You sit down in a café, connect to the free Wi-Fi and open your banking app. It feels harmless. But on a shared network, the people around you are, technically speaking, on the same road as your data. This is the problem a VPN (Virtual Private Network) solves.
Public Wi-Fi is like sending a postcard
When you send a postcard, anyone who handles it along the way can read it. Data travelling over an open or poorly secured Wi-Fi network can behave the same way: someone on that network, with the right tools, may be able to see where your traffic is going and, in weak setups, what it contains.
A VPN puts your postcard in a sealed envelope
A VPN creates an encrypted tunnel between your device and a VPN server. Everything you send is scrambled before it leaves your phone or laptop, so anyone watching the café network sees only gibberish travelling to one destination: the VPN server.
The VPN server then unwraps your request and visits the website on your behalf. That has a second effect: the website sees the VPN server's IP address, not your real one.
| Without a VPN | With a VPN |
|---|---|
| Traffic visible on the local network | Traffic encrypted inside a tunnel |
| Websites see your real IP address | Websites see the VPN server's address |
| Risky on public Wi-Fi | Much safer on public Wi-Fi |
Three things a VPN does for you
- Encrypts your data in transit, so snoopers on the same network see only scrambled data.
- Hides your IP address from the websites you visit.
- Makes public Wi-Fi safer, in cafés, airports and hotels.
The auditor's tip: what a VPN can NOT do
From an IT audit point of view, the most common mistake is treating a VPN as complete protection. It is not. A VPN protects data in transit. It does not stop:
- Phishing: if you type your password into a fake website, the VPN will happily deliver it.
- Malware already on your device.
- Weak or reused passwords.
Use a VPN on public networks, but combine it with strong, unique passwords and two-factor authentication.
How to choose a VPN
- Avoid unknown free VPNs. If a VPN service is free, your data may be the product.
- Choose a well-known provider that has been independently audited.
- Look for a clear no-logs policy, meaning the provider does not record what you do.
- At work, use only your organisation's approved VPN. Personal VPNs on company devices can break security controls and policies.
A VPN is your sealed envelope on the internet: simple, effective, and one layer of a sensible security routine.
Preparing for an IT audit or security certification? Practise free questions at CertPrepX.