Most consumer security advice treats the encrypted tunnel as the foundational layer of digital safety. This framing assumes that the primary risk to an individual is surveillance by their internet service provider or a hostile network. While that risk exists, it is not the most common way an average person loses access to their digital life. The data on account compromise tells a different story. The vast majority of breaches begin with credential theft, not network interception. An attacker does not need to see your traffic in transit if they already possess the key that opens the door.
The mechanism of loss is usually simple. A user enters a password on a fraudulent site, or a data breach exposes a password that was reused across multiple services. In these scenarios, the state of the network connection is irrelevant. The password was sent to the legitimate server, or it was stolen from a database. Encrypting the pipe between the user and the server does nothing to stop a password from being guessed, phished, or leaked. The frequency of these events dwarfs the frequency of on-wire interception attacks against private individuals. To order defences by the threat they mitigate, one must look at where the failure actually occurs.
This creates a disconnect between marketing and reality. Vendors sell the idea that visibility is the main danger. For a general user with one budget, this is a misallocation of resources. The two most effective defences against the most common forms of account loss are not hardware or subscriptions. They are habits and free software. Before considering any paid service, a user must address the single point of failure that is their own authentication method. If the password is weak or reused, no amount of encryption on the network layer will save the account. The first thing to buy is not a tunnel; it is a way to stop the tunnel from being bypassed.
The Role of Password Managers
The first and most critical defence is the elimination of password reuse. The EFF notes that reusing passwords is a dangerous practice because a single breach can cascade into total account loss. If a user employs the same credential for email, banking, and social media, the compromise of one service compromises all of them. The solution is unique, complex passwords for every account. The human brain is not designed to memorise dozens of random strings, which leads to the predictable, weak patterns that attackers exploit.
A password manager solves this by generating and storing unique credentials for each site. It acts as a vault, protected by a single master password. The user only needs to remember one strong passphrase, while the manager handles the rest. This tool is available in both free and paid tiers. The free versions of major providers are sufficient for most individuals, offering encryption, generation, and autofill. The cost is effectively zero, yet the security impact is profound. By ensuring that a breach of one site does not provide keys to others, the manager breaks the chain of compromise.
The mechanism here is isolation. When a password is unique, the attacker’s success is limited to that single account. They cannot pivot. This is a far more common failure mode than network interception. A user who spends money on a VPN but continues to reuse "Password123" across their services has built a fort with a drawbridge that is always up. The password manager is the first line of defence because it addresses the root cause of most account takeovers: the lack of unique, strong credentials. It is free, it is effective, and it is the logical first step before any other security expenditure.
The Necessity of Multi-Factor Authentication
The second critical defence is multi-factor authentication, or MFA. A password, no matter how strong, is a single factor. It is something you know. If that knowledge is compromised, the account is lost. MFA adds a second layer, something you have, such as a smartphone or a hardware key. This requirement means that even if an attacker has the correct password, they cannot log in without the second component. The Wikipedia entry on MFA confirms that accounts with this protection are significantly less likely to be compromised.
The implementation is straightforward and largely free. Most major services offer authenticator apps or SMS-based codes. While SMS is less secure than an app or a hardware key due to the risk of SIM swapping, it is still a substantial improvement over password-only login. The mechanism is the separation of knowledge and possession. An attacker might phish a password, but they cannot easily steal the physical device that generates the one-time code. This adds a friction point that stops the majority of automated and opportunistic attacks.
For the average user, enabling MFA on email, banking, and cloud storage is the highest-yield action available. It is free. It requires no subscription. It directly addresses the most common vector of attack: credential theft. A VPN does not provide this layer. A VPN encrypts the connection, but it does not verify the identity of the user at the login screen. If the password is correct, the VPN does not stop the login. MFA does. By ranking defences by the frequency of the threat they stop, MFA sits firmly at the top, alongside password managers. It is the second free item that should be implemented before any money is spent.
Where the VPN Actually Fits
The VPN’s position in this hierarchy is lower than its marketing suggests. A virtual private network encrypts the data in transit between the user’s device and the internet. This protects against eavesdropping on insecure networks, such as public Wi-Fi. It can also hide the user’s IP address from the websites they visit. However, it does not protect against the primary causes of account loss: phishing, data breaches, and malware. If a user clicks a malicious link, the VPN does not stop the malware from installing. If a user types a password into a fake site, the VPN does not stop the credentials from being sent.
The condition under which a VPN is the most important defence is specific. It is when the user is on an untrusted network, such as a hotel Wi-Fi or a coffee shop connection, and is accessing sensitive services. In that narrow context, the risk of local network interception is elevated. However, for the general user who works from home or uses secure mobile data, this risk is minimal. The vast majority of traffic is already encrypted via HTTPS, which protects the data regardless of the network. The VPN adds a layer of encryption that is often redundant in modern web usage.
Therefore, the VPN is not the first thing to buy. It is a situational tool. It addresses a specific, less frequent threat: local network surveillance. It does not address the more frequent threats of credential compromise and social engineering. Buying a VPN first is like buying a high-quality lock for the front door while leaving the windows open. It is a valid security measure, but it is not the foundational one. The user should only consider a VPN after the free, high-impact defences are in place. It is a secondary layer, not the primary shield.
The Cost-Benefit Analysis
The final consideration is the allocation of a limited budget. The claim that a VPN is the first thing to buy implies that it offers the greatest return on investment for general safety. This is incorrect. The two most effective defences, password managers and MFA, are free. They address the most frequent causes of account loss. They require no ongoing payment. A user who spends money on a VPN subscription before implementing these free measures is spending money to solve a problem that is less likely to occur than the problems they are leaving unsolved.
The mechanism of this misallocation is marketing. VPN providers sell fear of surveillance. They do not sell the practical reality of credential management. The average user is not a journalist under state threat. They are a person with an email account and a bank login. For them, the threat model is dominated by hackers and scammers, not intelligence agencies. The defences against these actors are behavioural and software-based, not network-based.
The condition under which the VPN becomes a higher priority is if the user has a specific threat model that includes network-level surveillance. For most people, this is not the case. The rational approach is to implement the free defences first. Then, if there is remaining budget and a specific need for network privacy, the VPN can be considered. But it is not the first thing. It is not the most effective thing. It is a tool for a specific job, and that job is not the one that most people are failing at. The order matters. The free tools stop the most common failures. The paid tool stops a rarer one. The budget should follow the frequency of the threat.