Consumers are rethinking how they protect themselves online, and the shift shows up clearly in purchasing habits. G2A.COM, a digital marketplace serving more than 35 million users across 180 countries, has reported a 35% year-on-year increase in antivirus and security software orders, a pace that has now overtaken growth in VPN purchases. The figures, released during Cybersecurity Awareness Month, point to a broader change in how people think about digital safety.
A Shift From Privacy Alone to Layered Defense
According to the marketplace data, security software accounted for 43% of all cybersecurity-related orders in the period, up from 39% a year earlier. Overall orders across cybersecurity products rose by almost a quarter. VPNs still represent the larger of the two categories, but their share of the market is narrowing as antivirus and endpoint protection tools gain ground.
For much of the past decade, VPNs dominated consumer conversations about online safety, largely framed around privacy: masking an IP address, encrypting a connection, or getting around regional restrictions. Antivirus software, by contrast, has long been associated with a narrower task - catching malware before it causes damage. The new data suggests that distinction is blurring. Buyers increasingly want protection that covers devices, accounts and activity together, rather than a single layer addressing one type of risk.
“What we’re seeing is a shift from privacy-first protection towards a more layered approach to cybersecurity,” said Adrian Podkaminer, Chief Information Security Officer at G2A.COM. “As people move between more devices, accounts and digital services, effective cybersecurity increasingly depends on different safeguards working together rather than relying on a single solution.”
Threats Are Changing Faster Than Habits
The timing lines up with warnings from European regulators. The EU Agency for Cybersecurity’s Threat Landscape 2026 report identifies ransomware as the most damaging type of cyber incident in the short term, while social engineering - attacks that exploit human trust rather than software flaws - remains widespread. Phishing emails, fake login pages and urgent payment requests all fall into this category, and no VPN, however well configured, can block a user from willingly handing over a password to a convincing fake website. That gap helps explain the growing appetite for dedicated security software that can flag malicious downloads, suspicious links and compromised accounts directly.
Who Is Responsible for Keeping Shoppers Safe?
G2A.COM’s data also touches on a question that extends beyond its own platform: who should bear responsibility for online security? A separate survey conducted with Juniper Research, covering 9,000 consumers across nine countries, found that half believe e-commerce sites carry the main responsibility for keeping transactions secure. About a third pointed to banks and payment providers, while only one in five said the responsibility rests with consumers themselves.
That expectation places pressure on marketplaces to build in safeguards rather than leave protection entirely to the buyer. G2A.COM says it works exclusively with verified business sellers and applies Know Your Customer, Know Your Business and Anti-Money Laundering checks, backed by AI-based fraud detection and ongoing monitoring of transactions.
Practical Steps for Cybersecurity Awareness Month
Alongside the data, the marketplace is using the awareness campaign to encourage habits that complement any software purchase:
- Use strong, unique passwords and enable multi-factor authentication on email, shopping and payment accounts.
- Install operating system, browser and application updates as soon as they become available.
- Treat unexpected login prompts, downloads or urgent payment messages with caution, and go directly to the official website or app rather than clicking embedded links.
- Check exactly what a security product covers, whether it works with existing devices, and what its renewal terms involve before buying.
The broader lesson from the figures is that no single tool offers complete protection. A VPN encrypts a connection and can obscure location data, but it does nothing to stop malware already on a device or a convincing scam email. Antivirus software catches malicious code but has no bearing on network-level privacy. The growing preference for layered protection reflects a more realistic understanding of what digital threats actually look like in 2025 - less about one dramatic breach, and more about dozens of small vulnerabilities across accounts, devices and everyday online habits.
