Published March 12 2026
Virtual Private Networks (VPNs) are a growing tool in cybersecurity. Having a VPN is a frequent recommendation from cybersecurity experts to keep your devices and data secure, especially during the summer when travel and vacations are common. There are a growing number of VPN providers, including both free and paid services, offering VPNs with a variety of formats and features. However, how VPNs work and what they do to improve your cybersecurity is difficult to understand even for many of their users. This blog explains VPNs and the network design concepts that underlie them to you how to effectively use this security tool to maintain your privacy and safety online.
Understanding how VPNs work requires understanding how normal networks operate and how companies and cyber threats use the information traveling through and between networks to harvest information. For most people’s home computer systems, their network includes a modem, a router and a series of devices that use the internet. A modem connects the other devices to the internet, translating the signals coming from within the home network, such as those generated when a person tries to access a website from their laptop, into a format that can be translated over the network created by their internet service provider (ISP). Modems do this translation in a wide variety of ways, depending on what kind of network the ISP uses, which can include networks run through fiber cables or a variety of wireless networks. The modem also establishes the Internet Protocol (IP) address for the devices accessing the internet through it, which is used to help websites and other aspects of the internet track interactions and identify what they are interacting with. IP addresses are also used by those trying to track traffic and monitor traffic, since this address can be used to identify traffic and track where that traffic is originating from.
The router operates in concert with the modem to distribute information passing through the modem to the devices people within a home or office are using. To the outside internet, all data coming through a particular modem shares the same IP address and looks the same. The router directs data from the modem to each device on your network using their internal IP addresses. Together, these connected devices form your local network - the one you select when connecting a phone or laptop to the internet. The network the router manages also allows devices on its to contact and identify each other, which facilitates processes like wireless printing. A network can be private, such as one within your home, or public, such as a network that a coffee shop might offer for its guests. Public networks can present security risks, as malicious actors using such a network can identify and attempt to steal data from or hack into other devices on the network. For private and public networks, the router is what allows devices to connect to the network and what manages any security protocols, like network passwords, that control how devices connect to the network.
When you use a device to communicate with a website through your modem, that communication is typically not encrypted unless the other partner you are communicating with encrypts it. Outside observers, like advertising companies or cyber criminals, can use this unencrypted data to track what websites you visit, how long you stay on them and what information you transmit to them. Observers track this information by using your IP address, which links back to your modem and network and helps isolate both what data is yours and where you are located. Much of the internet now uses HTTPS or other encryption, which helps protect against this kind of IP address tracking and data collection. However, some legitimate websites do not use encryption, and it is possible to be tricked into accessing an unsecured website to facilitate an attacker harvesting your data. This same Information from unencrypted communications is also available to your internet provider although with information about the volume of data transmitted, since the information travels through their equipment. Many ISPs harvest this data and sell it to other parties as an additional revenue stream.
Understanding both the structure and risks of normal networks, we can examine how VPNs function and how they increase security. Using a VPN creates an encrypted tunnel between your device and a server owned by the VPN operator. At the server, data coming from your device is decrypted and then sent to the website or other device you are trying to access. Data coming back to your device is also encrypted at the server and sent back to your device through the encrypted tunnel. VPN providers typically offer servers in a variety of locations and let the user choose which server their device will communicate with through the encrypted channel.
Using a VPN offers two major security advantages compared to accessing the internet without one. While using a VPN, data coming to and from your computer through your router and modem becomes extremely difficult for outside observers to read, since it is strongly encrypted and encryption also masks the IP address for the network you are using to access the internet. Although the volume of data coming to and from your computer is still trackable by your ISP, the contents of that data are rendered largely impossible to discern due to the encryption and outsider observers cannot track either the volume of data or its origin.
Using a VPN also changes your apparent location and IP address. Since the decrypted data is being distributed to the rest of the internet from the VPN provider’s servers, the IP addresses associated with this data are those for the company’s server and not those for your actual location and network. This gives you a degree of anonymity and prevents observers from being able to discern your location.
Together, these security advantages help maintain security from threats and observers inside and outside of your network. VPNs obscure your location and the details of your activity from observers outside the network, helping you maintain your privacy and partially impeding processes like location-based tailoring of advertisements. VPNs also provide protection against actors trying to observe you or monitor your activity within your network, including other users on public networks or your internet provider on your private network. Because data is encrypted all the way to your device when using a VPN, users or ISPs are significantly limited in what information they can extract about your online activity. However, since the VPN company handles and decrypts the data passing through its network, it is still possible for the company to collect and sell your data. This is particularly common with free VPNs as they lack another way to monetize their services. Checking what the data logging and sale policies are for a VPN is crucial when picking one to use.
VPNs are especially important when traveling or on vacation, since you are more likely to use public or poorly secured networks when on such trips. With the information in this blog, you are well prepared to understand and effectively use VPNs and stay secure wherever you are. If you want to learn more about VPNs and other cybersecurity topics, CyberMontana offers its Security Awareness Training program, which offers monthly approachable online cybersecurity lessons for Montana businesses and individuals.
To get started with enrolling in the program or to learn more, go to our security awareness training page or contact Laura Haacke at laura.haacke@mso.umt.edu.