Nord Security

What is Nord Security?

Nord Security is a private Lithuanian cybersecurity company founded in 2012 by Tom Okmanas and Eimantas Sabaliauskas. It is best known as the company behind NordVPN and now operates a broader suite including NordPass, NordLocker, NordLayer, NordStellar, NordProtect, and the Saily travel eSIM.

Is Nord Security publicly traded?

No. Nord Security is private. It raised $100 million in 2022 at a $1.6 billion valuation and another $100 million in 2023 at about $3 billion. Leadership has discussed maintaining IPO readiness but has not announced a listing.

Who owns Nord Security?

Founders Tom Okmanas and Eimantas Sabaliauskas retain controlling ownership. Minority investors include Novator Ventures, Burda Principal Investments, and General Catalyst, plus angel investors from the European tech sector.

Where is Nord Security headquartered?

Nord Security's operational headquarters and largest hub is Vilnius, Lithuania. Some legal entities, particularly those tied to NordVPN service operations, are registered in other jurisdictions including Panama, a common arrangement among privacy-focused VPN providers.

What is Nord Security's market position?

Nord Security is one of the two largest consumer VPN companies globally by brand awareness and subscribers. NordVPN is its flagship, and the company has expanded into password management, business network security, identity protection, and travel eSIMs. It is Lithuania's most prominent tech unicorn.

Does Nord Security own Surfshark?

Nord Security merged operations with Surfshark in early 2022, so both brand families sit under common ownership. They continue to operate and market as separate brands rather than being merged into a single product.

Nord Security was founded in Vilnius in 2012 by Tom Okmanas and Eimantas Sabaliauskas, childhood friends who wanted to build online privacy tools. Their first product, the NordVPN app, launched the same era and grew steadily through the mid-2010s as consumer awareness of surveillance and data privacy expanded.

The company's early growth was unusual in tech: it raised no venture capital for a decade, funding expansion from operating cash flow. NordVPN's heavy investment in advertising, sponsorships, and creator marketing built it into one of the best-known consumer VPN brands globally.

In 2020 the company expanded beyond VPN, launching NordPass for password management, NordLocker for encrypted cloud storage, and NordLayer for business network access security. This began the transition from single-product VPN provider to a broader security platform.

In early 2022 Nord Security merged operations with Surfshark, another fast-growing consumer cybersecurity company, with both brands continuing independently under the combined structure. That April, Nord raised its first-ever outside capital: $100 million led by Novator Ventures with Burda Principal Investments, General Catalyst, and tech founders including Supercell's Ilkka Paananen, Wolt's Miki Kuusi, and Automattic's Matt Mullenweg. The round valued the company at $1.6 billion and made it Lithuania's second unicorn.

In September 2023 the company raised a further $100 million at a valuation of about $3 billion, nearly doubling in a year. It turned EBITDA-positive in 2023 and has consistently stated it wants IPO readiness without committing to go public.

Product expansion continued through 2024 and 2025. The company launched NordStellar for threat exposure management, Saily for travel eSIM connectivity in March 2024, NordProtect for identity theft protection, and the NordLayer Browser. It also acquired IronWall to deepen its business security capabilities. As of 2026, Vilnius remains its global headquarters, and the company continues to position for a potential IPO while staying private.

Nord Security's ethics profile centers on privacy rather than environmental metrics. Its core proposition, audited no-logs policies on NordVPN, has been independently verified through third-party audits commissioned by the company. Those audits are self-commissioned rather than regulatory, which is standard practice in the VPN industry.

On the digital rights side, the company funds internet freedom initiatives and has published transparency reporting on data requests. As a European-headquartered company it operates under GDPR across its products.

Environmental reporting is minimal. The company does not publish a comprehensive carbon accounting or hold B Corp certification, which is typical for a software business of its size but worth noting for completeness.

Nord Security's main historical incident was a 2018 server breach disclosed publicly in 2019, in which a third-party data center server in Finland was accessed. NordVPN said no user credentials or activity logs were exposed, but the delayed disclosure drew criticism over transparency. The company responded by moving to fully owned and colocated servers with RAM-only infrastructure.

The broader VPN industry faces ongoing regulatory scrutiny around logging claims and jurisdiction shopping. Nord Security's use of a Panama registration for parts of its VPN operation, while Lithuania hosts its real headquarters, has periodically drawn questions about corporate transparency, though no regulator has found wrongdoing.

The Surfshark merger also attracted attention because the two brands continued marketing against each other afterward, which some critics argued obscured common ownership from consumers comparing VPNs.