VPNs: What They Protect and What They Don't
Understand VPN threat models, no-log policies, and when VPNs provide real privacy.
VPNs: What They Protect and What They Don't is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is a VPN?
A Virtual Private Network (VPN) creates an encrypted tunnel between your device and a VPN server. All traffic is routed through this server, hiding your true IP address from websites and encrypting traffic from your ISP or local network.
How VPNs Work
Steps when using a VPN:
- Device establishes encrypted connection to VPN server
- All traffic is sent through this encrypted tunnel
- VPN server sends traffic to the destination on your behalf
- Destination sees VPN server's IP, not yours
- Response returns through the tunnel to you
VPN Protocols
Common VPN protocols:
- OpenVPN — open source, highly configurable, uses TLS
- WireGuard — modern, fast, minimal codebase, excellent security
- IKEv2/IPsec — fast reconnect, great for mobile
- PPTP — obsolete and broken, never use
What VPNs Protect
VPNs effectively protect:
- Traffic from your ISP (they see encrypted tunnel, not content)
- Traffic on untrusted Wi-Fi (coffee shop, airport)
- Your real IP from websites you visit
- Bypassing geographic content restrictions
- Preventing local network surveillance
What VPNs Do NOT Protect
VPNs do NOT protect against:
- Malware already on your device
- Phishing and social engineering
- Cookies and browser fingerprinting
- Account tracking when logged in (Google knows who you are)
- DNS leaks (if DNS is not routed through the VPN)
- The VPN provider itself — they now see your traffic
VPN Trust Model
Using a VPN shifts trust from your ISP to the VPN provider. A dishonest VPN provider can log all your traffic. Evaluate VPN providers by: no-logs policy (ideally audited), jurisdiction, transparency reports, and open-source clients.
DNS Leaks
A DNS leak occurs when DNS queries are sent outside the VPN tunnel, revealing visited domains to your ISP even while connected to a VPN. Check at dnsleaktest.com and use VPNs that route DNS through the tunnel.
Corporate VPNs
Corporate VPNs connect remote employees to internal company networks. Unlike consumer VPNs, the employer monitors corporate VPN traffic. Using a corporate VPN for personal browsing means IT can see all your traffic.
Split Tunneling
Split tunneling routes only specific traffic through the VPN. For example: only corporate network traffic goes through the VPN; personal browsing goes directly to the internet. Reduces VPN load but may create security gaps.
VPN + Tor
Combining VPN with Tor adds layers:
- VPN-over-Tor: VPN hides Tor usage from ISP; Tor provides anonymity
- Tor-over-VPN: Tor hides traffic from VPN provider
Both add complexity and performance cost. Used by journalists and activists in high-risk environments.
Zero Trust vs VPN
Traditional VPNs grant network access to all internal resources. Zero Trust Network Access (ZTNA) grants access to specific applications based on identity and device health, not network location. ZTNA is replacing VPNs in modern enterprise environments.
Quick Check: VPNs
Which threat does a VPN NOT protect against?
Lesson Recap
VPNs encrypt traffic between your device and the VPN server, protecting against ISP monitoring and local network sniffing. They do NOT protect against malware, fingerprinting, account tracking, or a dishonest VPN provider. Choose providers with audited no-log policies. WireGuard is the modern protocol of choice.
Frequently asked questions
Is the “VPNs: What They Protect and What They Don't” lesson free?
Yes — the full text of “VPNs: What They Protect and What They Don't” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “VPNs: What They Protect and What They Don't”?
Understand VPN threat models, no-log policies, and when VPNs provide real privacy. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “VPNs: What They Protect and What They Don't” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Browser Security Settings and Extensions
- Tracking, Cookies, and Fingerprinting
- VPNs: What They Protect and What They Don't
- Operational Security (OPSEC) Basics