SiliconRepublic.com stopped off in Kilkenny for Cyber Ireland National Conference 2026, where we talked to a number of attendees from across the industry.

On Tuesday (22 September), Cyber Ireland held its fifth annual national cybersecurity conference to explore the most important trends and updates within the contemporary cyber sector.

The Cyber Ireland National Conference (CINC) 2026 saw a variety of cybersecurity professionals and leaders gather at the Lyrath Estate in Kilkenny to discuss and examine topics such as the global cyberthreat landscape, cyber innovation, the development of a cyber-ready workforce and emerging security risks associated with AI.

SMEs, multinationals and individual experts alike all gathered at the event, which was sponsored by organisations such as Enterprise Ireland, TrendAI, Integrity360, IDA Ireland, Munster Technological University, Intel and Centripetal, among many more. Ireland’s National Cyber Security Centre (NCSC) and KPMG were headline sponsors of the event.

As well as featuring a number of keynotes and panel discussions, a key goal of the event was to facilitate expertise and knowledge exchange among the attendees.

This kind of engagement was particularly noted by Loman McCaffrey, Integrity360’s director of business development for Ireland, when speaking to SiliconRepublic.com at the conference.

“Everyone is engaged, everyone seems to have come with some challenges in mind,” he said.

“People use [CINC] as their one outing of the year to gather some information, to come back to the team, their boss, to the board with ‘here’s the direction of travel we need to be on’. Some events are a little bit more ‘a day out from the office’ – this isn’t that.

“This is people coming to do their research, figure out what others are doing.”

Small state, important position

The theme for this year’s conference was ‘Realising Ireland’s Cyber Industry Potential’, with a number of talks focused on Ireland’s importance in the European space, and how the country can scale its cyber resilience and capabilities to become a global player in the domain.

For Ian Fahey, managing director at KPMG, the scene was set for this year’s CINC by NCSC director Richard Browne in his opening keynote, ‘Cybersecurity State of the Nation Address’, where he “introduced Ireland as a small state on the edge of Europe, who is also leading the overall security capability for the European state”.

“We’re hosting vast amounts of data, we’re hosting and managing the fibre interconnectors between Ireland and mainland Europe and the US,” said Fahey.

“Lots of key critical infrastructure items are being hosted or driven out of Ireland and that brings a certain responsibility, and I think Ireland as a nation is stepping up to that.”

The conference took place at a vital time, with Ireland currently in the middle of hosting its EU Presidency – which also brings heightened cyber risk with it.

Eoin Byrne, cluster manager at Cyber Ireland, noted that it’s become clear through the Presidency that Ireland has a “very strong seat at the table” in Europe.

However, he emphasised that the country also has a “critical role to play in securing Europe’s digital economy” due to factors such as hosting numerous multinational tech and pharma companies, the transatlantic data cables running through our waters, and hosting an estimated 30pc of the EU’s data.

Fahey echoed the important role Ireland plays in EU digital resilience, stating that it brings “different pressures” but also “an imaginative mindset”, noting that some of the vendors at CINC were on “the leading edge” of tech solutions.

“That’s kind of positioned us to be a real strength and a real leader in terms of cybersecurity,” he said. “[The EU Presidency] has obviously brought a different focus to Ireland. The threat landscape changes, it naturally follows the Presidency of the EU.

“Ireland as a whole has held up really well, and what it has really reinforced is that the cyberthreat landscape is borderless and our response … also has to be borderless.”

‘Get the basics right’

With the topic of cyber resilience, especially in an Irish context, top of mind at CINC 2026, we asked a number of attendees about what Irish businesses need to do to stay secure in the ever-evolving threat landscape.

Eadaoin McArthur, a Cortex and cloud specialist at Palo Alto Networks, pointed to staff education as key to staying secure.

McArthur said that businesses can bolster their defences by “ensuring that their staff are moving at the speed that the threat landscape is evolving, and ensuring that organisations have the incentives and mandates in place and that they’re addressing them in a timely manner”.

She added: “Most organisations going forward will be forced to have an AI mandate to ensure that their organisations are capable to protect against the speed and velocity at which cyberattacks are occurring.”

Fahey emphasised that the most important step for Irish organisations is to “get the basics right”.

“Sort out your basic cyber hygiene before you start addressing all of these really sophisticated attacks,” he advised.

Fiona Griffin, a solutions engineer at TrendAI, agreed, and also added that Irish organisations need to keep an eye on AI.

“Getting the basics right – hygiene, patching – but also really just being aware of AI out there,” said Griffin. “Taking it seriously, making sure you’re compliant, making sure that you’re aware of the latest threats that are out there, and what’s Ireland doing in terms of compliance.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

• Householders are getting free hot water from Heata, a company that installs rented servers in homes
• Heat generated by the servers is passed to the water supply for showers and hot taps
• Heata pays for any additional electricity used, ensuring homeowners win and businesses have their data stored safely

What happens to waste heat from servers? In a server room or data center, the heat is removed through industrial cooling systems and exhausted. But what if it could be reused? What if that heat could be used to keep domestic heating bills down?

Heata is one of several companies across the UK and Europe delivering solutions to server space and heating costs. Domestic waste-heat use appears to be a growing industry, and offers homeowners the chance to cut bills significantly while giving businesses low-cost server space.

When a VPN disconnects, traffic may either stop or fall back to your normal internet connection. A working kill switch is designed to block that fallback, while a fail-open setup may let new traffic use your ordinary network route and public IP address.

What Happens the Moment the VPN Tunnel Drops

A VPN normally gives selected network traffic a route through an encrypted tunnel to a VPN server. When that tunnel disappears, the operating system and VPN software have to determine what should happen to traffic that would normally use it.

One possible outcome is fail open. This means ordinary networking is permitted again. New connections may use the device’s Wi-Fi, Ethernet, or mobile connection directly, just as they would if the VPN were not active. Websites reached through those new connections may then receive the public IP address associated with your normal internet connection rather than the VPN server.

The opposite behavior is fail closed. Instead of allowing protected traffic to fall back to the normal route, the device blocks it until the VPN connection returns or the blocking policy is deliberately disabled.

Suppose a laptop is connected to home Wi-Fi and its browser traffic is leaving through a VPN server. If the VPN tunnel fails, a fail-open configuration may let the browser establish its next connection directly through the internet service provider. With fail-closed protection, that new connection should fail rather than silently bypass the tunnel.

The behavior of an existing connection can be less predictable. Applications may retry requests, create a new connection, wait for the VPN to return, or time out. The practical privacy question is therefore whether traffic that was supposed to remain protected can establish a usable path outside the VPN after the tunnel is lost.

What a VPN Kill Switch Actually Does

A kill switch does not keep the VPN tunnel alive. Its job is to restrict networking when that tunnel is unavailable.

Mozilla describes its implementation as blocking the device’s network connection if Mozilla VPN becomes unstable or drops, with the aim of preventing the local IP address from being exposed. Mozilla’s kill-switch documentation is one example of fail-closed behavior implemented by a VPN application.

The enforcement can also come from the operating system. Android supports an Always-on VPN setting and a separate Block connections without VPN control. When configured together, Android can prevent connections that do not use the selected VPN.

Automatic reconnection is related but different. A reconnect feature tries to restore the VPN tunnel. A kill switch determines what traffic is permitted while that tunnel is missing. A VPN product can implement both, one, or neither depending on the platform and configuration.

Standard Kill Switch vs Persistent Blocking

“Kill switch” does not describe one universal policy. Some implementations respond primarily to an unexpected VPN failure, while others enforce a VPN-required state even after a deliberate disconnect or restart.

Proton VPN, for example, currently distinguishes a standard mode from an advanced mode. Its standard kill switch is designed to activate when the VPN connection drops unexpectedly, while its advanced kill switch prevents internet access whenever Proton VPN is not connected and can remain active across restarts on supported platforms. These are Proton-specific implementation details, not universal VPN terminology.

The table below shows the conceptual distinction. Exact behavior still depends on the VPN application, operating system, and policy configuration.

This distinction is why pressing a VPN application’s Disconnect button is not always a valid test of an ordinary kill switch. Some products intentionally interpret a manual disconnect as permission to resume normal networking.

A VPN Disconnect Is Not the Only Kind of Leak

A complete tunnel failure is only one way traffic can end up somewhere you did not intend. A VPN may appear connected while a particular protocol, resolver, application, or address family follows a different path.

Public IP exposure after fallback

If the VPN tunnel disappears and ordinary routing resumes, a new connection can leave through the underlying internet connection. The remote service may then see the public IP address assigned to that normal route.

This is the failure people commonly mean when they say a kill switch prevented an “IP leak.” More precisely, traffic that was expected to remain protected obtained an ordinary route after the VPN stopped carrying it.

DNS leakage

The Domain Name System, or DNS, translates names such as example.com into network addresses. A DNS leak occurs when queries that were intended to follow the VPN’s protected DNS path instead use another resolver or network path outside that intended configuration.

Not every DNS server different from the VPN provider’s own resolver is automatically evidence of a leak. Some users deliberately configure another encrypted or third-party DNS service. The useful comparison is between the DNS path you intended and the one the device actually uses.

IPv6 bypass

Many networks support both Internet Protocol version 4, or IPv4, and Internet Protocol version 6, or IPv6. That dual-stack design can expose a routing mismatch if VPN software protects one address family but fails to apply the intended policy to the other.

The IETF’s RFC 7359 analysis of dual-stack VPN leakage describes traffic intended for a tunnel escaping through an unprotected IPv6 path when VPN software fails to handle IPv6 correctly. The document dates from 2014, so it should not be treated as evidence that current VPN applications generally have this defect.

The RFC’s IESG note also cautions that the broader leakage problem is not unique to IPv6. Similar exposure can arise whenever policy permits another unencrypted interface or route, including some split-tunnel configurations.

Browser and WebRTC address exposure

Browser networking creates a separate category of address information. Web Real-Time Communication, or WebRTC, uses Interactive Connectivity Establishment, or ICE, candidates when discovering possible paths for peer-to-peer communication.

MDN documents that an ICE candidate can contain the IP address associated with that candidate’s source. Whether the address revealed is relevant to your VPN privacy model depends on the browser, candidate type, VPN implementation, and network configuration. The presence of WebRTC address information does not by itself prove that the entire VPN tunnel failed.

These failure modes are related enough to examine together, but they should not be collapsed into one diagnosis. IP, DNS, IPv6, and WebRTC leaks have different causes and require different verification methods.

Split Tunneling Changes What “Leak” Means

Traffic outside the VPN is not necessarily leaking if you deliberately configured it to stay outside.

Split tunneling means only selected applications or destinations use the VPN while other traffic follows the device’s normal network path. Android’s per-app VPN controls, for example, can restrict VPN use to an allowed set of applications or deliberately exclude applications from it.

Imagine that a browser is configured to use the VPN but a game launcher is intentionally excluded. Seeing the normal public IP from the game launcher may be expected split-tunnel behavior. Seeing that same fallback from the protected browser after the tunnel fails would be a different result.

This is why a leak test should start by establishing what was supposed to be inside the tunnel. Without that baseline, expected exclusions can be mistaken for failures.

Kill switches and split tunneling can also interact differently across products. Proton documents that the combination is unsupported on most of its platforms, while its Windows app can use kill-switch protection with split tunneling so protected applications remain blocked if the VPN disconnects. Proton’s split-tunneling documentation illustrates why this behavior must be checked on the exact product and platform rather than assumed universally.

Troubleshooting Kill-Switch and Reconnect Problems

The symptom usually indicates whether to investigate the kill-switch policy, the VPN connection itself, split tunneling, or the underlying network.

Platform Differences That Matter

Android

Android provides several VPN controls at the operating-system level. Google’s current documentation says Android 7.0 and later can use Always-on VPN, and compatible configurations can enable Block connections without VPN. That combination can create fail-closed behavior without relying solely on an application’s own interface.

Android also supports per-app VPN rules. If applications are placed on an allowed list, only those applications use the VPN. Other applications can use normal system networking unless non-VPN connections are also blocked. With blocking enabled, applications outside the permitted VPN set can instead lose network access. The interaction is configuration-dependent, so observing one application’s behavior does not necessarily describe the whole device.

Apple devices

Apple supports several distinct VPN deployment models, including VPN On Demand, per-app VPN, and managed Always On VPN. They should not be treated as interchangeable names for one consumer kill-switch feature.

For managed Always On VPN configurations, Apple documents that all IP traffic can be tunneled through the organization’s VPN infrastructure and that all IP traffic is dropped when the required Always On VPN tunnels are not up. This is a strong example of operating-system-enforced fail-closed behavior, but it does not establish that every third-party consumer VPN application on an Apple device behaves the same way.

Apple separately documents VPN On Demand, per-app VPN, and managed Always On VPN as different deployment mechanisms. Those distinctions matter when comparing application behavior with organization-managed traffic enforcement.

Desktop VPN applications

Desktop VPN clients can implement blocking in different ways. Some rely on operating-system filtering or firewall facilities, while others use routing or interface mechanisms.

As a vendor-specific example, Proton documents persistent Windows Filtering Platform rules for its advanced Windows kill switch and a dummy network interface for its Linux GUI implementation. Those mechanisms illustrate implementation variety; they should not be generalized to unrelated Windows or Linux VPN clients.

The larger distinction between Always-On VPN and a kill switch is whether the system is trying to maintain a required VPN state, block traffic when that state is unavailable, or do both.

Bottom Line

What happens after a VPN disconnects depends less on the word “VPN” than on the policy that follows the failure. A fail-open configuration can permit subsequent traffic to use the normal network path, while fail-closed enforcement blocks affected traffic until VPN protection returns.

A kill switch is therefore a traffic-control feature, not a guarantee that the VPN will never fail. Split tunneling, DNS routing, IPv6 handling, browser networking, and platform-specific rules can create separate exposure paths even when the main tunnel appears healthy. The reliable approach is to understand what should be protected, verify that behavior with harmless traffic, and interpret the result against the exact VPN and operating-system configuration in use.