The Comfort of Locks on an Open Door: Separating Genuine Security From Expensive Illusion

There is a particular kind of false confidence that security products are very good at manufacturing. A VPN logo in the corner of your screen, a browser extension with a shield icon, a password manager that grades your credentials — each of these creates a tangible, visible signal that something protective is happening. That signal feels good. It also, in many cases, has limited relationship to the actual threats you face.

This is not an argument against security tools. Several of them are genuinely valuable. It is an argument for understanding what a tool actually does, against what threat, under what conditions — and for recognizing when a product is selling peace of mind rather than delivering it.

What Security Theater Actually Means

The term "security theater" was popularized by cryptographer and security technologist Bruce Schneier to describe security measures that provide the appearance of protection without meaningfully reducing risk. The concept is well understood in physical security — the TSA removing shoes at airport checkpoints is a canonical example — but it applies with equal force to the digital tools consumers purchase and install.

Security theater is not always a product of bad faith on the part of vendors. Sometimes it reflects a genuine mismatch between what a tool was designed to do and the threat model of the person using it. A lock is not theater; a lock on a door with no walls around it is. The same logic applies to software.

The VPN Problem

Virtual private networks are among the most aggressively marketed consumer security products in existence. Podcast sponsorships, YouTube pre-rolls, and celebrity endorsements have made VPN brand names household words. The core promise — that a VPN protects your privacy online — is technically accurate in a narrow set of circumstances and significantly misleading in most others.

What a commercial VPN actually does is encrypt the traffic between your device and the VPN provider's server, and substitute the provider's IP address for your own when you connect to external services. This is genuinely useful in two primary scenarios: connecting to public Wi-Fi networks where a malicious actor might intercept unencrypted traffic, and obscuring your IP address from specific services (useful for circumventing geographic content restrictions, for example).

What a commercial VPN does not do is protect you from the threats responsible for the vast majority of consumer security incidents. It does not prevent phishing attacks. It does not protect credentials you enter on a legitimate website that has been compromised. It does not prevent malware already present on your device from exfiltrating data. It does not stop the websites you visit from identifying you through browser fingerprinting, first-party cookies, or login sessions. And critically, it transfers your trust from your internet service provider to the VPN provider — a trade that requires careful evaluation of the provider's jurisdiction, logging practices, and ownership structure.

Several popular VPN services have been acquired by large holding companies whose privacy commitments are less clearly established than their marketing materials suggest. A 2021 investigation by vpnMentor and subsequent reporting found that multiple "no-log" VPN providers were, in fact, retaining user data. Selecting a VPN requires research, not brand recognition.

Browser Extensions: A Mixed Record

The browser extension ecosystem presents a similar pattern. Ad blockers with strong reputations — uBlock Origin is the most consistently recommended by independent security researchers — provide genuine value by reducing exposure to malvertising, a real and underappreciated attack vector through which malicious code is delivered via compromised advertising networks.

Beyond that category, the picture becomes murkier. Many "privacy" extensions request broad permissions to read and modify all website data — permissions that, in the wrong hands, enable the very surveillance they claim to prevent. The Chrome Web Store and Firefox Add-ons repository have both hosted extensions that were later found to be harvesting browsing history and transmitting it to third parties. An extension promising privacy while holding permissions to observe your entire browsing session is not a theoretical risk; it is a documented attack pattern.

The practical guidance here is to minimize your extension footprint. Every extension you install is an additional trust relationship and an additional attack surface. Audit your current extensions, remove those you do not actively use, and verify the reputation and ownership of those you retain.

Threat Modeling: The Framework That Changes Everything

The antidote to security theater is not cynicism about all security tools — it is threat modeling. Threat modeling is the practice of systematically identifying what you are protecting, from whom, and with what resources. It is the methodology that security professionals use, and a simplified version of it is accessible to any consumer.

Ask yourself four questions:

1. What do I most need to protect? Financial accounts, private communications, professional data, physical location, or some combination?
2. Who might realistically attempt to access it? Opportunistic cybercriminals, targeted attackers, data brokers, an abusive ex-partner, or a specific corporate or government adversary?
3. What are the most likely attack vectors? Phishing emails, credential stuffing from a previous breach, malware, physical device access, or social engineering?
4. What controls address those specific vectors most effectively?

For the overwhelming majority of American consumers, the answer to question three points to phishing, credential stuffing, and account takeover — not to ISP surveillance or man-in-the-middle attacks on public Wi-Fi. This means the highest-value investments are a reputable password manager with unique credentials for every account, multi-factor authentication on all accounts that support it (prioritizing hardware security keys or authenticator apps over SMS), and trained skepticism toward unsolicited communications requesting action.

A VPN subscription ranked below these controls is money and attention directed away from your actual risk surface.

Making the Distinction in Practice

Genuine security controls share certain characteristics: they address documented, realistic attack vectors; they operate transparently with auditable behavior; they have been evaluated by independent researchers; and their limitations are clearly communicated by reputable sources.

Security theater tends to share different characteristics: it is marketed primarily through fear; it promises broad, vague protection; its efficacy is difficult to verify; and its limitations are absent from vendor communications.

Neither category is perfectly stable. A tool can be genuine protection for one threat model and theater for another. The goal is not to identify a list of approved products but to develop the analytical habit of asking what a tool does, against what threat, and whether that threat is actually relevant to your circumstances.

CipherWatch's consistent position is that informed users are more secure than users with impressive-looking software. The most sophisticated lock available cannot protect a door you have left open — and no extension, VPN, or security suite can compensate for a threat model you have never examined.