. It does nothing about a password reused across services, an investor-impersonation email asking you to change wire details, or a laptop that has not been updated in months.
Business email compromise, which is persuasion rather than technical intrusion, costs companies considerably more each year than network interception does. Authentication and a habit of verifying payment requests by phone will do more for you than any network tool. A VPN is a sensible layer, not a strategy.
The Return You Cannot Put in a Spreadsheet
There is no notification telling you an incident was avoided, which is why this kind of spending is easy to defer indefinitely. What you get instead is that working from a co-working space in Berlin or a hotel room in Tokyo stops being a decision you have to think about.
Founders who apply the same deliberateness to their security setup as they do to product and fundraising tend not to be the ones explaining an avoidable breach to their board.
