Encryption between two endpoints proves one thing: the segment between them was not read in transit. It proves nothing about the endpoints themselves, the resolver answering their DNS queries, or the operator running the far end.

The gap between those two claims is measurable, and it was measured recently. MVPNalyzer, presented at the NDSS security conference in February 2026 by researchers from the University of Michigan, the University of New Mexico, and IIT Delhi, tested 281 free Android VPN apps carrying 2.4 billion combined installs.

Of those apps, 29 leaked user traffic outside the encrypted tunnel. Twenty-four leaked DNS queries, across roughly 360 million installs. Six leaked full browsing traffic. Four ran tunnels with no encryption at all. Seventy-six transmitted the device advertising ID, and 246, more than 80 percent of the sample, contacted known advertising and tracking servers. Of the 108 apps whose OpenVPN configuration files the team could read, exactly one followed every practice the study checked for. Nearly 20 percent used weak or outdated ciphers.

Those are consumer apps, and a deployed team is not installing them. The finding that transfers is the shape of the failure rather than the sample: in almost every case the tunnel was working. The traffic went around it, or the resolver answered outside it, or the operator logged what passed through it.

For an operational network the useful question is not which provider to trust. It is which segments of the path you own. Rover terminates tunnels on hardware under your control at both ends, resolves DNS inside policy rather than accepting whatever a host carrier hands out, and treats the tunnel as one control among several. Private 5G removes the question for local traffic entirely, because traffic between two users on the same kit never reaches a carrier at all. For traffic that does have to leave, a custom breakout puts the far end of the tunnel on infrastructure you nominate rather than on someone else's.

A team that moves loses connectivity for reasons that have very little to do with signal strength.

On a host-nation carrier, the network operator sees the subscriber identifier, coarse location, and the shape of the traffic, and none of that changes based on what runs above it. Encryption hides content. It does not hide that a cluster of devices arrived in a place at a time and started talking to each other.

Captive portals break tunnels before they can establish, which turns a hotel or airfield network into a choice between no connectivity and connectivity outside policy. Roaming agreements decide coverage in ways no amount of planning controls, and they change without notice. And a single uplink, however good, is a single point of failure that weather or terrain will find eventually.

None of these is fixed by an application. They are fixed by architecture.

Local access on private spectrum keeps traffic between team members off any carrier, which removes the operator from the picture for everything that does not need to leave. Multiple uplinks with automatic failover across fiber, multi-carrier cellular, and LEO satellite mean the path out can fail without the network going with it. An overlay terminating on your own hardware means the traffic that does leave is yours from end to end. Onboard power carries the gap when the site power does not.

That is the argument for a kit rather than a subscription: the parts you control are the parts that keep working.