Limitations, Tradeoffs & the Zero-Trust Shift

What a VPN Doesn't Protect Against

A VPN encrypts traffic in transit and masks apparent origin — it doesn't protect against malware already on a device, phishing that tricks a user into handing over credentials, or tracking via cookies/browser fingerprinting rather than IP address. Using a VPN also relocates trust rather than eliminating it: the provider can see decrypted traffic on their own servers, so their logging practices and jurisdiction become a real consideration.

Practical Tradeoffs

Routing all traffic through a VPN server adds latency and can reduce bandwidth — a real performance cost weighed against the security/privacy benefit. Split tunneling addresses this by routing only specific traffic (internal corporate resources) through the VPN while other traffic takes the normal, faster direct path. A kill switch blocks all traffic if the VPN connection drops unexpectedly, preventing a silent fallback to an unprotected connection.

VPN vs. Proxy Scope

A VPN typically operates at the OS/network level, tunneling essentially all of a device's traffic; a proxy server commonly operates at the application level (configured within just a browser), affecting only that application's traffic — a meaningful scope difference even though both can serve overlapping privacy purposes.

The Zero-Trust Shift

A traditional VPN implicitly grants broad network-level access once connected — anyone "inside" is trusted. Zero-trust architecture instead verifies every access request individually regardless of network location, reducing the blast radius if any single credential or connection is compromised. This is a genuine, ongoing shift in enterprise security thinking — a blanket corporate VPN is simpler to set up, but application-specific, per-resource access control requires more upfront design for a real security benefit at scale. A VPN concentrator is the infrastructure handling many concurrent remote-access tunnels for organizations still relying on the traditional model.