Giving contractors and personal laptops access without a VPN

Disclosure: we resell the Island Enterprise Browser. Obsidian Ridge deploys and manages it, so we have a commercial interest in this recommendation. Every figure attributed to a company below comes from Island's own published pages, read on October 22, 2026 and quoted from the body text. Those companies are Island's customers, not ours.

A small firm hires a part-time bookkeeper. She works two days a week from her own laptop and needs the accounting system, the bank portal and a shared folder of statements. The reflex is to set her up with a VPN. That is usually the wrong tool, and it is worth being precise about why.

Key facts

• A VPN gives network access when the job needs application access. Once a personal laptop is on your network, your controls end at the login.
• Island says contractors install only the browser: "no agents, MDM software, or device imaging required."
• Per application, downloads can be blocked or redirected "to secure cloud storage instead," alongside copy and paste, screenshots and watermarks.
• Landis+Gyr reports VPN use down 80% globally while covering about 400 contractors from nearly 80 suppliers.
• UHSP reports VPN usage down "more than 80%." Booking.com reports 17,000 users moved in weeks. Silicon Labs reports contractors on unmanaged devices with "no VPN required."
• Forrester's 2026 research says 72% of information workers "can do most or all of their work inside a browser."
• A browser is not a complete VPN replacement. Installed software, file shares and printers still need a network route.

Why the VPN is the wrong default for a contractor

A VPN answers one question: can this computer reach my network? It does not answer the questions a small firm actually has about a contractor. Can she download the client list to her desktop? Can she paste a client's bank details into a personal AI chat? If her laptop is already infected, what else can it now reach?

Island puts the trade bluntly on its BYOD page: "If you give the OK for unmanaged devices, corporate data is then out of your control. But when you force installing agents, virtual desktops, or monitoring tools on personal devices, the benefit of BYOD is gone."

That is the real bind. Nobody wants to install a management profile on a contractor's personal MacBook, and many contractors will simply say no. So firms either hand out broad network access with no data controls, or they buy a laptop for a two-day-a-week hire.

The reason a browser is a reasonable third answer is that almost all of the work happens there. Forrester's 2026 research, summarized on Island's report page, says "72% of information workers who use a computer for work purposes can do most or all of their work inside a browser." If that is true of your bookkeeper, then the browser is the whole perimeter you need to control.

What Island says the model looks like

Island's BYOD page describes the mechanics, and these are the sentences to hold a vendor to in a pilot:

• Installation: Contractors and employees "simply install the Island browser on any personal device and authenticate, no agents, MDM software, or device imaging required." The page also says "no kernel extensions, proxies, or OS-level configurations needed."
• Scope of access: New contractors "download Island, log in with their credentials, and immediately access only the applications you've authorized for their role."
• The other browsers: "Without proper authentication through Island, contractors cannot reach your corporate resources, even if they try using Chrome or other browsers." That depends on your applications being configured to require it, which is a setup task, not a default.
• Data controls: You can "prevent copy/paste from sensitive applications, block downloads to personal devices (redirecting them to secure cloud storage instead), disable screenshots, apply watermarks, and even redact sensitive data on-screen."
• Identity: Island "integrates with your existing identity providers (Azure AD, etc.)" and names Okta as well. Confirm your own provider before you buy.

One thing to settle early, because it is a conversation with a person and not a setting. Island says you can "see application usage, user actions, performance metrics, and even take screenshots of critical activities." On someone's personal laptop, agree in writing what is monitored, what is not, and for how long records are kept. A contractor who discovers screenshot capability after the fact is a problem you created.

What four companies report after cutting VPN use

Landis+Gyr: 80% less VPN, 400 contractors

Island's Landis+Gyr story is the most relevant of the four, because the contractor problem is the stated reason for the purchase. Island says the company "works with about 400 contractors from nearly 80 third-party suppliers," and quotes its security lead on the goal: "We wanted only one door."

The reported outcomes: "Island has also reduced Landis+Gyr's VPN usage globally by 80%," plus "secured 400 third-party contractors" and, in Island's summary, "IT gained granular data control over 80 suppliers without using broad system-level gateways." That last phrase is the architectural point. A gateway lets a supplier onto the network; a browser policy governs what the supplier can do with the data.

UHSP, Booking.com and Silicon Labs

Island's UHSP story, about a university of health sciences and pharmacy, reports "significant cost savings when reducing their VPN usage by more than 80%."

The Booking.com story lists "insecure access for contractors and other third parties" as one of the problems it set out to fix, and quotes the scale of the change: "To be able to transition 17,000 employees over to Island with very little downtime and very few IT support tickets, that's a testament to how well the Island platform works." Island says the company "eliminated not only the VPN, but also unmanaged browsers, antivirus software, and data-loss prevention tools," which it summarizes as four tools replaced by one browser.

The Silicon Labs story covers a company of over 2,000 people working with contractors and fabricators across more than a dozen countries. Its summary card reads "contractors secured on unmanaged devices, no VPN required," and the body adds the travel case: "Even in high-risk travel scenarios where VPNs are impractical, Silicon Labs turns to Island for secure access that mirrors the in-office experience."

Treat all four as evidence that the model works at scale, not as a forecast for your office. None was audited by anyone independent, and a 2,000-person company's VPN reduction tells you nothing about what you will spend.

The small-firm version

Two situations come up constantly, and neither one justifies a VPN.

The part-time bookkeeper. She needs the accounting package, the bank portal, a payroll system and a document folder, all of which are websites. Give her the work browser on her own laptop, allow only those applications, block downloads and copy out of the accounting system, and allow printing if she genuinely needs it. When the engagement ends you turn off one account, and there is nothing to collect from her computer.

The seasonal hire. A tax season contractor or a summer temp on a home computer is the same shape, with one addition: decide before they start whether they may download anything at all, because filing season is when someone will need a file on a desktop at 9pm. Agree the exception process in advance and name who approves it.

In both cases the test is the same. List every application the person opens. If they are all web applications, a browser does the job. If one of them is installed software, a file share or a label printer, you still need a network route for that one thing, and you should scope it as narrowly as you can rather than handing over the whole network. Our honest answer on whether you need a VPN covers where a VPN still earns its place, and the browser comparison names the alternatives to Island.

How Obsidian Ridge can help

We deploy and manage the browser, write the per-application rules, and remove access when an engagement ends, for firms that have no administrator of their own. Our commercial terms:

Obsidian Ridge deploys and manages the Island Enterprise Browser for firms of any size, including a one-person firm, at $18 per user per month, month to month with no minimum number of users, with zero-configuration initial onboarding and CISSP-led support for businesses in the Research Triangle and anywhere in the United States. Managed browser policies give your business control over work-app access and how client data is copied, downloaded, uploaded or printed.

Those are Obsidian Ridge's terms, not a claim about every Island seller. The managed browser service page describes the scope, and pricing shows how it sits beside monitoring. Add-ons are priced separately.

Talk with us about who works from a computer you do not own, which applications they need, and what you need stopped. If one of those applications cannot work in a browser, we will say so rather than sell around it.

Sources

All read October 22, 2026, and quoted from body text rather than page summaries.

• BYOD Workforce, Island: no agents or MDM, per-application data controls, contractor day-one access, identity providers.
• Island Customer Story: Landis+Gyr: 80% VPN reduction, 400 contractors, nearly 80 suppliers.
• Island Customer Story: UHSP: VPN usage reduced by more than 80%.
• Island Customer Story: Booking.com: 17,000 users in weeks, four tools replaced, contractor access.
• Island Customer Story: Silicon Labs: contractors on unmanaged devices with no VPN, and the travel case.
• Forrester browser security, Island's summary of a gated Forrester report: the 72% figure.