Consumer spending habits in cybersecurity are changing shape. New marketplace data from G2A.COM, which serves more than 35 million users across 180 countries, shows antivirus and security software orders climbing 35% year-on-year, growing faster than VPN purchases during the same period. The figures, released to coincide with Cybersecurity Awareness Month, point to a broader reassessment of what digital protection actually means to ordinary users.
A Widening Security Basket
Security software now accounts for 43% of cybersecurity-related orders on the platform, up from 39% a year earlier. VPNs still represent the larger share of the category overall, but the gap is narrowing. Combined orders across all cybersecurity products rose by almost a quarter, suggesting that people are not simply switching between tools but buying more protection overall. That distinction matters: it signals a move away from treating privacy software as a single fix and toward assembling several layers of defense.
For years, VPNs were the entry point for consumers thinking about online privacy, prized for encrypting internet traffic and masking location. Antivirus and endpoint security tools serve a different function, scanning for malware, blocking phishing attempts and monitoring system behavior. The growing appetite for the latter suggests that threats are increasingly understood as hitting devices and accounts directly, not just the connections between them.
Why the Threat Landscape Is Changing Habits
The timing lines up with warnings from European regulators. According to the European Union Agency for Cybersecurity's Threat Landscape 2026 report, ransomware remains the most damaging category of cyber incident in the near term, while social engineering continues to be a dominant method for breaching trust rather than technical defenses. These are attacks that often succeed regardless of whether a connection is encrypted, because they target human decisions: a convincing email, a fraudulent login page, an urgent payment request.
Adrian Podkaminer, Chief Information Security Officer at G2A.COM, frames the shift as a structural one. "What we're seeing is a shift from privacy-first protection towards a more layered approach to cybersecurity," he said. "As people move between more devices, accounts and digital services, effective cybersecurity increasingly depends on different safeguards working together rather than relying on a single solution."
Who Is Responsible for Keeping Shoppers Safe
Buying more security tools does not mean consumers believe the burden rests entirely with them. A separate survey conducted by G2A.COM and Juniper Research, covering 9,000 consumers across nine countries, found that half see e-commerce platforms as mainly responsible for security, while a third point to banks and payment providers. Only one in five consumers places the responsibility chiefly on themselves.
G2A.COM says it treats that expectation as an operational requirement rather than a talking point. The marketplace works exclusively with verified business sellers and applies Know Your Customer, Know Your Business and Anti-Money Laundering checks, backed by AI-based fraud detection and ongoing monitoring of transactions.
Practical Steps for Cybersecurity Awareness Month
Alongside the data, the company is using the awareness campaign to push basic digital hygiene, the kind of habits that cost nothing but are frequently skipped:
- Use strong, unique passwords and enable multi-factor authentication on email, shopping and payment accounts.
- Install operating system, browser and application updates as soon as they become available.
- Treat unexpected login requests, downloads or urgent payment messages with suspicion, and go directly to the official site or app rather than clicking through.
- Understand exactly what a security product covers, how it fits with existing devices, and what its renewal terms involve before purchase.
None of these measures replace software, but they determine whether that software is actually effective. A strong antivirus program cannot compensate for a reused password, and a VPN cannot stop a user from entering credentials into a fraudulent site. The marketplace data suggests consumers are starting to grasp that distinction, buying broader protection not because any single tool failed, but because no single tool was ever enough.