VPN, antivirus, password manager: what each one solves
A password manager addresses credential reuse and phishing, which is where most account compromise begins. Antivirus addresses malicious software on the device. A VPN addresses what the network can observe. They overlap almost not at all, and their importance is roughly in that order.
4 min read
Security suites bundle these three and the bundling implies they are variations on one thing. They are not. Each addresses a different point of failure, and knowing which is which changes what you should actually spend attention on.
Password manager: the credential problem
Solves: reusing passwords across sites, so one breach compromises many accounts. Weak passwords. And, importantly, phishing — a manager will not autofill a credential on a domain that does not match, which is a better phishing defence than human vigilance.
Does not solve: anything about the network, the device or malware.
Why it is first: the overwhelming majority of account compromise starts with a credential, either reused from another breach or phished. Fixing that addresses the most common failure mode directly.
Add two-factor authentication, ideally a passkey or a hardware key rather than SMS, and this category is largely handled.
Antivirus: the device problem
Solves: known malicious software, and increasingly behavioural detection of unknown software doing suspicious things.
Does not solve: phishing, weak credentials, or anything the network sees.
Where it sits: on Windows, the built-in Defender is competent and free, and for most people a third-party product adds little. On macOS and Linux the case is weaker still. On mobile, the platform's app review and sandboxing do most of the work and third-party mobile antivirus is largely theatre.
The most valuable thing in this category is not a product: it is keeping the operating system and browser updated, which closes the vulnerabilities the malware would have used.
VPN: the network problem
Solves: your network operator seeing which sites you visit. Traffic on untrusted networks. Your address being visible to sites you reach.
Does not solve: phishing, malware, weak passwords, tracking by cookies or fingerprinting, or anything at all about a site you are logged into.
Where it sits: genuinely useful for what it does, and routinely marketed as if it did the other two categories' jobs. A VPN cannot stop you downloading malware or entering a password into a fake page.
Ranking them
If you can only do one thing: a password manager with two-factor authentication. It addresses the most common way people actually lose accounts.
Second: keep everything updated. Free, and more effective than any product.
Third: a VPN, for the network exposure it genuinely removes, and more valuable the more you use networks you do not control.
Antivirus beyond the built-in one sits below all three for most people.
The overlap, such as it is
Almost none. The one real intersection is that some VPN clients bundle DNS-level blocking of known malicious domains, which is a small anti-malware benefit delivered through a network tool. It is useful and it is not antivirus.
What the bundles get wrong
Marketing that describes a VPN as protecting you from hackers, or from viruses, or from identity theft. None of those are network problems, and the tool does not touch them.
The honest description is narrow: a VPN stops the network you are on from seeing where you go, and stops the sites you reach from seeing where you are. VPNmine's privacy policy is the place that has to be specific about what is recorded, which is the corresponding question about the tool itself.
If you want all three, get them separately from providers who are good at each, rather than from one suite that is adequate at all of them. The download page covers the VPN half.
Where passkeys change the picture
Passkeys replace a password with a key pair held by your device, and the private half never leaves it. There is nothing to phish, because there is no secret to type, and nothing to reuse across sites.
Where a service supports them, they are strictly better than a password plus a second factor, and they make the password manager's phishing-resistance point moot for that service. Adoption is uneven, so a manager remains necessary for everything else — but the direction of travel is worth knowing when deciding where to invest effort.
The fourth thing nobody bundles
Backups. Not marketed as security and by far the most effective response to ransomware, device theft, drive failure and your own mistakes.
A tested backup turns several categories of catastrophe into an afternoon of inconvenience, which is a better return than any of the three products above. That it is missing from every security suite says more about what is easy to sell than about what protects people.
How to think about buying
Each of these is a different market with different leaders, and a bundle is almost never the best of all three. The bundle exists because selling three subscriptions to one customer is easier than selling one.
Buy the password manager first, use the platform's built-in antivirus, choose a VPN on the specifics of what it retains rather than on the brand, and set up backups before any of it.
