The Threat-Model Worksheet: Decide Whether a VPN Is the Right Tool for Your Actual Privacy Need
A VPN is the right tool for some privacy problems and useless for others. This worksheet-style guide walks you through defining your threat model — what you are protecting, from whom, and how — so you can decide whether a VPN actually fits your need.
Table of contents
"Do I need a VPN?" is the wrong question. The right one is: "What am I trying to protect, from whom, and is a VPN the tool that does it?" Security professionals answer this with a threat model — a plain description of what you are defending, who might come after it, and what you are willing to do about it. You do not need a background in security to build one. This worksheet walks you through it, and by the end you will know whether a VPN fits your situation or whether your effort belongs elsewhere.
What a threat model is
A threat model is just four honest answers:
- What are you protecting? (Your browsing on public Wi-Fi? Your location from websites? Your activity from your internet provider? Your accounts?)
- Who are you protecting it from? (A stranger on café Wi-Fi? Advertisers and trackers? Your ISP? A specific person? A government?)
- How likely and how serious is the threat? (A nuisance, or something that could cause real harm?)
- What are you willing to do? (Pay for a tool, change habits, accept some inconvenience?)
Write your answers down before shopping for anything. The tool comes last, not first. This mirrors the mindset in how to choose a VPN without falling for marketing claims: start from your need, not the feature list.
Step 1: Name what you are protecting
Be specific. "Privacy" is too vague to act on. Common concrete goals:
- Keeping your traffic unreadable on networks you do not control.
- Hiding your real IP address and rough location from websites.
- Keeping your browsing from your internet provider's view.
- Reaching services as if from another region.
- Protecting login credentials and accounts.
Notice that the last one is different in kind. It is about accounts, not connections — and a VPN does very little for it.
Step 2: Name the adversary
Who actually has the ability and motive to threaten what you named? Match the realistic adversary to the goal:
| What you want to protect | Typical adversary | Is a VPN the right tool? |
|---|---|---|
| Traffic on public Wi-Fi | Someone on the same network | Yes — encryption in transit is exactly its job |
| Your IP / location from sites | Websites, trackers | Partly — it hides your IP, but not cookies or logins |
| Browsing from your ISP | Your internet provider | Yes — the ISP sees an encrypted tunnel, not your destinations |
| Region-locked access | A geographic restriction | Often — subject to constant change |
| Your accounts from takeover | Anyone with your password | No — this needs a password manager and MFA |
| Ad tracking across sites | Ad networks | Mostly no — this needs tracker/cookie controls |
The pattern is clear: a VPN is a strong tool for protecting the connection and your IP-level location, and a weak or irrelevant tool for account security and cross-site tracking.
Step 3: Weigh likelihood and impact
Not every threat deserves the same effort. A quick way to prioritise:
- High likelihood, high impact: act now (e.g. you regularly work on public Wi-Fi handling sensitive data — a VPN genuinely helps here).
- High likelihood, low impact: worth a cheap habit change (e.g. casual tracking — browser settings may do more than a VPN).
- Low likelihood, high impact: plan for it deliberately rather than reaching for a single product.
- Low likelihood, low impact: probably fine to accept.
This step stops you from buying a tool for a threat you do not actually face — and from ignoring one you do.
Step 4: Match the tool to the need
Now decide. A VPN is likely the right tool if your honest answers include:
- You often use networks you do not control and want your traffic encrypted in transit.
- You want to hide your IP address and coarse location from the sites you visit.
- You want your internet provider to see an encrypted tunnel instead of your destinations.
- You need to reach services as though from another region (accepting that access shifts).
A VPN is the wrong or insufficient tool if your real need is:
- Account security — that is a password manager, passkeys, and multi-factor authentication. See our breakdown of how these tools complement rather than replace each other.
- Stopping cross-site tracking and ads — that is browser and cookie controls, not a tunnel.
- Anonymity against a powerful, determined adversary — a consumer VPN is not designed for that level of threat, and believing otherwise is dangerous.
It helps to know the boundaries clearly. Our guide on what a VPN actually hides draws the line precisely, and the myths worth unlearning covers the claims a VPN cannot deliver on.
A worked example
Say your answers are: I travel often, use hotel and airport Wi-Fi, want my banking and email traffic protected, and want to reach my home services abroad. That threat model points squarely at a VPN — encryption on untrusted networks and a home-region exit are exactly its strengths. Pair it with strong account security, and you are well covered; our guide to VPNs for travel builds on precisely this scenario.
Now say your answers are: I mostly worry about my accounts getting hacked and being tracked by advertisers. A VPN barely touches either need. Your effort belongs in a password manager, MFA, and tracker controls instead.
The point of the worksheet
The value of a threat model is that it turns a marketing question ("should I buy a VPN?") into a personal one ("does this tool address my actual risk?"). Sometimes the answer is a confident yes, and you can shop for the right features. Sometimes it is no — and knowing that saves you money and, more importantly, keeps you from the false confidence of a tool that does not defend what you actually care about.
