In a strategic move to bolster its privacy credentials, Malwarebytes has announced the completion of its inaugural independent security audit for the AzireVPN infrastructure, conducted by X41 D-Sec, a respected security audit provider. This development follows Malwarebytes's acquisition of AzireVPN in 2024, aimed at integrating specialized privacy features into its VPN services. The thorough evaluation affirmed Malwarebytes' adherence to rigorous no-logs policies, crucial for maintaining user trust in an often opaque industry.
In an industry characterized by unverified trust, Malwarebytes has taken the step of subjecting its complete source code, server configurations, and internal processes to external examination. This audit underscores Malwarebytes' commitment to transparency and security, as stated by Marcin Kleczynski, CEO and Founder of Malwarebytes, who emphasized the importance of evidence-based trust over mere promises.
Setting High Privacy and Security Standards
Kleczynski noted, “Trust shouldn't be a leap of faith; it should be an informed choice based on evidence. By completing this audit, we are moving beyond promises and providing our users with objective proof that their data is handled with the highest privacy and security standards.” He further suggested that if a VPN provider cannot provide similar transparency, its trustworthiness should be questioned.
The audit's two-month duration involved a comprehensive white-box penetration testing approach, enabling X41 D-Sec to thoroughly assess the software and hardware deployed by Malwarebytes to run its VPN services. This methodology ensured auditors had unrestricted access to key components, including:
- Core applications for Windows, macOS, Android, and iOS.
- Server infrastructure configuration across Malwarebytes’ extensive global VPN network.
- Privacy architecture, affirming no identifiable user metadata is stored or accessible.
Key Audit Results
Although some vulnerabilities were discovered, most have been rectified, including a critical issue
The audit reaffirmed Malwarebytes’ zero-logs policy, as auditors found no evidence of user data logging, such as IP addresses or browsing history. X41 D-Sec stated, “During our assessment, we did not observe evidence of user activity logging, and access to systems is tightly controlled, with no unnecessary remote, local, or SSH access exposed.”
The report concluded that Malwarebytes's systems are on a strong security level relative to similar platforms, with findings rapidly addressed in collaboration with the X41 team. Although some vulnerabilities were discovered, most have been rectified, including a critical issue, with Malwarebytes actively resolving remaining concerns.
Commitment to Transparency and User Security
Jérôme Boursier, Principal Research Engineer at Malwarebytes, affirmed, “This thorough security audit provides the level of transparency any VPN provider and privacy company should aim for. Combining a software audit with hardware penetration testing is invaluable. It gives our users a clear understanding of how we operate and how we stand apart from competitors. These results reinforce our commitment to security and will guide us in setting a higher standard for our users.”
Malwarebytes Privacy VPN, marketed as an ultra-private solution, offers robust protection and unrestricted internet access globally. New server locations in Jakarta and Johannesburg, along with features like RAM-only servers and an independently verified no-logs policy, further strengthen its market position. The ongoing transparency reports and Warrant Canary add additional layers of accountability and user assurance.
Malwarebytes, a global pioneer in online protection, announced the completion of its first independent third-party security audit of the AzireVPN infrastructure. Malwarebytes acquired AzireVPN in 2024 to bring its bespoke privacy features to its VPN solution and now leverages the AzireVPN infrastructure. The comprehensive assessment, conducted by renowned security audit provider X41 D-Sec, validates the integrity of Malwarebytes infrastructure and its strict adherence to its no-logs policy.
In an industry where trust is often requested but rarely verified, Malwarebytes made the strategic decision to open its entire source code, server configurations, and internal processes to external scrutiny.
Highest privacy and security standards
“Trust shouldn't be a leap of faith; it should be an informed choice based on evidence,” said Marcin Kleczynski, Founder and CEO, Malwarebytes.
“By completing this audit, we are moving beyond promises and providing our users with objective proof that their data is handled with the highest privacy and security standards. If a VPN provider can’t offer that level of transparency through an independent audit, it’s worth questioning whether it should be trusted at all. We hope this helps people make better decisions about who they trust with their internet traffic and activity.”
Identifiable user metadata
The audit was conducted by X41 D-Sec over a period of two months and employed a white-box penetration testing methodology to review the software and hardware Malwarebytes developed and deployed to operate its VPN service. This provided the auditors with full access to:
- Core applications: Source code for Windows/macOS/Android/iOS apps.
- Server infrastructure: A deep dive into the configuration of Malwarebytes’s global VPN node network.
- Privacy architecture: Verification of the "no-logs" systems to ensure no identifiable user metadata is stored or accessible.
Key Findings
Zero-logs verification: Auditors confirmed that the technical architecture is consistent with Malwarebytes’s privacy policy, finding no evidence of logging user IP addresses, browsing history, or DNS queries. X41 noted, “During our assessment, we did not observe evidence of user activity logging, and access to systems is tightly controlled, with no unnecessary remote, local, or SSH access exposed.”
- Good security level: The final report concluded that the Malwarebytes “systems appear to be on a good security level compared to systems of similar size and complexity.”
- Swift response to findings: Malwarebytes worked with the X41 team to quickly inspect and address findings. X41 shared, “While vulnerabilities were identified; most have already been addressed, including one critical issue, with remaining items in the process of being resolved."
“This thorough security audit provides the level of transparency any VPN provider and privacy company should aim for,” said Jérôme Boursier, Principal Research Engineer and privacy advocate at Malwarebytes. “Combining a software audit with hardware penetration testing is invaluable. It gives our users a clear understanding of how we operate and how we stand apart from competitors. These results reinforce our commitment to security and will guide us in setting a higher standard for our users.”
Malwarebytes privacy VPN
Malwarebytes Privacy VPN is an ultra-fast, ultra-private VPN service designed to protect user privacy and provide secure, unrestricted internet access. With servers worldwide, Privacy VPN lets users access the internet safely and without geographic limits, just as if they were using it in another country.
Key features include:
- RAM-only, diskless servers
- Independently verified no-logs policy and Blind Operator Mode
- Full infrastructure control
- Ongoing transparency reports and Warrant Canary
- New server locations including Jakarta, Indonesia, and Johannesburg, South Africa
- Part of holistic dashboard across desktop and mobile
