.png)
VPN usage is still huge, but the story has split in two. On the consumer side, roughly 1.6 billion people now use a VPN, and adoption keeps climbing in markets where censorship and surveillance push users toward privacy tools. On the enterprise side, the picture is darker. Verizon’s 2025 Data Breach Investigations Report found that perimeter devices and VPNs were the focus of a 34% jump in vulnerability exploitation, and edge-device breaches grew roughly eightfold year over year. Google Cloud’s M-Trends 2026 report put exploits at 32% of all initial-access events for the sixth straight year, with edge devices and VPNs leading the target list. Below are the VPN statistics IT, security, and compliance teams should actually be tracking in 2026.
Key VPN statistics at a glance
- About 1.6 billion people use a VPN globally, roughly 30% of the world’s internet users, with the GWI VPN Usage Report ranking the UAE, Indonesia, and India among the highest-usage markets.
- 22% of vulnerability-exploitation breaches in 2024 targeted edge devices including VPN concentrators, an eightfold jump from 3% the year before (Verizon 2025 DBIR).
- 54% of vulnerable edge devices were fully patched during the observation period, and median time to remediate was 32 days (Verizon 2025 DBIR).
- 32% of initial-access events in 2025 used exploits, with VPNs, firewalls, and routers occupying the top four most-exploited vulnerabilities (Mandiant M-Trends 2026).
- 12% of cases handled by Sophos’ 2025 Active Adversary Report incident-response and MDR teams started with a vulnerable VPN.
- 63% of organizations breached in 2024 had no MFA configured on the exposed account, nearly triple the 22% rate in 2022 (Sophos, 2025).
- 32% of US adults currently use a VPN, down from 46% in 2023 (NordVPN 2025 usage survey).
- 70% of new remote-access deployments will rely on Zero Trust Network Access rather than legacy VPNs by the end of 2025 (Gartner).
Multiple actively exploited Ivanti Connect Secure VPN vulnerabilities were added to CISA’s Known Exploited Vulnerabilities Catalog in the first half of 2025.
How many people use a VPN in 2026
Global VPN usage has flattened at scale rather than slowed in growth. GWI’s research puts the share of internet users on a VPN at roughly 30%, which works out to about 1.6 billion people once you apply that share to current internet-user counts. The leading markets are concentrated in regions with restrictive internet policies or aggressive content controls. The UAE sits near the top at about 42% of internet users, with Russia, Indonesia, Turkey, India, Vietnam, and Malaysia all clustered between 26% and 38%, per GWI.
In the United States, the consumer story is different. NordVPN’s 2025 survey found that 32% of Americans currently use a VPN, a meaningful drop from 46% in 2023 and 39% in 2022. The number is not falling because privacy concern has faded. It is falling because casual streaming-driven users have moved on, while the remaining base is more committed and more likely to pay. NordVPN reported that paid VPN use climbed to 52% of US users in 2025, while free use accounted for about a third of all VPN users in Canada, Australia, and most non-US markets.
Mobile dominates the device split. Most consumer VPN sessions now originate on phones, and major surveys consistently show roughly half of users running their VPN on iOS and another third or so on Android, with desktop platforms in the single digits. The implication for IT teams is that any BYOD or remote-work program needs to account for personal VPNs running on the same device as corporate apps, since split-tunnel behavior is no longer a corporate-only concern.
The VPN market keeps growing, even as enterprise VPN declines
The global VPN market was estimated at $44.6 to $45 billion as of 2022 and is on a path that Grand View Research forecasts will hit $151.92 billion by 2030, a compound annual growth rate of about 17.7%. Most of that growth lives on the consumer side, where subscription apps, mobile carriers, and security suites are bundling VPNs into broader privacy offerings.
Enterprise spending tells a different story. The traditional remote-access VPN appliance is in slow decline, with Gartner projecting that 70% of new remote-access deployments will use Zero Trust Network Access by the end of 2025 and that ZTNA growth among 5,000 to 25,000-seat organizations is being driven primarily by VPN replacement projects. Gartner notes that the business justification for the shift comes from risk reduction rather than from cost savings, which lines up with the breach data below.
VPN vulnerabilities and exploits: the 2026 enterprise reality
Perimeter devices have become the cybersecurity industry’s biggest visible weak point, and VPN gateways are at the center of the problem. The Verizon 2025 DBIR found that exploitation of vulnerabilities grew 34% year over year, with edge devices and VPN concentrators rising from 3% to 22% of breach-related exploitation, roughly an eightfold increase. Vulnerability exploitation now accounts for 20% of all breaches, only two points behind credential abuse at 22%, per Verizon.
The patch lag is the part that should worry boards. Per the Verizon 2025 DBIR, only 54% of vulnerable edge devices were fully remediated during the observation period, and median time to remediate was 32 days. That is well above what is acceptable for an internet-facing system, particularly because Verizon also reported that the median time between flaw publication and mass exploitation for edge devices was effectively zero days. By the time most organizations begin patching, attackers have already scanned the entire internet and identified vulnerable instances.
Mandiant’s M-Trends 2026 report, which is built on more than 450,000 hours of incident response in 2025, reached the same conclusion from a different angle. Exploits were the top initial-access vector at 32% for the sixth consecutive year, and the four most exploited vulnerabilities in 2024 all sat in edge devices: Palo Alto’s PAN-OS GlobalProtect (CVE-2024-3400), two Ivanti Connect Secure VPN flaws (CVE-2023-46805 and CVE-2024-21887), and a Fortinet FortiClient management server SQL injection (CVE-2023-48788). Mandiant also reported that attackers can now hand off compromised access between teams in roughly 22 seconds, leaving defenders almost no buffer between initial compromise and follow-on action.
Federal authorities have been tracking the same surge in parallel. CISA’s Known Exploited Vulnerabilities Catalog added multiple new VPN appliance flaws in 2025, including CVE-2025-0282 and CVE-2025-22457, both in Ivanti Connect Secure, and both confirmed to be exploited in the wild. The latter was actively exploited starting in mid-March 2025 and allowed unauthenticated remote code execution, per the CISA advisory.
Ransomware groups love a misconfigured VPN
The connection between VPN exposure and ransomware is direct. Sophos’ 2025 Active Adversary Report found that vulnerable VPNs were the entry point in 12% of cases handled by its incident response and MDR teams in 2024. Exploited vulnerabilities, taken as a whole, were the most common ransomware initial-access vector at 32%, followed by compromised credentials at 23% and phishing at 18%, per Sophos.
MFA gaps amplify the damage. Sophos reported that the share of breached organizations without MFA configured on the exposed account nearly tripled from 22% in 2022 to 63% in 2024. In incident-response engagements specifically, MFA was unavailable in 66% of cases, and 67.32% of all 2024 to 2025 incidents had an identity-related root cause, with compromised credentials alone accounting for 42.06%. The pattern Sophos describes is consistent across cases: an attacker buys or brute-forces VPN credentials, gets unrestricted lateral access because the appliance was never integrated with MFA, and rolls ransomware across the estate within hours.
Verizon’s own data lines up. The 2025 DBIR found that ransomware was present in 44% of breaches overall and in 88% of breaches at small and medium-sized businesses, a category that disproportionately runs older VPN appliances without enforced MFA or modern conditional access. Ransomware incidents rose 37% year over year per Verizon, even as the median ransom payment fell to about $115,000 and 64% of victims declined to pay.
Why VPN appliances are the soft target
Three factors make VPN gateways uniquely attractive to attackers in 2026.
First, they are internet-facing by design. A VPN that no one can reach from the public internet is not a VPN. That visibility is exactly what zero-day scanners look for, which is why edge devices saw a near-zero median time from disclosure to mass exploitation in the Verizon 2025 DBIR.
Second, most VPN appliances run on opaque firmware that does not host endpoint detection and response agents. Defenders cannot see what is happening inside the box the way they can on a managed laptop. Mandiant has called out this monitoring gap repeatedly as one reason state-sponsored groups have moved toward edge-device exploitation as a primary intrusion path.
Third, once an attacker is through the VPN, the security model often assumes they belong on the network. Legacy VPNs grant broad layer-three access to internal subnets rather than verifying every session against identity and device posture. That is the architectural gap ZTNA was designed to close, and it is why Gartner describes VPN replacement as the primary motivator for ZTNA adoption among mid-market and enterprise buyers.
Free vs paid VPN usage in 2026
Free VPN apps remain widespread, particularly outside the United States. NordVPN’s 2025 survey found that free services still account for roughly a third of all VPN users in Canada, Australia, and most non-US markets, while paid use rose to 52% in the US. Free VPN apps frequently log user data, inject ads, sell traffic data, or come bundled with adware, and they create a hidden compliance problem for any organization that has not blocked them through MDM policy or DNS filtering. Mobile is especially exposed, since most app-store VPNs run on personal devices that often hold corporate email, file storage, and SaaS sessions.
Emerging VPN trends and what is new in 2026
Several developments stand out for security and compliance teams as 2026 progresses.
ZTNA replaces VPN as the default new deployment. Gartner’s Market Guide for Zero Trust Network Access names VPN replacement as the leading driver of ZTNA adoption, and that pattern has accelerated in 2025. Organizations are not ripping out VPNs overnight, but new deployments and refresh cycles are tilting heavily toward ZTNA architectures that grant per-application access rather than full-network access.
Edge-device exploitation has become a state-sponsored specialty. Mandiant’s M-Trends 2026 report found that state-aligned groups are now consistently targeting VPN gateways, firewalls, and routers as the preferred path into enterprises across at least 13 industries, including healthcare, financial services, and government. Edge devices went from 3% to 22% of all breach-related exploitation in a single year per Verizon, and the trajectory is still climbing.
Mobile VPN sprawl is creating a new shadow IT category. With about half of consumer VPN sessions running on iOS and another third on Android (per NordVPN), employees are bringing personal VPN apps onto devices that touch corporate data. Many of those apps route traffic through unknown jurisdictions, weakening any geographic or data-residency control IT has put in place.
Regional demand spikes still drive VPN headlines. Major events, including elections, social-media bans, and internet shutdowns, continue to push regional VPN adoption sharply higher within days. Whether those spikes show up on the corporate side or only in consumer markets, they are a reliable indicator that VPNs remain the default privacy fallback for billions of users.
MFA on VPNs is no longer optional. Given that Sophos found MFA missing in 63% of breached organizations and that VPN credential abuse keeps appearing in ransomware case studies, the practical baseline for 2026 is conditional access tied to device posture, MFA on every VPN account, and rapid patching of any internet-facing VPN appliance within days of disclosure rather than weeks.
For broader context on the trends above, see our zero trust statistics and cyber attack statistics roundups.
How swif.ai helps
swif.ai gives IT and security teams a single console to enforce device, identity, and compliance controls across the macOS, Windows, and Linux endpoints behind the numbers above. Explore swif.ai unified endpoint management to see how it works.
.webp)
