Recently, CISA (the Cybersecurity and Infrastructure Security Agency) made headlines by advising people to avoid personal VPN services as a general security measure.

This caught a lot of attention because VPN companies spend millions marketing themselves as essential security tools. But here’s the truth most people miss:

Personal VPNs are privacy tools, not security tools.

And confusing the two leads people (and businesses) into risky assumptions.

Security vs. Privacy: Two Very Different Things

A personal VPN can improve privacy. It can:

• Hide your browsing activity from your Internet Service Provider
• Mask your location
• Prevent certain types of tracking
• Change who “sees” your Internet traffic

But a personal VPN does not protect you from phishing, stop malware, or replace the modern security tools you need as part of your cyber defense strategy.

A VPN doesn’t make you “more secure.” It only changes who you trust.

And that brings us to the next issue, which is that many personal VPN companies advertise:

• “Zero logs”
• “We never track you”
• “Complete anonymity”

But the industry has clear examples of providers claiming “no logs” while storing logs, turning over user data during law enforcement investigations and even VPN apps containing vulnerabilities or acting as malware, spyware, or data brokers.

If you choose to use a personal VPN, you are simply shifting your trust from your ISP to a private company you don’t control — and often know nothing about.  Some VPN providers may be trustworthy. Others clearly are not.

If someone truly feels their ISP or government may track them, and they fully trust their VPN provider instead, then yes, a personal VPN might offer more privacy, but that is a privacy decision, not a security one.

Why CISA Is Cautious About Personal VPNs

I’m not sure I agree with CISA 100% that personal VPNs are “bad,” but I do agree with the spirit of their message: many people use personal VPNs for the wrong reasons — expecting security benefits they simply don’t provide.

CISA’s caution comes down to three issues: you’re shifting trust to the VPN provider, increasing your attack surface with yet another app, and gaining a false sense of security against threats a VPN can’t actually stop.

 Does a Personal VPN Ever Improve Security?

Yes — but only in a very narrow scenario:

When you must use Wi-Fi you don’t control:

Airports, hotels, coffee shops, conferences.

Personal VPNs can reduce exposure to:

• Man-in-the-middle attacks
• Rogue Wi-Fi networks
• Basic interception tools (pineapple attacks)

Even then, the better choice is:

Use your phone’s hotspot or a dedicated cellular hotspot whenever possible.

Public Wi-Fi carries more risks than a VPN can solve.

What About Work VPNs? Are They Different? Completely different.

Corporate VPNs such as Fortinet, Palo Alto, Cisco AnyConnect, and SonicWall are used to secure remote access to internal systems, which is not what we are talking about here. They are not comparable to personal VPN apps marketed on social media and TV.

What this means for your organization

These examples aren’t rare anymore, in fact they are a daily reality.

Attackers are using automation and AI to:

• Create realistic email chains and spoofed domains
• Target finance and leadership roles with customized lures
• Imitate trusted vendors or internal staff to request payment
• Use public data and exposed credentials to make their messages more believable

Even the most vigilant employees can fall for an email that looks “normal.” That’s why relying on training or spam filters alone isn’t enough.

So What Should Businesses Focus On Instead?

If your goal is security (not privacy), the essentials are:

• Phishing-resistant MFA
• EDR/MDR on every device
• Conditional Access and Zero-Trust controls
• Modern, updated hardware and software
• Avoiding public Wi-Fi
• Security awareness training grounded in real-world attacks  

These stop the attacks that actually compromise businesses today. A personal VPN does not.

Final Thoughts

Personal VPNs have a place, but it’s a small one, and not for the reasons people think. They provide privacy benefits, not security benefits, and in some cases, they introduce new risks.

If you’re a business owner or leader, the message is simple:

Don’t rely on a VPN to keep you safe. Rely on modern security controls that actually stop attacks.

If you’d like to discuss how these recommendations apply to your environment, or whether your current controls reflect today’s threat landscape, I’d be happy to talk.

Tim Weidman