'No critical findings' — Express VPN’s new products get thumbs up from third-party security audit in firm's 27th round of independent review | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

'No critical findings' — Express VPN’s new products get thumbs up from third-party security audit in firm's 27th round of independent review

Express Mail Guard and Identity Defender have just been confirmed as secure

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Express VPN is celebrating the results of a new independent audit carried out by third-party cybersecurity firm Cure 53, bringing its total number of third-party assessments to a whopping 27.

The new audits were completed on two products launched by one of the best VPNs on the market, a few months back: Express Mail Guard — a service that provides limitless email aliases — and Identity Defender, an identity protection app.

Curve 53 gave the green light with no significant vulnerabilities reported. However, it highlighted several areas that required closer attention. More details below.

'No major vulnerabilities' — Mullvad’s Wire Guard implementation gets thumbs up from independent security audit

Express VPN review 2026 – packed with security and notably quick, if at a cost

Malwarebytes just proved its no-logs VPN policy is the real deal

While this was not a clean score-sheet on this occasion, such findings highlight why independent audits are now crucial for any reputable provider wanting to provide a truly secure VPN service for its customers. In this context, an independent audit is not just about a software passing a test the first time, but rather an open commitment to address any architectural issues that may arise.

Express VPN is a veteran when it comes to third-party checks. Since its first audit in 2018, its products have been consistently scrutinized by several renowned firms, including Pw C, Cure 53, and KPMG, securing four ISO certifications, and reflecting a growing commitment to accountability that goes well beyond industry standards.

"Every product we build that touches user data gets handed to independent researchers whose job it is to break it. Twenty-seven audits later, we remain committed to the same standard: trust must be earned, not assumed," said Aaron Engel, CSO at Express VPN — words to live by when we talk about VPNs.

Curve 53 conducted comprehensive source-code reviews and infrastructure assessments of both products — from UIs and email processing functionalities to backend infrastructure, authentication, personally identifiable information (PII), and data storage.

Investigations took place in early March and were carried out for a maximum of 18 days.

In the case of Express VPN Identity Defender, the independent auditor identified eleven areas of concern. Of these, seven were classified as security vulnerabilities of a 'medium' grade; issues that do not cause a major impact on any area within scope.

Two medium-severity issues related to the storage of unencrypted data. In the first case, Express VPN was passing unencrypted data structures to its log and, in doing so, prevented its redacting processes from securing them. In the second, data relating to the user identity was being used for a secondary purpose, thereby inadvertently providing hackers with one potential way to triangulate data about you.

“Not equipped to handle that responsibility”: the VPN industry reacts to Tech Radar's latest research

Exclusive: I asked 10 VPNs for my personal data — only one lived up to our expectations

Google killed its dark web scanner, but Nord VPN’s upgraded tool is here to fill the void

For Express Mail Guard, Cure 53 team identified even more issues — a total of thirteen findings. However, of these, only two were classified as direct security vulnerabilities, and eleven were categorised as more general weaknesses with no direct route to exploitation.

In this case, the sole medium-level exploitable vulnerability is related to the incorrect processing of sender email address data, an issue that could aid a malicious actor in spoofing emails, amongst other things.

Other medium-severity issues included recipient verification emails being sent to wrong addresses — neither a risk in isolation, but potentially useful in conjunction with another vulnerability.

Curve 53 advice included promptly addressing and resolving these findings, undertaking regular tests to identify new risks as they arise, and reporting issues to maintainers when third-party code was involved.

Follow Tech Radar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

Silvia Iacovcich is a tech journalist with over five years of experience in the field, including AI, cybersecurity, and fintech. She has written for various publications focusing on the evolving regulatory landscape of AI, digital behavior, web 3, and blockchain, as well as social media privacy and security regulations.

You must confirm your public display name before commenting

1 Watch out, Apple - Nvidia just unveiled its RTX Spark Arm 'superchip' to take on the M5 at Computex 2026

2 There are no strangers at my front door — but Ring's Familiar Faces feature would be better if it weren't tied to its Pro tier

3MSI Claw 8 EX AI+ with Intel Arc G3 Extreme inside revealed at Computex 2026

4 Nvidia Computex 2026 keynote as it happened: RTX Spark announced to take on Apple, Intel, and Qualcomm

5I put the LG G6 and LG B6 OLED TVs side-by-side, and exploring the nuances of color depth and HDR brightness across the range makes me more certain than the LG C6 is the real star of 2026 — here’s how the flagship and budget OLED tech compares

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards