A VPN is safe for one job: protecting data in transit across a network you do not trust. It does not protect a compromised device, stop phishing, or hide you from the VPN operator. How safe it is depends on how it is configured and who runs the other end.
What does a VPN protect?
The UK NCSC describes VPNs as encrypted network connections that let remote users reach an organization's services securely, and as one way to guarantee the security of data in transit across an untrusted network. It lists further benefits for organizations: letting legacy services work remotely, adding a second layer in front of poorly maintained internal services, and keeping user devices from direct connections to the local network, where attacks like ARP spoofing are possible.
Those are real but narrow gains. Notice what is not on the list: malware protection, account protection, anonymity.
What does a VPN not protect?
It does not protect the endpoint. If malware is already on the laptop, it sees the data before encryption. It does not protect credentials phished through a fake login page. And NIST notes that in a remote access design, traffic beyond the VPN gateway is outside the tunnel.
It also does not remove trust, it relocates it. With a VPN you trust the operator of the gateway instead of the coffee shop. For a company VPN that operator is you. For a commercial service, it is a third party whose practices this post cannot evaluate. Do not rely on marketing claims without an independent audit report.
Can the VPN itself be the weak spot?
Yes. A VPN gateway sits on the internet and accepts connections from strangers, which makes it a target. CISA maintains the Known Exploited Vulnerabilities catalog, a list of flaws with evidence of exploitation in the wild, and any product that terminates connections for your network is worth checking against it. Patch on a schedule, and check the catalog when you buy.
Configuration matters as much as code. NCSC notes that some older protocols, PPTP for example, have fallen out of use because of security concerns. It also advises client certificates over pre-shared keys, since a single certificate can be revoked on its own.
Is a VPN always needed?
NCSC says there is little benefit in a VPN if you have fully adopted a zero-trust approach to networking, and that if none of the listed advantages apply, you do not need one. It also warns that VPNs are complex to run and that a failure can cause organization-wide outages.
For an individual, the reasoning is the same in smaller form. If a site uses HTTPS, the content is already encrypted between your browser and the site. A VPN adds protection for the network hop and for metadata such as which sites you contact, but moves that metadata to the VPN operator.
A constructed example
Priya works from an airport and opens an internal wiki that still serves pages over plain HTTP. Without a VPN, anyone on the same network could read or alter those pages. With a company VPN, the traffic is encrypted to the gateway. The same day, she clicks a link in a fake invoice email and enters her password on a look-alike page. The VPN did nothing for that.
How to check or apply this
- Say what you want the VPN to prevent, in one sentence. If you cannot, you may not need one.
- For a company VPN, force the tunnel, use per-device certificates and patch the gateway quickly.
- For a personal VPN, prefer providers that publish independent audit reports, and treat the provider as a party that can see your traffic metadata.
- Keep the device updated and use multi-factor authentication, because the VPN covers neither.
- Check that internal services use TLS anyway, so the VPN is a second layer and not the only one.
Quick check
Does a VPN make me anonymous?
No. It changes who can see your traffic: the local network no longer can, and the VPN operator can. The destination site still sees your account activity and any cookies.
Do I need a VPN if every site uses HTTPS?
Often not for content protection. The NCSC says a VPN adds little if its listed benefits do not apply to you. It still helps against local network attacks and for reaching internal services that were never designed for the internet.
Sources
- NCSC, Virtual Private Networks (VPNs) device security guidance
- NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
- CISA, Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
