Your contractor needs one app, not your network

There is a quiet habit in how companies let outsiders in. A contractor needs a program. Someone says 'give them VPN access', and the matter is closed. It is quick, it is familiar and it works. It also answers a bigger question than the one that was asked.

Two different questions

A VPN answers: can this device reach our network? A contractor's real question is: can I use this application? Those sound close. They are far apart. The first grants reach to everything the network can see. The second grants the ability to do one job.

Why the gap matters

Security people talk about blast radius: how far a mistake or a compromise can spread. A contractor with network access sits at the centre of a much bigger circle. If their laptop is infected, shared with a family member or simply set up carelessly, the circle is yours. You are not trusting the contractor. You are trusting every device and habit they own.

With per-app access the circle is the size of one application. A compromised laptop can see a picture of that application and send it keystrokes. It cannot wander the file shares, probe the servers or find the tool nobody remembered to lock down.

It is not only about attackers

Most real incidents with outside access are dull. Someone leaves the project and the account stays. A password is shared in a message. A laptop is lost with local copies of exports. Reducing reach limits the damage from each of these without anyone doing anything clever.

It also makes offboarding a single act. Removing someone from one application is a clear, checkable step. Hunting down everything a network account could touch is not.

What good per-app access needs

• A role for each person, so the contractor can do their job and the observer can only watch.
• Controls on what may leave: whether the clipboard and file transfer are open, and whether a watermark marks the screen.
• A record of what happened, so access is something you can review rather than something you hope about.
• Removal that takes effect immediately, not at some later expiry.

None of this is exotic. It is what you would ask for if you were designing outside access from scratch rather than inheriting a VPN from an earlier decade.

When a VPN is still right

Fairness matters here. Some outside people really do need network-level access: an engineer working on servers, someone running a migration. A VPN is the right tool for them. The point is not that VPNs are bad. It is that they are being used for jobs that are much smaller than a network.

If you do one thing this quarter, list who outside the company has VPN access and ask of each: what is the one thing they actually use it for? The honest answers tend to be a short list of applications. That list is your starting point.