Because the parts that must be connected sit in places joined only by someone else's network: distant sites, mirrored data centres, home offices, outsourcing partners, remote maintenance, and distributed OT, IT or IoT devices.

Situations that need a connection beyond one's own cables:

• companies with many distributed, possibly far-apart sites;
• data centres deliberately spread over several sites and mirrored for redundancy (the further apart, the better for resilience, and the harder to connect);
• mobile work and home office, where users and devices can reach the company network only via the internet;
• remote access in outsourcing scenarios;
• remote maintenance, also in OT environments;
• data connections to distributed OT plants, other IT systems or IoT devices.

Dedicated leased lines such as dark fibre are rarely used, for cost reasons and because they often aren't available. Most connections run over a shared medium (a rented line) or a public network (internet, mobile network). The perimeter must therefore be extended across a network the organisation doesn't control.

Two VPN routers build an encrypted channel (a tunnel) through the shared network. For the participants at both ends the two private networks look directly routed, and the public area is locked out.

The VPN is a virtual network overlay: a logical network laid on top of a physical one. The most widespread kind is the VPN on Layer 3. Without it, two subnets that share the internet as their medium are just two networks on the internet. With it, packets between them are encrypted and wrapped at one VPN router, carried across the internet, and unwrapped at the other. The result is one extended perimeter with two private parts and an encrypted link between them, and outsiders on the shared medium can neither read nor join that link.