Nord Security
Maker of NordVPN, NordPass, and NordLayer, a bootstrapped consumer-to-enterprise security suite.
On the record
Checkpoint: NordLayer SOC 2 Type II report completion and ongoing US auto-renewal class-action suits move toward settlement
The call
Nord Security stays profitable and widely used while its consumer VPN core faces slow erosion from free OS-level privacy tools and its enterprise arm is still new.
Nord Security sells VPN apps, password managers, and cybersecurity tools to 20 million regular people and is now pushing into business software. The hard part: Apple, Google, and Microsoft keep adding free privacy features directly into their phones, computers, and browsers, so Nord's consumer products are slowly becoming less special. The company stays profitable by charging subscriptions and recently started selling to companies, but that business is brand new and small. One thing that could hurt Nord is a growing stack of lawsuits about its auto-renewal billing practices in the US, which might force the company to make signing up harder and cheaper, shrinking the profits that keep it afloat.
Why
01
AI pressure: Apple/Google/Microsoft AI-native credential and privacy agents built into OS and browser. If OS-level AI agents handle passwords and private browsing by default, standalone apps like NordPass and NordVPN become optional add-ons. Could AI do the core job? Only partly.
02
Bigger players: Apple (iCloud Private Relay), Google (One VPN), Microsoft. Apple and Google already ship free, built-in VPN and privacy tools that cover casual users' basic needs without a separate subscription. Could a giant copy it? Yes, easily.
03
What protects it. Decade of profitability, 20M+ users, audited no-logs claims, and owned distribution let it outspend rivals on trust and marketing.
What would change this call
A US court approves a settlement in the Sasgen, Schnappinger, Tio, or Hanscom auto-renewal billing suits. Forced billing UX changes could reset the conversion economics behind 90% of revenue.
NordLayer publishes or leaks an ARR figure or enterprise customer count by mid-2027. Shows whether the enterprise pivot is gaining real scale as a hedge against consumer plateau.
Apple or Google expands Private Relay or One VPN to more device tiers or regions. Signals deeper OS-native substitution pressure on NordVPN's core consumer base.
NordLayer publishes or leaks an ARR figure or enterprise customer count by mid-2027. Shows whether the enterprise pivot is gaining real scale as a hedge against consumer plateau.
Apple or Google expands Private Relay or One VPN to more device tiers or regions. Signals deeper OS-native substitution pressure on NordVPN's core consumer base.
Key numbers
- Over 90% of revenue came from consumer (B2C) sales
- US made up about 50% of sales, Europe 30-40%
- NordLayer had 9,000+ business customers in 118 countries
Named risks
- Four or more US auto-renewal billing class actions (2024-2026) could force UX and pricing changes to 90%+ of revenue.
- OS and browser-native privacy defaults (Apple, Google) gradually eroding standalone consumer VPN category.
- Enterprise pivot via NordLayer remains unproven at scale months after SOC 2 certification (Jul 2026).
- Valuation stuck at $3B since September 2023 signals stalled growth narrative for potential IPO.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| ExpressVPN | contesting | Gizmodo (Jul 2026) rates ExpressVPN Best Overall, NordVPN Best for Streaming amid quality convergence |
| Surfshark | contesting | Sister brand under common holding structure since 2022, rated Best Value by Gizmodo Jul 2026 |
| Apple and Google OS-native privacy | gaining on | iCloud Private Relay erodes standalone VPN demand; Google killed its own paid VPN Jun 2024 |
| CrowdStrike | contesting | Jan 2026 partnership turned prior competitor into SMB distribution ally |
| 1Password and Bitwarden | gaining on | AI-agent credential management threatens NordPass over time per 2026 analysis |
Questions people ask
- Is Nord Security profitable in 2026?
- Nord Security bootstrapped for a decade with zero outside capital until April 2022, and its own CFO said the company had already surpassed $100M in revenue before that first raise, implying sustained profitability; no audited P&L has been published since, as the firm remains private as of July 2026.
- Who owns Nord Security?
- Founders Tomas Okmanas and Eimantas Sabaliauskas retain control; outside investors Warburg Pincus, Novator Ventures, and Burda Principal Investments hold minority stakes after a $100M Series B in September 2023 valued the company at $3B, unchanged through July 2026.
- Could AI replace NordVPN or NordPass?
- Core VPN tunneling and encryption remain infrastructure AI cannot substitute, but AI-driven OS and browser privacy defaults, plus agentic credential managers, threaten to absorb standalone tools like NordPass over time, a risk the company is hedging via its founders' separate nexos.ai venture launched January 2025.
- Who is Nord Security's biggest competitor?
- In consumer VPN, Gizmodo's July 2026 review found NordVPN, ExpressVPN, and sister brand Surfshark have converged in quality, with ExpressVPN rated Best Overall and NordVPN Best for Streaming; in enterprise security, CrowdStrike became a partner rather than rival via a January 2026 deal.
- Is Nord Security facing lawsuits?
- Yes, at least four US class actions over alleged deceptive auto-renewal billing have been filed since March 2024, including Hanscom (March 2024), Sasgen (June 2025), Tio (November 2025), and Schnappinger (April 2026), targeting a subscription model that generates over 90% of company revenue.
- What is Nord Security's enterprise strategy?
- Through NordLayer, which reported over 9,000 business customers in 118 countries by end of 2024, the company partnered with CrowdStrike (January 2026) and Acronis (June 2026), and completed SOC 2 Type II certification with no exceptions across NordLayer, NordLayer Browser, NordPass, and NordStellar in July 2026.
Timeline
- 2026-07-27NordLayer, NordLayer Browser, NordPass, NordStellar complete SOC 2 Type II certification, no exceptions
- 2026-06-25Partnership announced with Acronis for MSP network and endpoint security
- 2026-04-24Schnappinger v. NordVPN auto-renewal billing class action filed
- 2026-04NordLayer Browser officially launched
- 2026-01-15Strategic partnership announced with CrowdStrike for SMB cybersecurity
- 2025-05NordVPN rolls out post-quantum encryption across all apps
- 2025-01-20Founders launch nexos.ai, enterprise AI orchestration platform, from stealth
- 2024-07-26Apple removes NordVPN from Russian App Store; company exits Russia fully
- 2023-09-28$100M Series B led by Warburg Pincus values company at $3B
- 2022-04$100M Series A led by Novator Ventures values company at $1.6B
Revision history
29 July 2026
First assessed. Defensible for now. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- History and Values - Nord Security
- Cybersecurity unicorn Nord Security on its journey from bootstrapping to IPO readiness (2024-09-09)
- NordVPN (2026-07-26)
- NordVPN's parent company, Nord Security, valued at $3B after latest funding round (2023-09-28)
- Nord Security Company Profile
- Nord Security's $3B Growth: The FP&A Vision (2024-12-03)
- Nord Security - Overview, News & Similar companies (2026-07-20)
- Revenue, Competitors, Alternatives
- Growth, New Features, and Big Wins
- CrowdStrike and Nord Security announce strategic partnership (2026-01-15)
- Nord Security (2026-06-25)
- Nordsec Number of Employees 2026 (2026-06-29)