As of 13 August 2026, AI can only partly choose and secure a VPN for your business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the official documentation for the VPN products being considered and gather their current security, administration, device-support, logging, support and data-handling details without copying credentials or private keys.
   2. Write down the business requirements, including users, locations, devices, systems that need access, identity provider, existing controls, resilience needs and any contractual or regulatory constraints.
   3. Paste the requirements and the relevant official documentation into a chatbot with the supplied prompt, and ask it to identify missing information before making a shortlist.
   4. Compare the model's shortlist and proposed access rules against the official product documentation, marking every unsupported feature, certification or compliance claim as unresolved.
   5. Give the proposed design and staged rollback plan to an experienced network or security professional, who should adapt it to the live environment and approve the access model.
   6. Implement the approved configuration in a limited pilot, then record the results of authentication, authorised access, denied access, DNS, routing, logging, failure and account-removal tests before wider deployment.

   Prompt

   Help me choose and plan a secure business VPN for a UK business. Treat this as a planning and documentation exercise, not permission to make changes to a live system.
   
   Business context:
   - Business size and number of users: [insert]
   - Staff locations and remote-working needs: [insert]
   - Offices, cloud services and key systems: [insert]
   - Devices and operating systems: [insert]
   - Identity provider and existing security controls: [insert]
   - Regulatory, contractual or customer requirements: [insert]
   - Budget and preferred support model: [insert]
   
   Use only the requirements and provider documentation I supply. Do not invent current features, prices, security certifications or UK compliance claims. If a fact needs checking, label it CHECK against the provider's current official documentation. Do not ask for or repeat passwords, private keys, recovery codes, secret tokens or other credentials.
   
   Produce:
   1. A requirements summary and a list of missing information.
   2. A comparison framework for suitable VPN approaches, including identity controls, device support, logging, administration, resilience, support, data handling and exit options.
   3. A shortlist only where the supplied evidence supports it, with a reason for each choice and the trade-offs.
   4. A high-level network design, access rules and least-privilege plan. Clearly mark anything that requires an experienced network or security professional.
   5. A staged implementation and rollback plan that avoids exposing credentials.
   6. A test plan covering authentication, authorised and unauthorised access, DNS and routing, device loss, logging, service failure and access removal.
   7. A handover checklist for the person who will implement and independently review it.
   
   Separate facts, assumptions and recommendations. Do not claim that the resulting design is secure until it has been reviewed and tested on the actual systems.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.