When securing your endpoints, a VPN is necessary when you are away from the office or traveling, unless your company has a software-defined perimeter (SDP). I cover SDPs and Zero Trust in Chapter 11. Your company may have a VPN set up if they have an on-premise data center. Typically, you will connect to the company VPN in order to get access to the on-premise servers and applications. As more and more companies move to cloud-first postures, your company may not have one set up. If your company is cloud-first, then every service it uses is a SaaS. Your employees log in to M365 or Google Workspace, for example. The remote session is already being encrypted with TLS 1.2 or above. As more companies move to this posture, they may not have a VPN that you connect to. A VPN is not obsolete. When you are out and about away from your home Wi-Fi or company network, connecting to guest Wi-Fi, then you need to use a VPN. Be suspicious of any free VPN except for Proton...