The results of the latest independent audit carried out by ExpressVPN are in and it is good news for all customers that use their Windows app.
The test has passed the Windows App with flying colours with no significant vulnerabilities identified. Furthermore, it has confirmed the ExpressVPN security and privacy claims about their Windows app.
F-Secure's independent audit
The audit of the ExpressVPN Windows software was carried out by F-Secure, an independent third-party cybersecurity company, between November and December 2021. It reviewed the app and carried out a comprehensive penetration test to confirm the apps' privacy and security protections.
The tests conducted were intended to identify any security weaknesses in the coding that underpins the app with a particular focus on any issues that might result in the leaking of user information or IP Addresses.
The good news is that no vulnerabilities of this type were found. In fact, there were absolutely no critical vulnerabilities found. Neither were there any issues classified as high or even medium risk identified.
One vulnerability classified as low risk was found. This has now been fixed and F-Secure has confirmed as much in a follow-up test conducted last month.
The overall conclusions of the report are abundantly clear.
It states that “It was not possible to gain information about ExpressVPN's clients or out of the network traffic. Nor was it possible to execute code remotely through attacks such as, but not limited to, Man-in-the-Middle (MitM), TLS downgrading, packet injection.”
As Aaron Engel, Head of Cybersecurity at ExpressVPN commented, “The report from F-Secure showcases the strength of our product and validates the high-quality work that ExpressVPN engineers and security experts have been doing.”
ExpressVPN's audit record
Independent security audits are vitally important for VPNs to ensure credibility with their users.
Any VPN can claim to offer rock-solid security and privacy protections. But the reality is that most users don't have the know-how to check up on this and confirm that their claims stack up.
That's where independent audits conducted by reputable third-party organisations come in. They can do the checks that you can't and reassure users old and new that your VPN does exactly what it says it does.
ExpressVPN has been one of the first VPNs to really embrace independent audits and this latest audit of their Windows app is just the latest in a long line of independent tests that they have carried out.
PwC Switzerland also conducted an assurance engagement on their build verification process while Cure53, an independent cyber security company has also examined their browser extensions and their new VPN protocol, Lightway.
Audits and the importance of VPN transparency now and in the future
At the end of the year, ExpressVPN will be way out in front of all their main rivals in conducting these audits and will have boosted the trust of their users and the transparency of their service and products overall.
They have also helped launch the VPN Trust Initiative, which aims to promote public awareness about internet safety overall as well as the specific roles that reliable VPNs like ExpressVPN can play.
ExpressVPN is really leading the way when it comes to transparency and independent audits of their service. They deserve enormous kudos for that and for showing other VPN providers the way.
We hope to see more VPN providers following their lead and expanding on their use of independent audits across their entire service in the months and years ahead.
For now, users who want to be sure that their VPN provider is providing the service they promise will know that in ExpressVPN, they have a premium, high-quality VPN that genuinely does do exactly what it says on the tin.