How a VPN fits (and doesn’t fit) a threat model

A VPN is best viewed as one link in your security chain: it typically protects traffic between your device and the VPN endpoint. It does not automatically protect everything else in your threat model—especially what happens at your endpoints (device/browser/app settings) or inside networks you interact with after the VPN.

Key operating conditions to assume upfront:

  • Your device traffic must actually use the VPN for the applications you care about.
  • The VPN connection must be configured correctly (protocol, routes, DNS handling).
  • Your threat model must specify adversaries: e.g., someone on your local network, a website you visit, or a service operator observing traffic patterns.

If any of those conditions fail, the VPN’s expected risk reduction may not apply.

How it works in practice

When diagnosing or configuring a VPN, focus on what the tunnel changes versus what it leaves unchanged.

What the tunnel typically affects:

  • How your device sends network traffic to the VPN endpoint.
  • Network-path visibility for traffic between your device and the VPN.

What often remains outside the VPN’s control:

  • Whether your applications leak connections outside the tunnel.
  • DNS resolution behavior (which resolver is used and whether it matches your expectations).
  • Endpoint security (malware, risky browser extensions, credential compromise).
  • Application-layer data exposure once you reach the destination (e.g., account logins).

In threat-model terms, the VPN may reduce certain observations, but it does not remove all ways an adversary can influence outcomes.

Main limitations to plan for

Common limitations users should account for:

  • No guaranteed anonymity or guaranteed safety: identities and actions can still be inferred through endpoints, accounts, or traffic patterns.
  • Performance and availability vary: latency, stability, and throughput can change by network, device, location, provider, and time.
  • Misconfiguration risk: the VPN may be “on” while specific apps, DNS queries, or routes bypass it.
  • Changing environment: updates to OS networking, browser behavior, or VPN settings can alter results over time.

Because threat models depend on your exact adversary and goal, the “best” setup is context-specific rather than universal.