A study has found that consumers and businesses using separate virtual private networks (VPNs) and password managers are at greater risk of attacks targeting their credentials, exposing them to financial loss and data theft.
Research by Ontario Tech University, Pure Square, and CQR Cybersecurity, conducted for PureVPN, highlights that the fragmentation of security tools-when individuals use password managers and VPNs from different vendors-has created a security gap previously unrecognised by the public.
Fragmentation risk
The report, entitled "The Cost of Fragmentation: Measuring Time, Spend and Risk in Personal Cybersecurity Tool Stacks", says that security tool fragmentation allows threat actors to take advantage of alert fatigue, resulting in stolen credentials being offered for sale on the Dark Web.
The study found that the average person now manages 3.4 separate security apps, spends up to 27 hours each year maintaining them, and incurs between $574 and $850 annually on redundant subscriptions and unmanaged risks. Redundant subscriptions account for nearly a quarter (24%) of annual security tool costs for each individual.
Findings also show that 44% of users receive overlapping alerts from different apps, and 38% of those report that they routinely ignore these alerts. Researchers observed that up to 34% of people either leave security tools disabled or fail to use paid features at all.
The phenomenon of alert fatigue-the overwhelming flow of notifications from multiple apps-was especially notable during the 2025 Google breach which affected 2.5 billion Gmail accounts. As a result, individuals inundated online forums and search engines with urgent queries while attempting to respond to notifications across numerous apps.
"Fragmentation doesn't just waste money, it leaves people vulnerable when breaches strike," said Ifrah Arif, Product Manager at PureVPN. "Unification is the missing layer. Choosing an app that integrates essential password management and VPN protections within a single secure app can sharply reduce this alert chaos - which can easily overwhelm all but the most tech-savvy consumers."
Consequences of fragmentation
The researchers' analysis of over 1.5 million breaches shows that nearly 38% of attacks exploit stolen credentials and exposed connections that can arise from the use of fragmented security tools. These multi-surface attacks cost an estimated $400 million in losses each year. Personal pre-breach costs for consumers-described as a "chaos tax"-can exceed $850 per year per person as a result of duplicated subscriptions and unmanaged risks.
The study notes that missed and ignored alerts are making fragmented apps gateways for attackers, with the actual risk to individuals increasing as compromised credentials continue to circulate and be abused on illicit internet marketplaces.
Unified approach
In response to these findings, PureVPN has developed an integrated security platform combining VPN, Password Manager, Dark Web Monitoring, Tracker & Ad Blocker, and Data Removal functions in a single app. The intention, according to the company, is to consolidate alert streams, reduce false alarms, and simplify breach-response workflows.
PureVPN asserts that combining these tools in a single application strengthens each individual component while reducing user burden. For example, credential autofill through the Password Manager is carried out via an encrypted VPN tunnel, Data Removal erases personal identifiers from data brokers, and Dark Web Monitoring continues to check for leaked credentials across hidden web forums and dumps. The unified platform also aims to lessen the risk of alert fatigue by prioritising and streamlining notifications.
Ali Khan, Head of Product at PureVPN, commented:
"Security isn't about how many tools you have, it's about how well they work together when it matters. PureVPN's security suite is designed around that reality: one app, complete protection, no wasted motion."
With the updated app available for both Android and iOS devices, PureVPN states that its security suite allows consumers to replace overlapping subscriptions with a single source for managing online privacy and security.
