Aircove’s security posture is validated in 2nd audit by Cure53

As we developed Aircove, the VPN industry’s first hardware product, we placed an uncompromising focus on user privacy. 

One way we’ve made Aircove stand out is by taking the extra step of validating our security claims through independent audits. In fact, ExpressVPN Aircove is the only consumer router that is independently audited for security. 

The resulting audit reports help us improve our product as well as validate our security claims to users, providing a high degree of transparency while setting a new security standard for consumer routers.

Aircove’s second audit: findings

With the rollout of AircoveOS v5, we’re pleased to share the results of our second comprehensive security audit of Aircove. This latest assessment was completed in November 2024 by cybersecurity firm Cure53, with fixes further reviewed in February 2025.

This thorough evaluation included penetration testing and a complete source code audit of AircoveOS v5, which offers significant new features. Cure53 identified only a small number of low-risk findings and no high or critical security issues.

Of the eight findings identified, the majority were hardening recommendations or minor issues. Cure53 reported that “none of the detected flaws exceeded an impact score of Medium, indicating close adherence to secure development principles.” The report further states that the low number of issues identified reflect “favorably on the Aircove’s security performance.”

The report concluded that the “Aircove router received an admirable final verdict.”

Identified issues have already been addressed and verified again by our security team, save for a fix to one low-risk finding scheduled for an upcoming release. Read the full audit report.

What’s new in AircoveOS v5

This version of AircoveOS is a major release, offering upgrades that make going online more enjoyable and more secure for your whole family:

• Faster VPN speeds. Speeds in v5 reach up to seven times faster than older VPN-compatible routers and almost double the speeds that AiroveOS v4 achieved.
• Guest Wi-Fi to isolate untrusted devices. A new guest Wi-Fi device group option prevents devices from communicating with any other device on the network, lowering the risks to your household.
• ML-KEM for post-quantum security. Our engineers have upgraded our pioneering Lightway VPN protocol to using ML-KEM, the newly finalized NIST standard for post-quantum encryption. Lightway has also been rewritten in Rust programming language.

Read about these updates in detail.

Aircove and our Aircove Go portable router makes it easy to protect what matters most—your home and devices on the go. Both routers are available for purchase on Amazon and the ExpressVPN Store. Note: An active ExpressVPN subscription is required to use Aircove’s VPN functionality.