Kaspersky VPN was assessed by the HushFleet team and placed in the Not recommended band, with a security score of 3/100 and a usability score of 71/100. In the overall security ranking of VPN providers it ranks 49 of 68. Commercial VPN, company jurisdiction Russia.
7 fields sit on this record without entering the score, and the contract says so in the field itself: scored: false. They are here because a reader asking who owns this company, or who signed the audit, is asking something the record answers — and because a value that never touches the arithmetic should be visibly outside it rather than quietly mixed in.
Alternatives
Not recommended
Paying monthly
$8.99 per month
Paying yearly
$40.99 billed once a year
Coverage
Not published no country list published
Free tier
No paid trial only
Security
Usability
| Service class | Commercial VPN — security leads |
|---|---|
| Security score | 3 of 100 · Not recommended |
| Usability score | 71 of 100 · state known · 83% established · 73.5% of the weight read |
| Legal entity | AO Kaspersky Lab |
| Jurisdiction | Russia |
| Ultimate owner | Eugene Kaspersky |
| Exposure | Low · dominant channel: jurisdiction |
| Retention | unknown |
| Latest audit | unknown · unknown · unknown · unknown |
| Countries with exits | not published |
| Protocols | WireGuard |
| Works under active censorship | unknown |
| Weakest protocol still offered | not applicable |
| Own DNS inside the tunnel | unknown |
| Platforms | WindowsmacOSAndroidiOS |
| Simultaneous devices | 5 |
| Kill switch | On every platform |
| Split tunnelling | Available |
| Signing up | An email address only |
| Free tier | A trial only |
| P2P allowed | Allowed |
| Major streaming services reachable | Reachable |
| Price, monthly | $8.99 per month |
| Price, yearly | $40.99 a year at renewal, billed once |
| Offered countries that sit under a logging mandateC09_mandate_countries | unknown |
|---|---|
| Country of the ultimate beneficial ownerM11_owner_jurisdiction | RU |
| Owner group cluster keyM15_owner_group | independent |
| Date the current owner took controlM16_control_since | not applicable |
| Role of this brand inside the groupM17_brand_role | principal |
| Infrastructure shared with cluster siblingsM18_shared_infrastructure | separate |
| Total published auditsV10_audit_count | unknown |
Coverage147countries
Paying monthly$9.99monthly
Paying yearly$53.88yearly total
Free tierYeslimited free plan
Devices10at once
Security
Usability
Coverage50countries
Paying monthly$5.69monthly
Paying yearly$69.60yearly total
Free tierNopaid plans only
Devices5at once
Security
Usability
Coverage41countries
Paying monthly$6.00monthly
Paying yearly$60.00yearly total
Free tierNopaid plans only
Devices5at once
Security
Usability
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
23 42 left unknown, 2 not applicable
Completeness
33% the share the model could weigh
Citations
38 across 10 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 6 hereB weighs 0.85 · 32 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Backend operator. The privacy policy discloses that Kaspersky Secure Connection "uses services of third parties whose privacy practices differ from Kaspersky's," and the bug-bounty scope names "third-party modules" in the VPN app, but no page names the contractor, so retention, server ownership, DNS handling and jurisdiction of the actual exit infrastructure (C01, C06, C08, C09b) stay unknown.
No VPN-specific audit or no-logs attestation was found. Kaspersky's published SOC 2 Type II report covers antivirus-database infrastructure only and explicitly excludes the VPN; no independent audit, pentest or open-source claim naming the VPN product turned up on the sites checked.
Fleet size is unverified. The product pages advertise "6000+ servers in 120+ locations" but no page lists the actual countries, so U02_server_countries and everything derived from it (C09, C13) are unknown rather than assumed from the marketing figure.
On the record as a whole.
Standalone plans observed live on kaspersky.com on 2026-09-13: 5 devices / 1 month = $8.99; 5 devices / 1 year = $40.99 introductory, renewing at $47.99/year. The VPN is also bundled at no extra charge into the Kaspersky Plus and Premium suites.
Transparency-center figures (P08/P09/P05/P06) are corporate-wide (all Kaspersky products), not VPN-specific: H2 2025 reports 34 government/law-enforcement requests from 3 countries, all categorized as requests for "technical information or expertise" (not user account data) and all approved after legal-verification screening; a separate count of 432 requests came from individual users exercising data-subject rights.
M06 (company jurisdiction, RU) and M11 (owner jurisdiction, RU) are the same country, so C10/C11 represent one exposure, not two, per the model's own rule.
M09_owner_ultimate is sourced to a UK Companies House persons-with-significant-control filing for "Kaspersky Labs Limited" (a London-registered Kaspersky group entity, not itself AO Kaspersky Lab), which is a public record proving Eugene Kaspersky's majority personal control of that entity; it does not itself trace the full ownership chain to the Russian operating company, which is why X03_owner_transparency is graded partial rather than clear.
Where the company sits 0.6, where its owner sits 0.45, the exits it offers 0.05, the gag-order regime 0.05 — one circumstance, priced once rather than compounded.
Hosting in the mandate countries it offersC09b_mandate_hosting
unknown
nothing published · recorded as asserted
Incorporation country mandates retentionC10_company_under_mandate
yes
Bkaspersky.com13 Sep 2026
Report a problem with C10_company_under_mandateBeneficial owner sits under a retention regimeC11_owner_under_mandate
yes
Afind-and-update.company-information.service.gov.uk13 Sep 2026
Report a problem with C11_owner_under_mandateResponse to a national logging mandatealso read by ignoranceP04_mandate_response
Computed
×0.025 of a clean record completeness 33%
Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.380, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Silence — ×1.000 where the register averages ×0.927 — and furthest below on Jurisdiction, ×0.380 against ×0.680.
Published score
3Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
unknownnothing published · recorded as asserted
Secret-order regime in the incorporation countryP11_gag_order_regime
unknown
nothing published · recorded as asserted
What this channel priced on this record:Absolute claims 0.04Disclosure rate 0.3Owner transparency 0.06Owner group history 0.35
User base scale (mass >=10M, mid >=1M, niche <1M)also read by silenceM08_user_scale
unknown
nothing published · recorded as asserted
Other businesses of the owner groupM10_owner_other_business
antivirus
Bkaspersky.com13 Sep 2026
Report a problem with M10_owner_other_businessTransparency reportalso read by ignorance, silenceP05_transparency_report
fresh_with_numbers
Bkaspersky.com2025-12
Report a problem with P05_transparency_reportReported numbers plausible for this scalealso read by ignoranceP06_report_plausibility
plausible
Bkaspersky.com2025-12
Report a problem with P06_report_plausibilityDocumented gap between claim and behaviourX01_documented_lie
unknown
nothing published · recorded as asserted
Marketing versus audit findingsX02_claim_gap
unknown
nothing published · recorded as asserted
Ownership structure transparencyX03_owner_transparency
partial
Bkaspersky.comAfind-and-update.company-information.service.gov.uk13 Sep 2026
Report a problem with X03_owner_transparencyAdverse events on the owner group recordX04_owner_group_history
sanctioned_or_prosecuted
Afederalregister.gov24 Jun 2024
Report a problem with X04_owner_group_historyHow the service is paid forX05_monetisation_model
paid_only
Bkaspersky.com13 Sep 2026
Report a problem with X05_monetisation_modelClaims of 100% anonymity or military-grade cryptoX06_absolute_claims
yes
Bkaspersky.com13 Sep 2026
Report a problem with X06_absolute_claimsAggressive lifetime subscriptionsX07_lifetime_push
no
Bkaspersky.com13 Sep 2026
Report a problem with X07_lifetime_pushCoverage exists only on affiliate sitesX08_affiliate_only_reviews
unknown
nothing published · recorded as asserted
Security incident and how it was disclosedalso read by ignoranceX09_incident_handling
unknown
nothing published · recorded as asserted
Affiliate programme and payout tierX10_affiliate_program
unknown
nothing published · recorded as asserted
Owner-run review media discloses the tieX11_review_media_disclosure
unknown
nothing published · recorded as asserted
App store data declaration against the provider's own policyX12_store_data_declaration
unknown
nothing published · recorded as asserted
Contagion from the owner groupS18_cluster_contagion
0.0
no owner group on this record, so nothing to carry
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.55 for what is actually retained.
Retention linkable to a person as declaredmaterialC01_linkable_retention
unknown
nothing published · recorded as asserted
Persistent device identifier the provider holdsC12_device_identifier
unknown
nothing published · recorded as asserted
At least one independent auditmaterialV01_audit_exists
unknown
nothing published · recorded as asserted
How the report is publishedV02_report_publication
unknown
nothing published · recorded as asserted
Subject of the latest auditV03_audit_subject
unknown
nothing published · recorded as asserted
Server fleet coverageV04_scope_servers
unknown
nothing published · recorded as asserted
Auditor categoryV06_firm_category
unknown
nothing published · recorded as asserted
Assurance standardV07_audit_standard
unknown
nothing published · recorded as asserted
Date of latest reportmaterialV08_audit_date_latest
unknown
nothing published · recorded as asserted
Audit cadenceV09_audit_regularity
unknown
nothing published · recorded as asserted
What the report states is retainedV11_audit_findings
unknown
nothing published · recorded as asserted
Strength of the assurance opinionV15_assurance_strength
unknown
nothing published · recorded as asserted
Chronology of documented enforcement eventsP12_case_history
unknown
nothing published · recorded as asserted
Priced from what is missing: 0.33 of the weighted record is established, on a slope of 0.9 under a cap of 0.6, with a posture of 0.4 relieved by 0.4.
Record completenessS08_completeness
33%
derived from the record itself
Response to a national logging mandatealso read by jurisdictionP04_mandate_response
unknown
nothing published · recorded as asserted
Transparency reportalso read by integrity, silenceP05_transparency_report
fresh_with_numbers
Bkaspersky.com2025-12
Report a problem with P05_transparency_reportReported numbers plausible for this scalealso read by integrityP06_report_plausibility
plausible
Bkaspersky.com2025-12
Report a problem with P06_report_plausibilityWarrant canary disciplinealso read by disclosureP07_warrant_canary
unknown
nothing published · recorded as asserted
Security incident and how it was disclosedalso read by integrityX09_incident_handling
unknown
nothing published · recorded as asserted
A capped sum — the one channel that adds: 0.154 of a possible 0.28, from the fields marked below.
RAM-only diskless serversC02_ram_only
unknown+0.018
nothing published · recorded as asserted
IP allocation modelC03_ip_sharing
unknown+0.012
nothing published · recorded as asserted
Signup without emailC04_signup_no_email
no+0.025
Bkaspersky.com13 Sep 2026
Report a problem with C04_signup_no_emailAnonymous payment optionsC05_payment_anonymous
unknown+0.012
nothing published · recorded as asserted
Own DNS inside the tunnelC06_own_dns_in_tunnel
unknown+0.012
nothing published · recorded as asserted
Worst third-party SDK category in the appC07a_app_sdk
unknown+0.018
nothing published · recorded as asserted
Worst third-party tracker category on the siteC07b_site_trackers
unknown+0.009
nothing published · recorded as asserted
Who owns the hardwareC08_servers_ownership
unknown+0.009
nothing published · recorded as asserted
Weakest protocol still offeredC13_weakest_protocol
not applicable
Bkaspersky.comBkaspersky.com13 Sep 2026
Report a problem with C13_weakest_protocolClient source code publishedV12_client_open_source
unknown+0.018
nothing published · recorded as asserted
Reproducible buildsV13_reproducible_builds
unknown+0.014
nothing published · recorded as asserted
Separate client or infrastructure pentestV14_pentest_exists
unknown+0.007
nothing published · recorded as asserted
What this channel priced on this record:Price 0.15
Who operates the exitC00_architecture
contractor_operated+0.150
Bkaspersky.com13 Sep 2026
Report a problem with C00_architectureWhat the exit does to passing trafficC14_traffic_modification
unknown+0.050
nothing published · recorded as asserted
Server seizure by law enforcementalso read by silenceP01_seizure_event
unknown
nothing published · recorded as asserted
Actual disclosure historyP02_disclosure_history
none_known
Bkaspersky.com2025-12
Report a problem with P02_disclosure_historyCourt record of compelled productionalso read by silenceP03_court_record
unknown
nothing published · recorded as asserted
Warrant canary disciplinealso read by ignoranceP07_warrant_canary
unknown
nothing published · recorded as asserted
Requests received in periodP08_requests_received
34
Bkaspersky.com2025-12
Report a problem with P08_requests_receivedRequests where data was providedP09_data_provided
34
Bkaspersky.com2025-12
Report a problem with P09_data_provided0 years in operation at 0.015 a year under a cap of 0.3, weighted 0.5: the rule did not fire.
Year the service launchedM07_launch_year
unknown
nothing published · recorded as asserted
User base scale (mass >=10M, mid >=1M, niche <1M)also read by integrityM08_user_scale
unknown
nothing published · recorded as asserted
Server seizure by law enforcementalso read by disclosureP01_seizure_event
unknown
nothing published · recorded as asserted
Court record of compelled productionalso read by disclosureP03_court_record
unknown
nothing published · recorded as asserted
Transparency reportalso read by integrity, ignoranceP05_transparency_report
fresh_with_numbers
Bkaspersky.com2025-12
Report a problem with P05_transparency_report