ExpressVPN is a VPN service operated since 2009 from the British Virgin Islands. Acquired in 2021 by Kape Technologies for 936 million dollars. Kape is owned by Teddy Sagi, an Israeli-Cypriot billionaire whose previous companies include Crossrider, an adware distribution platform identified by malware researchers in the mid-2010s.
What it means in practice
The architecture is technically sound. RAM-only servers, audited no-logs claim (PwC and KPMG audits, multiple), Lightway protocol developed in-house. The problem is not the engineering. The problem is the ownership chain: Kape Technologies also owns CyberGhost, Private Internet Access, ZenMate, plus the review sites VPNMentor and Wizcase that rate them favorably. That structure is a conflict of interest that no audit can wash off. Predaxia does not recommend ExpressVPN. The verdict is editorial, not technical: the product is fine, the corporate context is not consistent with what Predaxia recommends to high-risk operators.
Who uses it, and against whom
Customer base is dominated by mainstream consumers reached through influencer marketing on YouTube, podcasts, and search ads. The adversary set is mostly Netflix geo-blocking, casual ISP tracking, and public-Wi-Fi snooping. For that adversary set, ExpressVPN works as advertised. For the threat models Predaxia covers (journalists protecting sources, lawyers under client privilege, NGO staff in adversarial jurisdictions, divorce clients facing forensic discovery), the recommendation is Mullvad or Proton VPN, not because of price but because of the absence of conflicted ownership and review-site coupling.
What you can change today
If you already pay for ExpressVPN and the threat model is consumer-grade (Netflix, hotel Wi-Fi), there is no urgent need to switch. If the threat model is anything more serious, plan the migration on the next renewal: Mullvad if the priority is anonymous billing and Swedish jurisdiction, Proton VPN if the priority is consolidation with the rest of the Proton suite. Disable ExpressVPN auto-renewal, request a refund within the 30-day window if applicable, and rotate any credentials that were created or recovered while routed through ExpressVPN servers.