What does a VPN not protect you from?

A VPN (virtual private network) encrypts your internet traffic and hides your IP address, making it harder for outsiders to intercept or trace your connection. It’s one of the best ways to boost your online privacy, but even so, VPNs only secure one layer of your digital activity, and many threats can still reach you through other channels.

For example, according to the Cybersecurity & Infrastructure Security Agency (CISA), over 90% of successful cyberattacks start with phishing, which VPNs are powerless to protect against. 

Malware, cookies, account logins, and data breaches can all expose your information in ways a VPN cannot stop. That is why understanding its limits matters: a safe, trusted VPN provides many privacy benefits, but it works best alongside good security habits and other protections that cover the gaps a VPN cannot reach.

What a VPN does

A VPN creates a secure, encrypted connection between your device and a remote VPN server. Instead of connecting directly to websites and online services, your internet traffic first travels through a secure VPN tunnel to that server, which then forwards it to its destination.

This process changes what different parties can see about you online.  Fundamentally, here’s what a VPN hides when you connect:

1. Your real IP address: Websites and other online services see the VPN server’s IP address instead of yours. This helps conceal your approximate location and makes it harder to track your activity using your IP address alone.
2. Your internet traffic from network observers: By encrypting traffic between your device and the VPN server, your ISP, hackers on public Wi-Fi, and other local observers are unable to see the data you send and receive.

But that protection doesn’t make you invisible or eliminate every privacy and security risk online. Even the most secure VPNs can’t prevent online tracking or security threats that occur outside of the VPN tunnel, such as third-party data breaches, phishing attacks, or spyware installed on your device.

What a VPN does not protect you from

Using a VPN doesn’t make every website, download, or online interaction safe. A VPN primarily protects your internet connection, so threats that target your device, browser, or accounts — or rely on tricking you into taking an unsafe action — generally fall outside its scope of protection.

Here are some of the most important threats a VPN alone can't protect you from.

Viruses and other malware

A VPN can securely transport data, but the VPN connection itself doesn't determine whether that data is malicious. It isn't a substitute for antivirus software, which is designed to detect, block, and remove threats such as viruses, ransomware, and spyware.

If you download an infected attachment, install a malicious app, or encounter malware through another route, a VPN alone won't stop the infection.

Phishing attacks

Phishing and other social engineering attacks target people rather than their device or internet connection. By impersonating trusted companies or individuals, scammers try to persuade you to compromise your own privacy and security by revealing passwords, payment details, verification codes, or other sensitive information.

And while they’re excellent at securing data in transit, VPNs can’t help you determine whether a message is trustworthy or stop you from voluntarily entering sensitive information on a fraudulent website.

Modern phishing sites can also be remarkably convincing. AI-assisted VibeScams, for example, can imitate legitimate websites closely enough to appear trustworthy at first glance. You might think you're signing in to PayPal or eBay when you're actually entering your credentials on a fraudulent site.

Browser tracking

Masking your real IP address boosts your privacy but doesn't make you anonymous online. Websites may still be able to identify or track you using cookies, tracking pixels, browser fingerprinting, account logins, and other identifiers.

Cookies are stored in your browser and can perform legitimate functions, such as keeping you signed in and remembering your preferences. But they also allow websites to recognize your browser and can be used for advertising and cross-site tracking.

So while a VPN can reduce IP-based tracking, it can't prevent every form of online tracking. For additional privacy, adjust your browser's tracking protections, limit unnecessary cookies, and periodically clear your browser cookies and cache.

Account credential theft

A VPN can't protect information that has already been stored by a company or online service. If that organization suffers a breach or data leak, information associated with your account may still be exposed.

For example, a company might store your name, contact information, account details, or password data on its systems. If attackers compromise those systems — or information is accidentally exposed — the data can be stolen regardless of whether you used a VPN when connecting to the service.

This illustrates the difference between data in transit and data at rest. A VPN protects traffic while it travels between your device and the VPN server; it doesn't control how another organization stores or protects information after receiving it.

Device compromise

A VPN can't fully protect you if a hacker or malware gains direct access to your device, where your internet data is decrypted. Computer viruses, spyware, and keyloggers operating on the device itself, outside the protection provided by the VPN tunnel, may be able to snoop on your online activity.

For example, a keylogger may capture a password as you type it, before the information is encrypted and sent through the VPN. Spyware may similarly monitor your screen, files, microphone, or other activity directly on the device.

How to fill the gaps a VPN leaves

A VPN is an important layer of online protection, but it has a specific job: encrypting your internet traffic between your device and the VPN server and masking your real IP address. Threats that target your device, accounts, browser, or personal information require other security measures.

For more comprehensive protection, combine your VPN with these cybersecurity practices:

• Use antivirus software: Reputable antivirus software can detect, block, and remove malware that a VPN alone can’t. Some of the best antivirus tools also include web protection and a built-in VPN, combining multiple layers of security.
• Use strong passwords: Protect each account with a unique, strong password. Prioritize length and unpredictability, and consider using a password manager to securely store your credentials. A password generator can help you create strong, random passwords.
• Turn on multifactor authentication (MFA): Enabling MFA requires an additional form of verification beyond your password, making it harder for someone with stolen credentials to access your account.
• Keep software updated: Operating systems, browsers, and apps regularly receive updates that patch known security vulnerabilities. Enable automatic updates where possible to help ensure important security fixes are installed promptly.
• Avoid sharing personal information online: Every time you enter personal information online, your vulnerability to attack increases, whether it’s adding personal info in a new app, posting on social media, or chatting with AI.
• Limit the personal information you share: The bigger your digital footprint, the more material scammers and identity thieves may have to target or impersonate you. Be selective about sharing sensitive details on social media, unfamiliar apps, online forms, or AI tools.
• Use good general cybersecurity habits: Brush up on your cybersecurity basics to avoid oversharing personal information, falling for phishing scams, and downloading malicious software.
• Practice good cybersecurity habits: Brush up on your cybersecurity basics to help head off threats before they compromise your security.  

Protect your privacy with Norton VPN

A VPN is an essential part of online privacy, but not all VPNs offer the same level of protection. Norton VPN combines fast, reliable performance with advanced security features to help keep your connection private while you browse, stream, and work online.

Some Norton VPN plans even go beyond core VPN privacy with built-in antivirus and anti-scam protection that can help flag suspicious websites, emails, text messages, and links before they put you at risk.

FAQs

Can a VPN protect against hackers?

Yes, a VPN can help protect you from certain hacking techniques, particularly those that involve intercepting or monitoring network traffic. By encrypting your connection, a VPN makes packet sniffing and similar forms of network eavesdropping much more difficult.

However, a VPN can’t prevent hackers from targeting your device, accounts, or applications through methods such as malware, phishing, stolen credentials, or unpatched software vulnerabilities.

Can a VPN be hacked?

Yes. Like any software or online service, a VPN can have security vulnerabilities or become compromised. Risks can stem from outdated VPN protocols, weak encryption, software flaws, or poorly secured VPN infrastructure. Misconfigurations can also cause IP or DNS leaks, potentially exposing information the VPN is designed to conceal.

Does a VPN protect you on public Wi-Fi?

Yes, a VPN can help protect you on public Wi-Fi by encrypting your internet traffic, making it more difficult for others on the network to intercept or monitor your data. This added protection is especially useful on shared networks in places like airports, cafés, and hotels, where your data may otherwise be more vulnerable to network-based attacks.