A VPN encrypts traffic between two points over an untrusted network, so remote staff or a second building can reach security systems without exposing them publicly. It protects data in transit and authenticates the endpoints, but it does not fix weak passwords or an unpatched recorder.
A VPN solves the exposure that port forwarding creates. It does not solve anything inside the tunnel, which is why the account and the device still matter.
Two shapes of tunnel
A site-to-site tunnel joins two buildings permanently, and a client VPN connects a person device to the network. Both need defined endpoints, current configuration and a decision on what each user may reach.
What it does not cover
Encryption in transit says nothing about who holds an account or whether the recorder was patched. Segment the tunnel so a remote viewer cannot reach the whole office network from a home computer.
Related:Commercial security camera systemsGlossary: Access control system