VPNs: When They Help and When They Don’t

C. Brian McKee, RFC®, CKA®

March 10, 2026

McKee Financial Resources, Wealth Management Services

Celebrating Over 40 Years of Excellence Since 1985

CYBERSECURITY SERIES

VPNs: When They Help and When They Don’t

Understanding What That Green Shield Actually Does — and What It Doesn’t

You’re at a coffee shop, laptop open, working through some emails before a meeting. The network list shows “Free Coffee Shop WiFi” and you connect without hesitation. After all, you have a VPN. You click the little shield icon, watch it turn green, and feel a small sense of security wash over you.

Here’s the question worth asking: what exactly did that green shield just do for you?

If you’re like most people, the answer is somewhere between “I’m not entirely sure” and “everything, probably.” VPN providers spend a lot of money convincing you it’s the latter. It’s narrower — and worth understanding.

What a VPN Actually Does

VPN stands for Virtual Private Network. When you turn one on, it creates an encrypted tunnel between your device and a server operated by the VPN company. Your internet traffic travels through that tunnel before reaching its final destination.

On a practical level, this means two things:

First, it encrypts your traffic on the local network. When you’re on public Wi-Fi — the coffee shop, an airport lounge, a hotel lobby — other people on that same network can’t easily see what you’re doing. Without a VPN, someone with the right tools could potentially intercept unencrypted data traveling over that shared connection. The VPN closes that window.

Second, it masks your IP address from the websites you visit. Instead of seeing your actual location, websites see the VPN server’s location. This is why people use VPNs to access streaming content that’s restricted to certain countries. It’s not really a security feature, but it’s a common reason people sign up.

That’s genuinely useful. If you’re checking your bank account on airport Wi-Fi, a VPN adds a real layer of protection. If you’re working remotely from a hotel and accessing company systems, it makes sense. The tunnel keeps your traffic away from prying eyes on networks you don’t control.

So far, so good.

What a VPN Doesn’t Do

This is where the marketing tends to get creative.

A VPN doesn’t protect you from phishing. If you click a link in a fraudulent email and enter your banking credentials on a fake website, the VPN faithfully encrypts that traffic and sends it straight to the scammer. The tunnel doesn’t know the difference between a legitimate site and a convincing fake.

A VPN doesn’t block malware. If you download a malicious file, the VPN doesn’t scan it or stop it. Some VPN providers bundle additional features that claim to do this, but that’s not what the VPN itself is doing.

A VPN doesn’t fix weak passwords. If your email password is “password123” and it gets leaked in a data breach, the VPN can’t help you. The breach didn’t happen on your local network — it happened on the other company’s servers.

A VPN doesn’t make you anonymous. This is a big one. While websites can’t see your real IP address, your VPN provider can see everything you’re doing. You’re trusting them instead of trusting the coffee shop’s network. That might be a reasonable trade, depending on the provider. But it’s not anonymity.

A VPN doesn’t protect you from yourself. If you click a malicious link, enter your credentials on a spoofed login page, or download an attachment you shouldn’t have opened, the VPN has no way to intervene. The most common ways people get compromised have nothing to do with network interception — and everything to do with human decisions.

The Gap Between Perception and Reality

There’s a certain comfort in clicking that shield icon and watching it turn green. It feels like you’ve done something. And you have — just not as much as the feeling suggests.

The real risk for most people isn’t a sophisticated hacker intercepting their traffic at Starbucks. It’s the phishing email that looks like it came from their bank. It’s the reused password that got exposed in a breach three years ago. It’s the text message claiming to be from the IRS with a link that leads somewhere it shouldn’t.

None of those attacks care whether you’re using a VPN. They’re not trying to intercept your connection. They’re trying to trick you into handing over the keys yourself.

A VPN is a lock on one specific door. It’s a good lock. But if you leave the windows open, the lock doesn’t matter much.

A Simple Framework

✅ When a VPN makes sense:

• You’re on public Wi-Fi you don’t control — airports, hotels, coffee shops, conferences

• You’re accessing sensitive accounts or work systems from an unfamiliar network

• You want to prevent your internet service provider from seeing your browsing activity (a privacy preference, not a security necessity)

❌ When a VPN doesn’t help:

• You clicked a link in a suspicious email

• You’re using the same password across multiple sites

• You haven’t enabled multi-factor authentication on important accounts

• You’re on your own home network with a properly secured router

The basics matter more than the VPN. Strong, unique passwords. Multi-factor authentication on every account that offers it. A healthy skepticism toward unexpected emails, texts, and phone calls. These aren’t glamorous, and no one’s running ads for them. But they’re what actually keeps most people safe.

Use a VPN when you’re on networks you don’t trust. Just don’t let the green shield convince you the other work is done.

VPNs: When They Help and When They Don’t

What a VPN Actually Does

What a VPN Doesn’t Do

The Gap Between Perception and Reality

A Simple Framework

Related Reading on Our Site