A VPN encrypts traffic between your device and the VPN endpoint and changes the address websites see. It does not make you anonymous, stop phishing, or protect an infected device. Whoever runs the endpoint can see your connections instead of your local network, so you are shifting trust, not removing it.
What a VPN does
- Encrypts traffic between the device and the endpoint, protecting it from people on the local network.
- Replaces your visible source address with the endpoint address.
- For a company VPN, places the device inside a private network so it can reach internal resources.
Those are real benefits. They are narrower than the marketing around consumer products suggests.
Myth: a VPN makes you anonymous
You are still logged in to your accounts, your browser still sends identifying details, and cookies still track you across sites. The destination knows who you are as soon as you sign in. A VPN hides your network address, not your identity.
Myth: a VPN protects against malware and phishing
Neither is a network encryption problem. A malicious attachment runs the same through a tunnel. A phishing page collects your password the same through a tunnel.
Fact: the VPN operator sees your traffic metadata
With a tunnel, your local network sees only a connection to the endpoint. The operator at the other end sees the destinations you connect to. For a company gateway that is you trusting your employer. For a third party service, that is trusting a third party. Read how they handle logs before assuming anything.
Myth: a VPN replaces zero trust or good access control
A tunnel decides how traffic travels. It does not decide whether the user and device should reach a given application. See VPN or ZTNA for how access models differ.
Fact: the gateway itself is a target
VPN gateways are internet facing and reachable by anyone. CISA publishes a catalog of known exploited vulnerabilities and tells organizations to use it as an input to vulnerability management prioritization. Gateways appear in such lists often enough that patching them first is routine advice, covered in patch VPN gateways first.
When a VPN is the right tool
- Reaching private systems from home or travel.
- Adding a layer on untrusted networks.
- Connecting offices to each other.
When it is the wrong tool
- Seeking anonymity from the sites you sign in to.
- Hoping to compensate for an unmanaged device.
- Avoiding the work of MFA and patching.
Quick check
Does a VPN stop my employer seeing my browsing?
No. On a company VPN, your employer controls the endpoint and may log connections. Assume work devices and work tunnels are monitored.
Is a free VPN safe?
You cannot tell without examining who operates it and what they log. Free products have to earn money somehow, so check the privacy terms before trusting one.
Sources
Last reviewed: 19 October 2026.
