Nord Security

Nord Security started in 2012 with a single product, NordVPN, and one idea: that ordinary people should be able to lock down their own internet without a security degree. It worked. What began as a Windows config file grew into a suite of eight consumer and business products, roughly 2,000 employees, and a valuation that jumped from $1.6B in 2022 to $3B a year later.

Co-CEOs Tom Okman and Eimantas Sabaliauskas still run the company, which is built out of Vilnius and now sells across more than 20 markets. The bet these days is breadth. NordVPN pays the bills, but the company keeps launching adjacent tools (a password manager, encrypted storage, a business VPN, an eSIM, an identity-theft service) to turn a VPN habit into a whole security relationship.

Nord Security sells digital privacy and security as a family of apps rather than a single tool. For individuals that means encrypting your traffic, managing your passwords, backing up files, and watching the dark web for your leaked data. For businesses it means locking down network access and hunting threats before they land.

The common thread is packaging hard security into something a non-expert can install and forget. NordVPN alone bundles a VPN, a next-gen antivirus, a dark web monitor, and call protection behind one subscription, which is the whole pitch in miniature: buy once, get covered on several fronts.

Most people know they should protect their browsing, passwords, and personal data, and most people never do it because the tools are fragmented and intimidating. Nord's answer is to hide the complexity: state-of-the-art encryption behind a single click, a password vault behind one master password, breach monitoring that just pings you when something leaks.

On the business side the problem is different but related. Remote and hybrid teams broke the old office-network perimeter, so NordLayer and NordStellar aim to give companies secure access and threat visibility without a heavy IT lift.

The core audience is regular internet users who want privacy without homework, and Nord has millions of them worldwide. That consumer base is what NordVPN, NordPass, NordLocker, Saily, and Coveron are built for.

The second audience is businesses, from small teams to larger organizations, served by NordLayer for secure network access and NordStellar for threat exposure management. It is a deliberate two-front strategy: keep the consumer flywheel spinning while growing the stickier, higher-value B2B side.

The portfolio spans consumer and business security, all under the Nord brand. NordVPN is the flagship and the growth engine; the rest fan out from it into passwords, storage, business networking, threat intel, eSIM, and identity protection.

Three of these (NordStellar, Saily, and Coveron) launched in 2024, a sign of how fast Nord keeps widening the suite rather than deepening a single product.

Nord Security runs on subscriptions. Consumers pay a recurring fee for apps like NordVPN, NordPass, NordLocker, and Saily, usually as annual or multi-year plans with tiered bundles, while businesses buy per-seat plans for NordLayer and NordStellar.

The strategy is to widen the wallet: land a customer on the VPN, then cross-sell the password manager, the encrypted cloud, the eSIM. More recently the company has used its balance sheet to grow through M&A, buying Atlas VPN and merging with fellow Lithuanian firm Surfshark. Nord does not publish standard pricing on its corporate site, so exact tiers live on each product's own page.

In VPNs Nord goes up against ExpressVPN, Surfshark (now a merger partner), Proton VPN, and a crowded field of budget rivals. In the adjacent categories it faces password managers like 1Password and LastPass, business VPN and ZTNA players, and encrypted-storage tools.

Nord's edge is that few competitors cover as many bases under one brand. Its risk is the flip side: spreading across eight products means fighting a specialist in every category at once, and the VPN space in particular competes hard on price and trust.

The numbers Nord leans on are scale and independent verification. It serves millions of users across 20-plus markets, and NordVPN has now passed five independent no-logs assurance assessments under the ISAE 3000 standard, run by PwC in 2018 and 2020 and by Deloitte in 2022, 2023, and 2024. For a privacy product, an outside auditor confirming you actually keep no logs is the proof that matters most.

The company also holds hundreds of granted US patents across NordVPN, NordPass, NordLocker, and NordLayer, a reflection of how much of the stack it builds itself.

NordVPN is widely rated among the best consumer VPNs, praised for speed, its large server network, and the all-in-one bundle. TechRadar named it the best VPN for 2026, and independent audits have repeatedly backed its no-logs claim.

The recurring criticism is not about the product but the company behind it. Skeptics on Reddit and elsewhere point to Nord's ties to Lithuania-based operations and its former Panama base, question the marketing, and remember a 2018 server breach that Nord disclosed late. Auto-renewal pricing also draws complaints. No public evidence has substantiated the data-sharing rumors, and the repeated third-party audits are Nord's direct answer to them.

Nord ran without outside money for its first decade. Then in April 2022 it raised $100M in its first-ever external round at a $1.6B valuation, becoming Lithuania's second tech unicorn. Just over a year later, in September 2023, Warburg Pincus led another $100M round that doubled the valuation to $3B.

The stated plan for the new capital is more of the same growth playbook: expand the product suite and pursue acquisitions. Novator and Burda Principal Investments joined as backers, and the raise sits on top of the earlier Atlas VPN buy and the Surfshark merger.

Nord's direction is clear: keep widening the suite, push harder into business security with NordLayer and NordStellar, and use its $3B war chest for acquisitions. The 2024 launches and the Acronis and Surfshark tie-ups all point the same way, toward a one-stop cybersecurity brand.

The open question is focus. Running eight products means competing with a specialist in every lane, and in the VPN market that means constant pressure on price and trust. Nord's answer so far is scale plus repeated independent audits, which is a reasonable hedge as long as the consumer flywheel keeps funding the rest.

Nord frames itself around four values (self-movers, team players, future shapers, restless achievers) that add up to an ownership-driven, do-it-without-being-asked culture. It employs around 2,000 people, heavily concentrated in engineering, and is one of Lithuania's flagship tech employers with a 4.4/5 Glassdoor rating.

Day to day the setup is hybrid, three office days and two from home, with a "work from anywhere" option for a change of scenery. The engineering org has leaned hard into AI-native product development lately, with teams like Saily expecting engineers to own problems end to end and use coding agents as a multiplier. Perks run generous: private health insurance, free psychologist consultations and wellness apps, 24/7 gym access, extra time off, and a company-wide "workation" getaway.

Because Nord hires mainly in Lithuania and Poland, its posted pay comes in monthly EUR and PLN bands rather than annual US-style salaries. Engineering is where most disclosed roles cluster, running roughly 2,000 to 8,600 EUR per month in Lithuania and 5,000 to 39,100 PLN per month in Poland, with the wide top ends reflecting senior and specialist positions.

Product, design, marketing, sales, and G&A roles disclose narrower bands. Pay scales by seniority and location, and the numbers here are base compensation.

Nord Security operates through Lithuanian entities (Nord Security UAB, also referenced as Nordsec Ltd), with development and support run out of Vilnius. Product-specific data controllers sit under the group, such as UAB 360 IT at Švitrigailos str. 36, Vilnius, which handles data for the referral program.

The company makes a point of its privacy posture: NordVPN's no-logs claim has been independently verified five times under ISAE 3000, and Nord publishes a subprocessor list and standard privacy and terms documents. The dual structure, separating data flows from corporate oversight, is deliberate for a privacy business, though it is also the thing critics scrutinize most.

Recent coverage tracks Nord's push into partnerships and its steady drumbeat of product and trust announcements. In 2026 it announced a partnership with Acronis to unite network and endpoint security for MSPs, launched a NordLayer Browser for SMBs, and paired NordVPN with Internews to protect journalists and at-risk communities.

Earlier milestones include the September 2023 Warburg Pincus round at a $3B valuation and NordVPN's fifth Deloitte no-logs verification.