VPN marketing often implies total online protection. The reality is narrower and more useful to understand.
This guide answers what does a VPN protect you from, where its protection ends, how leaks and configuration flaws undermine it, and how a consumer VPN differs from the remote access and zero trust tools organisations use.
By the end you will be able to judge when a VPN is the right control, which other controls must sit beside it, and how to test that your own VPN is doing its job.
A virtual private network creates an encrypted tunnel between your device and a VPN server, usually using WireGuard, OpenVPN or IPsec/IKEv2. Traffic leaves the tunnel at the server and continues to its destination from the server’s IP address.
That gives you two properties: confidentiality on the path between you and the server, and a different public IP address as seen by the sites you visit. Everything a VPN does or fails to do follows from those two properties.
Within its scope, a well-configured VPN closes several real gaps.
| Threat | Does a VPN help? | Why |
|---|---|---|
| Snooping on public or hotel Wi-Fi | Yes | The local network only sees encrypted tunnel traffic |
| ISP or local network logging the sites you visit | Mostly | DNS and destinations are hidden from the local network, but visible to the VPN provider |
| IP-based tracking and geolocation by websites | Partly | Your IP is masked, but cookies and browser fingerprinting still identify you |
| Certain on-path attacks such as rogue access points | Partly | Helps if the tunnel connects before other traffic and does not leak |
| Access to private corporate resources | Yes (corporate VPN) | Places the device on the internal network, which brings its own risks |
Because most sites already use HTTPS, the confidentiality gain on public Wi-Fi is smaller than it was a decade ago.
The VPN still hides which domains you visit from the local network and protects any traffic that is not encrypted end to end.
This is where most misunderstanding sits. A VPN changes the route your traffic takes; it does not inspect or judge that traffic.
If you type your password into a fake login page, the VPN encrypts it faithfully on its way to the attacker. Credential theft is a large problem: in January 2026 researcher Jeremiah Fowler reported an unprotected database holding about 149 million usernames and passwords, which TechRepublic reported (2026) appeared to come from infostealer and keylogging malware.
None of those victims would have been protected by a VPN.
Malware runs on your device, inside the tunnel. An infostealer reads saved passwords and session cookies locally and sends them out through the same encrypted connection.
Reporting on criminals shifting from fake login pages to infostealer malware and on stolen browser cookies bypassing MFA shows how much account compromise now starts on the endpoint. Endpoint protection, patching and careful downloads address this; a VPN does not.
Once you sign in to a service, it knows who you are regardless of your IP address. A VPN also cannot protect data you have already given to a company that later suffers a breach.
A VPN moves trust from your ISP to the VPN operator, who can see your destinations and any unencrypted traffic.
Free services with unclear funding models deserve extra scrutiny. If you are evaluating a paid service, a best VPN free trial or money-back period lets you test leak protection and performance before committing, but independent audits and a clear logging policy matter more than features.
A VPN is only as good as its configuration. Several failure modes quietly route traffic outside the tunnel.
A DNS leak happens when the operating system sends DNS queries to the ISP’s or local network’s resolver instead of through the tunnel. The sites you visit are then visible to the local network even though page content is encrypted.
Causes include split tunnelling, OS “smart” resolver features and IPv6 queries the VPN does not handle.
Some VPN clients only tunnel IPv4. If the network provides IPv6, that traffic may bypass the VPN entirely.
Split tunnelling, which sends only some apps through the VPN, is useful for performance but widens the gap if configured loosely.
In May 2024, Leviathan Security Group disclosed TunnelVision (CVE-2024-3661), a technique in which an attacker on the same local network runs a rogue DHCP server and uses option 121 to push routes that take priority over the VPN’s default route.
Traffic leaves outside the tunnel while the VPN still shows as connected. Windows, macOS, Linux and iOS were affected; Android was not, because it ignores option 121.
Mitigations include DHCP snooping on managed networks and VPN clients that use firewall rules or network namespaces rather than routes alone.
ip route show table all | grep -v “^local”
resolvectl status | grep -A2 “DNS Servers”
Unexpected specific routes via the physical interface, or DNS servers that belong to the local network, indicate a leak path.
For organisations, the VPN gateway is internet-facing infrastructure, and attackers treat it that way. CISA and the NSA’s joint guidance on selecting and hardening remote access VPNs (2021) warned that nation-state actors exploit known VPN vulnerabilities to steal credentials, execute code and hijack sessions.
That pattern has continued; recent coverage describes ransomware gangs attacking Palo Alto, Fortinet, Citrix and Check Point VPNs as an initial access route.
In MITRE ATT&CK terms, gateway exploitation maps to Exploit Public-Facing Application (T1190), and use of stolen VPN credentials maps to External Remote Services (T1133). Practical hardening steps include:
These map to CIS Controls v8 safeguards 7.x (vulnerability management) and 6.4 (MFA for remote network access), and to the NIST CSF 2.0 Protect function.
A traditional remote access VPN grants network-level access: once connected, a device can often reach far more than the user needs.
Zero trust network access (ZTNA) follows the model in NIST SP 800-207 Zero Trust Architecture, granting access per application based on identity, device posture and context, and re-evaluating that decision continuously.
| Factor | Remote access VPN | ZTNA |
|---|---|---|
| Access scope | Network segment | Individual application |
| Trust decision | Mostly at connection time | Per request, with posture checks |
| Exposure | Gateway reachable from the internet | Applications typically hidden behind a broker |
| Lateral movement risk | Higher | Lower |
Many organisations run both during migration. For the trade-offs, see reasons to replace a VPN with ZTNA and the broader overview of VPNs in cybersecurity.
Consumer VPNs serve a different purpose, privacy on untrusted networks, and are not a substitute for either.
It stops other users and the network operator from reading your traffic or seeing which sites you visit. It does not stop you from visiting a malicious site or downloading malware.
Only from attackers who are watching the network path. It offers no protection against phishing, password reuse, malware or exploited software on your device.
It hides your IP address, but if you are signed in or carry tracking cookies, Google and other services can still link activity to you.
Run a DNS leak test while connected. If resolvers from your ISP or local network appear instead of your VPN provider’s, your DNS is leaking.
No. A VPN gives network access after connection, while zero trust grants access to individual applications and keeps checking identity and device posture.
OpenAI has launched GPT-6 Cyber, a security-focused AI model that found 81 new high-severity Firefox…
Shopify is making IP allowlisting mandatory for public apps that call its Admin API, adding…
Microsoft’s Windows Paint vulnerability, CVE-2026-83844, could allow an unauthenticated attacker to execute code over a…
Melbourne, Florida, November 5th, 2026, CyberNewswire OpenMatter Network, a pioneer in decentralized infrastructure for agentic…
A new Android bug named GhostMap can leave a phone stuck in a crash loop…
A China-aligned hacking group is abusing Sogou Input Method, one of the most popular Chinese…