VPN Statistics 2026: Usage, Breach, and Regulator Data

The Verizon 2026 Data Breach Investigations Report found that edge devices and VPNs jumped from 3% to 22% of exploitation-driven breaches in a single year, a 7x increase. Vendor surveys still dominate the consumer VPN discussion, but the durable 2026 numbers now sit in security-incident data.

The Cybersecurity and Infrastructure Security Agency issued three emergency actions on the top enterprise VPN platforms in a 30-month window: Emergency Directive 25-03 in September 2025 against Cisco Adaptive Security Appliance zero-days that persist through reboots and system upgrades, a joint advisory covering a three-CVE chain on Ivanti Connect Secure and Policy Secure gateways where root-level persistence survives factory resets, and a June 2026 alert on the FortiBleed activity that exposed credentials associated with approximately 74,000 Fortinet devices, including firewalls and VPN gateways.

Key Takeaways

• Edge devices and VPNs accounted for 22% of exploitation-driven breaches in the 2026 DBIR, up from 3% the year before. That single-year shift is a roughly 7x increase in edge and VPNs’ share.
• CISA’s FortiBleed alert flagged approximately 74,000 internet-accessible Fortinet devices, including firewalls and SSL VPN gateways, with exposed credentials.
• Ivanti EPMM’s actively exploited flaw CVE-2026-1281 carries a CVSS score of 9.8, with unauthenticated remote code execution and a federal patch deadline of February 2, 2026.
• Cloudflare Radar observed 174 major internet outages worldwide in 2025, with almost half attributable to government-directed regional and national shutdowns.
• Iran’s partial restoration on May 26, 2026 peaked at only 40% of the maximum activity Cloudflare had recorded so far in 2026, after a shutdown that lasted nearly three months.
• The 2026 DBIR reports that 73% of ransomware victims had prior infostealer activity, which anchors the case for phishing-resistant MFA at every VPN gateway.
• CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on August 11, 2026, including CVE-2026-20349, a heap-inspection flaw in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD).

Editor’s Choice

• Vulnerability exploitation became the #1 initial-access vector in the 2026 DBIR, overtaking stolen credentials for the first time in 19 years.
• 74,000 Fortinet devices, including SSL VPN gateways, had exposed credentials in the FortiBleed activity flagged by CISA in June 2026.
• A chain of three Ivanti CVEs (CVE-2023-46805, CVE-2024-21887, CVE-2024-21893) affects all supported versions of Connect Secure and Policy Secure and can survive factory resets with root-level persistence, according to CISA and co-authoring agencies.
• CISA’s April 2026 V1 supersedes Emergency Directive 25-03 and kept CVE-2025-20333 (remote code execution) and CVE-2025-20362 (privilege escalation) on Cisco ASA at “unacceptable risk” for federal agencies.
• Almost half of 174 major internet outages in 2025 were government-directed, per the Cloudflare Radar 2025 Year in Review.
• On May 26, 2026, the traffic surge that marked Iran’s partial restoration ran roughly 15x the levels observed the prior week, with 91.6% of the new HTTP requests localized to Tehran.

VPN Statistics in Numbers

• Edge-and-VPN share of exploitation-driven breaches: 22% in the 2026 DBIR, up from 3% the year prior.
• Fortinet devices with credentials exposed in FortiBleed: approximately 74,000.
• Major internet outages worldwide in 2025 per Cloudflare Radar: 174.
• Share of those outages government-directed: almost half.
• Ivanti EPMM CVE-2026-1281 base CVSS score: 9.8.

Source: Verizon Data Breach Investigations Report 2026, CISA cybersecurity advisories 2024-2026, Cloudflare Radar 2025 Year in Review.

By the numbers: Verizon’s 2026 DBIR marked the first time in the report’s 19-year history that vulnerability exploitation overtook stolen credentials as the #1 initial-access vector, with edge devices and VPNs alone jumping from 3% to 22% of exploitation-driven breaches. That single-year 7x increase reframes every VPN-adoption figure as a rising attack surface, not just a privacy statistic.

The underlying traffic patterns VPNs ride on sit in the broader internet usage dataset.

Edge and VPN as an Attack Surface

The 2026 DBIR found that edge devices and VPNs went from 3% to 22% of exploitation-driven breaches, a 7x jump in a single year. Vulnerability exploitation overtook stolen credentials as the #1 initial-access vector for the first time in the report’s 19-year history.

• Vulnerability exploitation is the #1 initial-access vector in the 2026 DBIR, ahead of stolen credentials for the first time.
• Edge devices and VPNs alone account for 22% of exploitation-driven breaches, up from 3% the year before.
• The single-year jump from 3% to 22% is a roughly 7x increase in edge-and-VPNs’ share.
• Ransomware victims with prior infostealer activity: 73%, per the same 2026 DBIR dataset.
• Exploit windows are measured in days, far shorter than any appliance patch cycle.

The appliance bought to secure remote access has become the likeliest place a breach begins, which is the single most consequential entry in current VPN statistics coverage.

The mechanism sits behind the number. Edge appliances face the internet by design, sit at the perimeter of network-layer trust boundaries, and hold administrator credentials with broad reach into internal systems.

Exploit windows are measured in days, far faster than any appliance maintenance cycle, which means the operational patching model that once fit an internal server does not fit an internet-facing gateway. The follow-on pattern is equally consistent: 73% of ransomware victims had prior infostealer activity, so credentials harvested through one channel feed the next.

Employee-behavior signals that pair with these appliance figures sit in the broader remote work security data.

Don’t chase tech news. We track it for you.

One weekly briefing with the launches, AI developments, and breaches that matter. No filler.

Email address

Subscribe Now

Read by pros at Fortinet, TSMC, Barclays, and Deloitte.

Recent Developments

The rolling VPN statistics of the last twelve months tell the same story the DBIR figure opens with.

• 2025-09-25: CISA issued Emergency Directive 25-03 against Cisco Adaptive Security Appliance zero-day vulnerabilities, requiring federal agencies to account for all in-scope devices and complete required actions by 11:59 PM EST on September 26, 2025.
• CISA added Ivanti Endpoint Manager Mobile flaw CVE-2026-1281 (CVSS 9.8) to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to fix it by February 2, 2026.
• 2026-04-23: CISA issued V1 of Emergency Directive 25-03, superseding required actions and releasing the FIRESTARTER Backdoor Malware Analysis Report after new intelligence on threat-actor persistence.
• 2026-05-26: Cloudflare Radar confirmed Iran’s Internet was partially restored after being cut off for almost three months, with peak traffic at just 40% of prior 2026 levels.
• 2026-06-18: CISA released hardening guidance for Fortinet devices after the FortiBleed activity exposed credentials for approximately 74,000 Fortinet devices, including SSL VPN gateways.
• 2026-08-11: CISA added CVE-2026-20349, a heap-inspection flaw in Cisco Secure Firewall ASA and Firewall Threat Defense, to the KEV Catalog with evidence of active exploitation.

Federal Emergency Directives on VPN Platforms

The clearest institutional signal in enterprise VPN statistics is the federal-directive cadence.

• CISA emergency directives and KEV additions targeting VPN platforms in the last 30 months: 6 discrete federal actions.
• National-security-tier co-authored advisory on Ivanti Connect Secure: CISA and co-authoring agencies.
• Federal patch deadline for Ivanti EPMM CVE-2026-1281: February 2, 2026.
• Cisco ASA CVEs kept at “unacceptable risk” by V1 of ED 25-03: 2 (CVE-2025-20333, CVE-2025-20362).

CISA’s own analysis of the September 2025 directive concluded that applying the Cisco-provided security updates does not necessarily remove an existing threat actor from a compromised device, which is the operational subtext of the V1 supersede. Acting CISA Director Madhu Gottumukkala framed the September 2025 issuance around the “alarming ease with which a threat actor can exploit these vulnerabilities, maintain persistence on the device, and gain access to a victim’s network.”

Six federal actions on internet-facing VPN platforms in 30 months is the base rate the sector now runs on. Broader vector context sits in the cybersecurity attack data set.

Named VPN Vulnerabilities and Their CVSS Scores

• Ivanti EPMM CVE-2026-1281: unauthenticated remote code execution, base CVSS score 9.8, added to the KEV Catalog.
• Cisco ASA CVE-2025-20333 and CVE-2025-20362: kept at “unacceptable risk” for federal agencies under V1 of ED 25-03.
• Ivanti Connect Secure chain CVE-2023-46805, CVE-2024-21887, CVE-2024-21893: authentication bypass through to arbitrary command execution across all supported versions.
• Cisco ASA/FTD CVE-2026-20349: heap-inspection flaw added to the KEV Catalog in August 2026 on evidence of active exploitation.

Source: CISA KEV Catalog entries and CISA emergency-directive text, retrieved September 2026.

Two patterns run through the list.

The three CVEs on Ivanti Connect Secure and Ivanti Policy Secure (CVE-2023-46805, CVE-2024-21887, CVE-2024-21893) can be used in a chain of exploits to bypass authentication, craft malicious requests, and execute arbitrary commands with elevated privileges, and impact all supported versions (9.x and 22.x).

CISA’s independent research in a lab environment validated that Ivanti’s internal and previous external ICT is not sufficient to detect compromise and that a cyber threat actor may be able to gain root-level persistence despite issuing factory resets.

The Cisco ASA cluster shows a comparable pattern of persistence after remediation, which is why the V1 supersede added forensic hunt and disconnection requirements.

Worth noting: The advisory was co-authored by CISA and co-authoring agencies. Coordinated multi-agency authorship is the strongest signal a national-security-scale event has been assessed, and it belongs above vendor blog explanations of the same CVEs. Defender-side capacity trends sit in the cybersecurity job market data.

Government-Directed Internet Shutdowns Drive VPN Demand

Circumvention VPN demand tracks state action that cuts internet access; Cloudflare Radar publishes the primary measurement.

• Total major internet outages observed by Cloudflare in 2025: 174.
• Share of outages that were government-directed regional or national shutdowns: almost half.
• Cloudflare’s measurement network reach: over 330 cities in more than 125 countries.

Source: Cloudflare Radar 2025 Year in Review (December 2025).

Almost half of the 174 major Internet outages Cloudflare observed around the world in 2025 were due to government-directed regional and national shutdowns of Internet connectivity. That figure is drawn from Cloudflare’s own network measurements across more than 330 cities in more than 125 countries.

Why it matters: The 2025 Cloudflare Radar Year in Review sits on Cloudflare’s expansive global network that spans over 330 cities in more than 125 countries, which makes it the largest publicly-shared measurement of the internet-shutdown category. Nearly-half attribution to state action reframes VPN demand from a marketing story into a network-freedom story.

Iran’s 3-Month Shutdown and Partial Restoration

Cloudflare Radar produced the sharpest public measurement of Iran’s cutoff and May 26 restoration, the primary VPN statistics anchor for censorship-driven demand this year.

• Iran shutdown duration: almost 3 months starting February 28, 2026.
• Restoration-day traffic surge: roughly 15x the prior week’s levels.
• Peak restoration versus 2026 baseline: only 40% of the prior maximum.
• HTTP requests localized to Tehran during restoration: 91.6%.
• IPv6 traffic from Iran post-restoration: effectively zero.
• Restoration announcement date: May 26, 2026, ending a shutdown that began February 28, 2026.
• First measured traffic spike: 11:45 UTC, followed by a steady increase from 12:00 UTC.
• IPv4 address-space announcements: fairly consistent through the shutdown and after.

Source: Cloudflare Radar blog, “Iran’s Internet is partially restored, Cloudflare Radar data shows”, May 27, 2026. The May 26 restoration-day surge measured roughly 15x the prior week (see below); that multiplier is a separate metric from the peak-indexed values above.

On Tuesday, May 26, Iran’s vice president announced that Internet access had started to be restored in the country after being cut off almost three months ago, following the launch of U.S. and Israeli attacks on February 28. Cloudflare Radar data confirmed a brief spike at 11:45 UTC followed by a steady increase starting at 12:00 UTC, a surge in activity roughly 15x the levels observed during the prior week. At its peak on May 26, traffic had only returned to 40% of the maximum amount of activity observed so far in 2026.

Cloudflare Radar’s regional breakdowns indicate that the vast majority of this new traffic is localized to Tehran, with 91.6% of HTTP requests originating from the capital city. The volume of announced IPv6 address space, and thus IPv6 traffic from Iran, remained effectively zero even after restoration began, which means the network layer under the restoration is still partial.

Enterprise VPN Market vs Consumer VPN Market

Enterprise VPN statistics are legible through federal directives; consumer market share leans on vendor surveys.

• Enterprise VPN platforms drawing a federal emergency directive in the last 30 months: 3 (Cisco ASA, Ivanti Connect Secure, Fortinet FortiGate).
• Consumer commercial VPN adoption data: dominated by vendor-published surveys; no widely-accepted primary measurement.
• Enterprise ZTNA displacement of VPN: primary driver cited in analyst-reported enterprise-buyer motivation.

Source: SQ Magazine data-posture reference, compiled from cited CISA and Cloudflare Radar sources.

Consumer VPNs reduce specific privacy and geo-block exposures without delivering anonymity. Enterprise buyers are moving toward zero-trust architectures with no inbound VPN ports. Smaller-organization exposure trends sit in the SMB cybersecurity data set.

The takeaway: The 2026 DBIR puts edge devices and VPNs at 22% of exploitation-driven breaches, up from 3% a year earlier, which reframes the box bought to provide secure remote access as a rising breach entry point, which is the durable operational lesson of the 2026 data. The wider cybersecurity statistics data set carries the enterprise-security context organizations use to plan around these directives.

Where VPN Use Is Restricted or Banned

The most reliable VPN-legality characterizations name a specific statute or regulator, as the reference table below does.

• Countries with total consumer VPN bans in the reference table below: 4 (North Korea, Turkmenistan, Belarus, Iraq).
• Countries with heavy VPN restrictions or government-approved-only regimes: 5 (China, Russia, Iran, Turkey, UAE).
• Democracies with unrestricted personal and enterprise VPN use in the same set: 6 (United States, EU, UK, Canada, Australia, Japan).

Source: Public statements from national regulators and government press releases through Q3 2026; DataReportal Digital 2026 Mid-Year Update for the China VPN-access framing.

For most SQ readers, VPN use is legal; the reference table lists 4 total-ban states, 5 heavily restricted states, and 6 unrestricted democracies where personal and enterprise VPN use is legal. Local law compliance is the reader’s responsibility. DataReportal notes that many platforms remain blocked in China, with users enjoying varying levels of access via VPNs while domestic platforms remain far more popular choices.

What technology is replacing VPN?

Zero Trust Network Access, commonly written as ZTNA, is the architecture that enterprise buyers most often name when they retire an internet-facing VPN. Every new CISA action strengthens the case for removing inbound VPN ports. The durable fix per the 2026 DBIR is zero inbound ports with outbound-only delivery. For most organizations, the migration is gradual, driven by contract renewals and specific application cutovers, not a single-day replacement.

Can a VPN really hide my IP address?

A commercial VPN routes the user’s traffic through the provider’s server, so external sites see the VPN’s IP rather than the user’s home IP. The VPN provider still sees the traffic, DNS can leak on misconfiguration, and account activity still identifies the user. A VPN helps reduce IP exposure; it does not deliver anonymity.

Conclusion

Set vendor surveys aside, and the 2026 VPN statistics carry a plain shape: the DBIR jumped 3% to 22% on edge-and-VPN, CISA issued three top-platform emergency actions, and Cloudflare Radar counted 174 major 2025 outages, nearly half state-directed.

The shrinking disclosure-to-exploitation window pushes enterprises toward outbound-only architectures with MFA at every gateway. Consumers keep narrow privacy benefits. The next material update to these VPN statistics likely arrives from CISA.