The Dual Nature of the VPN
When most people hear "VPN," they think of anonymity. They imagine a commercial service designed to hide their traffic from their ISP or bypass government firewalls. However, when your employer requires you to launch GlobalProtect, FortiClient, or Cisco AnyConnect, the purpose is exactly the opposite.
A Corporate VPN is not designed to give you privacy; it is designed to extend the corporate office network directly into your living room.
Full Tunnel vs. Split Tunnel
To understand what your IT department can see, you must determine how the VPN is configured. There are two primary deployment methods.
1. The Full Tunnel (Total Surveillance)
In a Full Tunnel configuration, the moment you click "Connect," 100% of your internet traffic is forcefully routed through the corporate servers before hitting the open internet. This means:
- Web Traffic: If you open YouTube or search for a new job, that request goes to the company server first. The IT firewall logs the domains you visit.
- Content Filtering: The company's internal proxy can block you from accessing social media or gambling sites, just as if you were sitting at a desk in the corporate headquarters.
- SSL Decryption: As covered in our article about Institutional Firewalls, if your company issued your laptop, they likely installed root certificates. They can legitimately decrypt your HTTPS banking or medical traffic if they actively choose to intercept it.
2. The Split Tunnel (Targeted Access)
Because Full Tunnels consume massive amounts of the company's expensive bandwidth, modern IT departments usually deploy a Split Tunnel. In this mode, only traffic destined for internal corporate resources (like `intranet.company.local` or a private Git repository) is pushed through the VPN tunnel.
Everything else—like Spotify, Google, and Netflix—goes straight through your normal home ISP router. The company servers never see your personal browsing history because it was never sent to them.
The Ultimate Threat: Endpoint Management
Many remote workers ask: "If I turn off the corporate VPN, am I safe to do whatever I want on the work laptop?"
Absolutely not. While the VPN only tracks network flow, the laptop itself is riddled with Mobile Device Management (MDM) software and endpoint telemetry agents. Independent of your current IP routing, these background services constantly upload lists of installed applications, connected USB drives, and sometimes even active screen times directly to the security operations center.
The only secure way to separate your personal life from your corporate life is the harsh physical boundary of using two entirely different computers.