VPNs, Antivirus and What Actually Protects You Online

Consumer security marketing has a structural problem: the most effective protections are free and dull, while the products that are easiest to sell address threats that are no longer the main ones. Untangling that is worth doing before spending anything.

What a VPN actually does

A VPN encrypts traffic between your device and the VPN server, and replaces your IP address with the server's. That produces three genuine effects:

• Your internet provider — or a public Wi-Fi operator — can no longer see which sites you visit.
• Websites see the VPN's IP address rather than yours, which obscures your approximate location.
• Traffic on an untrusted network is encrypted end to end to the VPN server.

What it does not do is the part the advertising blurs. A VPN does not make you anonymous — you are still logged into your accounts, and browser fingerprinting, cookies and your own logins identify you regardless. It does not stop malware. It does not stop phishing. It does not protect data after it leaves the VPN server. And it shifts trust rather than removing it: your provider can no longer see your traffic, but the VPN company now can, which is why their logging policy and jurisdiction matter more than their speed.

The honest case for a VPN today: it is genuinely useful on untrusted networks, for keeping browsing away from your provider, and for accessing services while travelling. The "public Wi-Fi is dangerous" pitch is weaker than it was, because almost all web traffic is now HTTPS-encrypted by default — which was the original threat a VPN solved.

If you buy one, look for an independently audited no-logs policy, ownership you can identify, and a jurisdiction you are comfortable with. Free VPNs are the category to avoid: running a VPN costs money, and if you are not paying, your traffic is frequently the product.

Do you still need antivirus?

Modern operating systems ship with real protection. Windows includes Defender, which now performs comparably to paid products in independent testing. macOS has layered protections including notarisation and XProtect. For a careful user on an up-to-date system, built-in protection plus good habits covers most of the realistic risk.

A paid suite still earns its place in specific situations: a household with several users of varying carefulness, a Windows machine used by children, anyone who downloads software from varied sources, or where you want a single dashboard across family devices. Several suites now bundle a password manager, VPN and identity monitoring, which can be good value if you would otherwise buy those separately — and padding if you would not.

What matters more than the brand is that updates are installed. The overwhelming majority of successful compromises exploit known vulnerabilities that were already patched.

The threat that actually gets people

Most individuals are not compromised by novel malware. They are compromised by phishing and credential stuffing, and neither is addressed by a VPN or by antivirus.

Credential stuffing works because breaches are constant and people reuse passwords. Attackers take email-and-password pairs from one breach and try them everywhere else. The defence is unique passwords everywhere, which in practice means a password manager, because unique passwords for two hundred accounts cannot be remembered.

Phishing works because a convincing fake login page defeats a password entirely — and defeats a texted or app-generated code too, if the attacker relays it in real time. The defence is phishing-resistant authentication: passkeys or a hardware security key, which verify the site's actual domain and cannot be handed to an imitation.

Two-factor authentication, ranked honestly

Not all second factors are equivalent.

Hardware keys and passkeys are strongest, because they are phishing-resistant by design. Authenticator apps are good and defeat credential stuffing entirely, though a real-time phishing page can still relay the code. Email codes collapse to the security of your email account. SMS codes are weakest in common use, because SIM-swap attacks — persuading or bribing a carrier to move your number — hand the attacker every code.

SMS is still far better than nothing. Where a service supports an app or a key, switch. And ask your mobile carrier to add a port-out PIN, which is free and takes one call.

The order that actually reduces risk

1. Keep everything updated. Free, boring, and the highest-impact measure available.
2. Unique passwords via a password manager. This closes the single biggest real-world attack path.
3. Strong 2FA on email first, then on money and identity accounts. Email is the master key — password resets for everything else arrive there.
4. Freeze your credit at all three bureaus. Free, and it prevents new-account fraud rather than reporting it afterwards.
5. Back up your data — the only reliable answer to ransomware, and the one thing no security product replaces.
6. Then consider paid tools for the gaps: a VPN if you use untrusted networks often, a security suite for a mixed household, identity monitoring for what a freeze does not cover.

The first five are free or near-free and address the threats that actually materialise. Buying a subscription before doing them is spending money to avoid an afternoon's work.

Recognising a phishing attempt

Since phishing is the threat most likely to reach you, a few habits are worth more than any product.

Never act on a link in an unexpected message. If your bank appears to be emailing about a problem, open the banking app yourself rather than following the link. This single rule defeats the overwhelming majority of attempts.

Treat urgency as the warning sign it is. Fraud relies on pressure — an account closing, a payment failing, a delivery held. Legitimate organisations do not require a decision in ninety seconds.

Check the actual domain, not the display name. Lookalike domains substitute characters or add plausible words, and a sender name is trivially forged.

Be suspicious of any request to move channels — to WhatsApp, to a phone call, to a payment app. That step exists to get you away from a platform with fraud controls.

And if something does slip through, the response order is: change the password on that account, check for added recovery methods or forwarding rules, then work outward to anything sharing that password.

If you are comparing tools, our ranked comparisons of password managers, antivirus software and identity theft protection cover how the leading options differ, scored against the criteria in our rating methodology.

This is general information, not security advice for a specific threat model. Product capabilities, audit status and pricing change over time — confirm current details with the provider, and seek tailored advice if you face targeted threats.