Malwarebytes VPN

A security company that wanted a real VPN bought one. In November 2024 it acquired AzireVPN, a small Swedish operator, and its own audit post states that the resulting infrastructure now powers both products, which it operates and maintains itself. That is a change of position, not just a purchase: before it, this brand ran on a network it rented. Transparency reports are published annually and a warrant canary monthly.

Then it did the rarer thing. It commissioned an outside firm to examine the infrastructure, the firm found two problems it rated critical — both concerning how servers are provisioned and booted rather than how traffic is handled — and the company published the report anyway, severity ratings intact, with an explanation of why exploiting either would require physical access to its datacentres. The same examination found no evidence of user activity being logged.

The cost is what that report has not yet said. There is no published confirmation that either critical finding has been fixed, so what a reader has is a company being unusually honest about problems that were open when it wrote. The company is American, so an American court is what compels it, there is no Linux client or router support, and signing up requires an identity like everywhere else.