VPNs get talked about like a magic cloak that makes you invisible online, but what they actually do is create an encrypted tunnel between your device and a server somewhere else, which hides your traffic from whoever is on the same network as you and masks your location from the sites you visit. Useful, but a lot narrower than the marketing suggests.
Understanding what that tunnel actually covers, and what it leaves wide open, matters more than picking a brand name off a comparison chart.
What a VPN Actually Does
When you connect to a VPN, your device sends all its internet traffic through an encrypted link to a server run by the VPN provider. From there, it goes out to the internet as normal. Anyone watching the network between you and that server, say, on public wifi in a coffee shop, sees only scrambled data. Anyone watching the internet at large sees traffic coming from the VPN server, not from your house or your office.
That’s it. It’s a privacy tool for the journey your data takes, not a security wrap around everything you do with it.
What VPNs Genuinely Protect Against
The clearest use case is public wifi. Coffee shops, airports, and hotels rarely secure their networks well, and anyone else connected can potentially intercept unencrypted traffic. A VPN closes that gap.
The second common use is hiding your location or IP address from websites and advertisers. If you’re browsing from a VPN server in a different country, sites see that server’s location rather than yours. This is why VPNs get used for accessing content restricted by region, though that use sits in a legal grey area depending on the service’s terms.
The third is stopping your internet provider from seeing which sites you visit. Without a VPN, your provider can see the domains you connect to, even if it can’t see the content on encrypted sites. A VPN hides that browsing pattern from them, though the VPN provider itself can now see it instead.
What VPNs Don’t Protect You From
A VPN does nothing to stop phishing emails, malware, or a weak password. If you click a dodgy link and hand over your login details, the VPN was never in a position to help, the tunnel it built has nothing to do with the decision you made on the page at the end of it.
It also doesn’t stop websites from tracking you through cookies, browser fingerprinting, or account logins. If you’re signed into Google or Facebook, they know it’s you regardless of what your IP address says. A VPN changes where your traffic appears to come from, not who you are once you’ve logged in somewhere.
And it doesn’t secure your device. If your laptop already has malware on it, or your accounts don’t have multi-factor authentication turned on, a VPN sits entirely outside that problem. This is one reason the NCSC’s guidance on VPNs treats them as one control among several, not a standalone fix.
VPNs and Business Networks
Businesses often use VPNs to let staff connect to internal systems remotely, as if they were plugged into the office network. This was the standard approach for years and still works, but it comes with a catch, once someone is on the VPN, they often have broad access to everything else on that network too.
That’s the thinking behind zero trust approaches for small businesses, which check identity and device health for every request rather than granting blanket access once someone is inside the tunnel. A VPN gets someone through the front door. It doesn’t decide what they should be allowed to touch once they’re in the building, which is a separate problem that needs its own answer.
Picking a VPN That Actually Does the Job
If you’re choosing a VPN, the provider itself matters more than the marketing on its homepage. You’re trusting that company with a full record of your browsing, since your traffic passes through their servers. A no-logs policy, backed by an independent audit rather than just a claim on the website, is worth checking for. Free VPNs are worth particular caution, running servers costs money, and if you’re not paying, something else is usually paying for it, often your data.
It’s also worth checking what encryption standard the service uses and whether it has had a public security review. A VPN with no track record and no audit is asking for trust it hasn’t earned yet. Setting one up correctly also means understanding basics like your network security key, since a VPN sitting on top of a poorly secured wifi connection is only solving half the problem.
If you’re weighing up VPNs against a wider access control strategy for your business, it’s worth reading through the zero trust approach for small businesses to see where the gaps actually sit.
