There’s a daily ritual in thousands of hybrid workplaces: connect the VPN, open the mapped drive, double-click the file — and wait. And wait. The pattern made perfect sense when it was built: the files lived on the office server, the VPN extended the office network to your laptop, done. It just was never designed for what it’s now asked to do — move gigabyte-scale files over home internet through an encrypted tunnel to a machine pretending it’s on the LAN. The crawl isn’t a configuration problem; it’s the architecture meeting its ceiling. Here’s why, and the modern paths past it.
Why the old pattern is structurally slow
Three compounding taxes. The protocol tax: traditional Windows file sharing (SMB) is a chatty protocol built for local networks — it assumes instant round-trips, and every one of its many back-and-forth exchanges now crosses the internet, multiplying latency into the experience. The tunnel tax: the VPN encrypts and funnels everything through the office’s internet connection — whose upload side, usually the thin side, now serves every remote worker’s downloads simultaneously. The distance tax: physics; the file crosses the country to reach you, every open, every save. Stack the three and the 800MB file that opens in two seconds at a desk takes twenty minutes at a kitchen table — and users respond the way users do: copying files locally “just for today,” which trades the speed problem for a divergence-and-security problem.
Worth saying plainly: this is a performance argument, not just a security one — though the security case against whole-network VPN access has its own article and points the same direction. When retiring a pattern solves two problems, that’s usually the architecture talking.
Path one: move the files to where the access is
The cleanest fix inverts the geometry: instead of remote users reaching into the office, the files live in the cloud — SharePoint/OneDrive for ordinary documents, with sync clients giving everyone local-speed opens and background upload — and suddenly the office is just another place that accesses them, no tunnel involved. For genuinely large files, the same inversion applies with heavier machinery: the purpose-built platforms and central-truth-with-caching patterns, where remote workers sync or check out what they’re working on rather than dragging live gigabytes across a tunnel per edit. This path is where most businesses should land, and many are halfway there already — running the VPN ritual out of habit for files that also exist in a cloud library nobody told the team about.
Path two: when the files must stay put, change how they’re reached
Some data genuinely stays on-premises — the machine-tied systems, regulatory or contractual location requirements, or datasets simply too large to relocate on your bandwidth. The pattern there: stop moving the files; move the screen. Remote desktop done properly — published apps or virtual desktops behind a modern gateway with MFA, or Windows 365-style cloud PCs — means the CAD application runs next to the data at full LAN speed, and only pixels cross the internet. A designer on hotel Wi-Fi gets workstation performance because the workstation never left the building. It’s also, not incidentally, the tightest security posture of any option here: the files never touch the endpoint at all — a property some compliance regimes actively want.
And the transfer case: when the job is sending a big file rather than working on it — deliverables to a client, media to a printer — neither VPN nor email is the tool. Governed share links with expiration from your existing platform handle it with an audit trail, retiring both the FTP relic and the random transfer site someone found under deadline.
Making the switch without chaos
The migration is smaller than it looks, because it’s mostly redirection: inventory what the VPN is actually used for (frequently: three folders and one application — the usage data tells you) · move the document tiers to the cloud path and the heavy/anchored tiers to the moved-screen path · tell people where things went, twice · then shrink the VPN to the legacy remnant that truly needs it — smaller attack surface, smaller patch-anxiety footprint, and no more ritual. The measure of success is subjective and unmistakable: the kitchen-table double-click just… opens.
The bottom line
VPN-to-file-server was the right answer to a question nobody’s asking anymore. Put ordinary files where the access is, move the screen to the files that can’t travel, and send deliverables through governed links — and the daily wait dissolves into architecture that’s faster and safer, which is the rare trade with no loser except the ritual itself.