Do As I Say, Not As I Do: The Privacy Habits Cybersecurity Experts Keep to Themselves

There's a running joke in cybersecurity circles that goes something like this: ask a security researcher what VPN they use, and they'll give you a long, thoughtful answer. Ask them what they personally run on their own machine, and the conversation suddenly gets a lot more complicated.

It's not hypocrisy, exactly. It's more like a professional acknowledgment that the tools built for everyday consumers and the threat models facing people who actually study surveillance infrastructure for a living don't really overlap the way the marketing suggests they do.

So what's actually going on here — and what does it mean for the rest of us?

The Recommendation Reflex

When a cybersecurity professional appears on a podcast, writes a blog post, or gets quoted in a news article, they're usually talking to a general audience. The advice they give — use a reputable VPN, enable two-factor authentication, don't reuse passwords — is calibrated for that audience. It's solid, entry-level guidance designed to move millions of people from zero protection to something meaningfully better.

The problem is that this advice gets interpreted as a comprehensive solution rather than a starting point. A VPN becomes the privacy tool, not a privacy tool. And the nuances that experts quietly carry around in their heads — the asterisks, the caveats, the "well, it depends" — rarely make it into the headline.

The result is a weird dynamic where consumer-facing security advice has been optimized for simplicity, while the people giving that advice operate under a completely different set of assumptions.

What Researchers Actually Worry About

Here's where things get interesting. When security professionals talk candidly about their own setups — usually in conference hallways or private forums rather than public interviews — a few consistent themes emerge.

VPNs shift trust, they don't eliminate it. This is probably the most widely understood gap between expert knowledge and public perception. A VPN moves the point where your traffic is visible from your internet service provider to your VPN provider. That's genuinely useful in a lot of contexts. But researchers who've spent time digging into VPN infrastructure know that "no-log" policies are difficult to verify, that legal jurisdictions matter enormously, and that a provider under a national security letter isn't going to be able to tell you anything useful.

For someone whose threat model includes sophisticated state-level actors — or who simply doesn't want to replace one untrustworthy middleman with another — this is a real concern.

Metadata is often more revealing than content. Deep packet inspection, traffic timing analysis, and connection metadata can paint a detailed picture of your behavior even when the actual content of your traffic is encrypted. Researchers who work in this space know that the shape of your internet activity — when you connect, for how long, to what categories of services — is frequently more valuable to surveillance systems than the raw data itself. A VPN obscures some of this. It doesn't eliminate it.

The endpoint is almost always the weakest link. You can route your traffic through the most carefully configured VPN on the planet, and it means very little if the device you're using is running outdated software, has a compromised browser extension, or is logged into accounts that are already correlated with your identity. Security researchers tend to be almost obsessive about endpoint hygiene in ways that rarely show up in the "just download this app" version of privacy advice.

The Tools That Actually Show Up in Expert Setups

So what does a security-conscious researcher's actual privacy stack look like? It varies, obviously — threat models differ even among professionals. But a few patterns show up consistently.

Tor gets mentioned a lot more than it does in consumer guides, particularly for high-sensitivity browsing. It's slower, it's less convenient, and it's not appropriate for everything — but for someone who genuinely needs to decouple their traffic from their identity, the distributed relay model addresses some structural weaknesses that centralized VPN providers can't.

Network-level controls — things like Pi-hole for DNS filtering, or carefully configured firewall rules — show up frequently. These aren't glamorous solutions, but they address the reality that a lot of tracking happens at the DNS layer, well before a VPN even enters the picture.

Compartmentalization is practically a religion. Separate devices for separate use cases. Browsers configured to minimize fingerprinting. Accounts that are deliberately siloed from each other. The goal isn't to find one tool that does everything — it's to make sure that a failure in one area doesn't cascade into a failure everywhere.

The Honest Conversation About VPNs

None of this means VPNs are useless. They're genuinely valuable for a lot of common use cases: protecting yourself on public WiFi, preventing your ISP from selling your browsing data, accessing content that's geographically restricted, adding a layer of friction against casual surveillance. For most Americans going about their daily internet lives, a trustworthy VPN is a meaningful upgrade over nothing.

But the security research community's collective ambivalence about VPNs as a complete solution points to something worth sitting with. The consumer privacy industry has gotten very good at selling confidence. "Military-grade encryption," "zero logs," "total anonymity" — the language is designed to make you feel like the problem is solved. Researchers know that the problem is never fully solved, only managed.

The honest version of VPN advice sounds less like a product pitch and more like: this tool addresses specific threats in specific contexts, here are the things it doesn't cover, and here's what else you should be thinking about. That's a harder sell. It's also more accurate.

What You Can Actually Take From This

If you're a regular person trying to protect your privacy online — not a journalist working a sensitive story, not a researcher studying surveillance infrastructure, just someone who'd rather their ISP not sell their data to advertisers — a VPN is still worth using. The gap between expert practice and public recommendation doesn't mean the recommendation is wrong. It means it's incomplete.

The more useful takeaway is to stop treating any single tool as the finish line. Think about what you're actually trying to protect against. Consider whether your DNS is leaking. Think about what accounts you're logged into and what that says about your identity regardless of what your IP address shows. Pay attention to the browser you're using and what it's reporting back.

Security researchers don't skip VPNs because VPNs don't work. They layer them into a broader approach because they understand what VPNs actually do — and what they don't. Closing that knowledge gap a little is probably the most useful thing any consumer privacy guide can offer.

And if you're looking for a place to start, a solid, transparent VPN from a provider you've actually researched is still a reasonable first step. Just don't let it be the last one.