# What is split tunnelling on a VPN, and is it a risk?

Split tunnelling means that only traffic for company systems goes through the VPN, while everything else, such as web browsing and video calls, goes straight to the internet from wherever the laptop is. It saves bandwidth and makes calls smoother, which is why it is common. The risk is smaller than it sounds if the laptop itself is protected: the device becomes the boundary, so it needs endpoint protection, updates and any web filtering you use. The trade-off is visibility: internet traffic that never enters the VPN never crosses your office network, so office firewalls and network sensors do not see it. Decide deliberately: full tunnelling if you need to inspect all traffic centrally, split tunnelling with strong endpoint controls otherwise. NetSenX sees the part that crosses a monitored segment; for the rest, an agent on a Linux or macOS laptop watches that laptop's own connections wherever it is.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/what-is-split-tunnelling-and-is-it-a-risk

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [Where should a sensor sit to see what VPN users do?](https://netsenx.com/en/faq/where-should-a-sensor-sit-to-see-vpn-users-traffic)
- [How do I detect a VPN account used from two countries at the same time?](https://netsenx.com/en/faq/how-to-detect-a-vpn-account-used-from-two-countries)
- [What is impossible travel, and which tool detects it?](https://netsenx.com/en/faq/what-is-impossible-travel-and-which-tool-detects-it)
- [Can network monitoring see where our VPN users connect from?](https://netsenx.com/en/faq/can-network-monitoring-see-where-vpn-users-connect-from)
- [Can NetSenX monitor a laptop that is outside the office?](https://netsenx.com/en/faq/can-netsenx-monitor-a-laptop-outside-the-office)