VPN and remote access systems account for roughly one-third of initial access vectors in healthcare cyberattacks.

Adoption of more advanced controls like two-factor authentication (47% businesses and 38% charities), a virtual private network for staff connecting remotely (36% businesses and 17% charities) and user monitoring (30% businesses and 31% charities) remain lower than other measures.

VPN Common Vulnerabilities and Exposures (CVEs) grow 82.5% over the analyzed period.

Roughly 1 in 5 of all device identification events in 2025 involved a VPN connection.

46% of people use a VPN, up from 42%.

Access is increasinly sold as tokens, SaaS admin, and integration footholds, not just VPN/RDP.

64% of Gen Z parents do not use a VPN for added protection.

3 VPN apps still utilized a legacy version of the OpenSSL library.

Approximately 1% of the analyzed VPN apps were found to be vulnerable to a Man-in-the-Middle (MitM) attack.

25% of the VPN apps analyzed on iOS failed to include a valid privacy manifest at all.

On iOS, over 6% of VPN apps were found requesting private entitlements, which are typically restricted from third-party developers. This represented a total of 30 apps

Only 10% of IT, security, and engineering professionals say their current VPN setup "works well" with no major issues.

At companies heavily reliant on VPNs, employees were nearly twice as likely to report broken access or security workarounds compared to those using modern tools.

90% of IT, security, and engineering professionals report limitations with their current VPN setup, such as security risks, latency, or operational overhead.

71% of SMBs Use a VPN.

71% of SMBs Use a VPN.

Nearly 2/3 of all respondents currently not using a VPN anticipate adopting VPN solutions within the next 12 to 24 months

Organizations were 61% more likely to report using VPNs, compared to all other solutions, to secure internet access.

VPNs alone accounted for two-thirds (66%) of all ransomware attacks.

42% said they use a VPN.