NS

Nord Security Financial Model

Two parent brands, each with a product cluster:

Nord Security brand:

• NordVPN - flagship consumer VPN; PC Editors' Choice; "hard to beat" (PCMag, June 2021)
• NordLayer - SMB/Enterprise VPN with Zero-Trust Network (ZTN) and custom gateways; launched 2019, rebranded Sept 2021
• NordPass - password manager with data breach scanner; independently audited; launched Nov 2019
• NordLocker - encrypted secure storage with Dropbox integration; in Beta at deck date
• NordWL - white-label VPN solutions for SMBs
• Alert - data breach detection service
• Incogni - personal data removal from data brokers; launched Dec 2021

Surfshark brand (acquired/merged):

• Surfshark VPN - consumer VPN; "blazing speeds, unlimited device support" (cnet, Sep 2021)
• Search - private search engine; no ads/targeting; launched Nov 2019
• Alert - data breach detection
• Antivirus - real-time virus/malware protection; launched Aug 2021
• Incogni - (shared with Nord brand)

Vision: "One platform for a radically better internet" - comprehensive suite, simple UX (download, activate, relax).

No explicit TAM/SAM/SOM figures in deck.

Demand-side indicators provided:

• 45% of consumers expect to be hacked in next 12 months
• 47% of businesses view security and privacy as top tech investment
• Cyberattacks growing: +600% YoY phishing, +630% YoY cloud attacks, 1 ransomware attack every 11 seconds

• Primary: Recurring subscriptions (B2C and B2B); pricing not disclosed in deck.
• Freemium entry: NordLocker and Surfshark Search used as free/low-cost acquisition hooks; upgrade to paid tiers.
• White-label (NordWL): B2B licensing of VPN infrastructure to SMBs.
• Affiliate channel: 35% of revenue derived from affiliates; 20,000 affiliates across the market's broadest affiliate programme.
• Influencer/content marketing: 50 influencer integrations per day, 2bn YouTube views in 2021.
• Multi-product upsell: Core VPN user upgraded to password manager, secure storage, breach detection, antivirus.

• NordLocker: 220% YoY growth (freemium virality)
• NordPass: 570% YoY growth; launched Nov 2019
• NordLayer: launched 2019, rebranded Sept 2021 - no user/revenue figure
• Infrastructure: 70+ countries, 160+ data centres, 9,000+ servers
• Marketing: 50 influencer integrations/day; 2bn YouTube views in 2021; 20k affiliates; 35% revenue from affiliates
• Media mentions: NordPass 2,000+ media mentions; Surfshark 1,000+ media mentions (2021)

• Affiliate channel cost is implicitly low-cost (revenue-share, no upfront spend) - no specific CAC figure.

Moat framing:

• Scale advantage in server network (9,000+ servers, 70+ countries) drives NordLynx speed/security superiority.
• Brand flywheel: most trusted VPN → strongest affiliate reviews → lowest CAC → more users → more infrastructure investment.
• Rated #1 by major tech media: techradar, CNET, Tom's Guide, PCMag, vpnMentor, comparitech, ProPrivacy.
• IP/content marketing as barrier: viral research reports (Top 200 passwords, Digital Quality of Life Index) generate thousands of media mentions annually.
• Working with 300+ NGOs on digital freedom - mission-driven positioning.

• Team: Lithuania-based; recognised as Lithuania's leading technology employer.
• Culture: quarterly OKR events, annual 'workation', expert guest speakers, learning & development.

Archetype + why: Multi-product subscription + freemium SaaS P&L model. Nord Security is a subscription-first business with multiple SKUs across two brand clusters (consumer VPN, SMB VPN, password manager, secure storage, antivirus). The core driver is subscriber count × ARPU by product, with a meaningful affiliate revenue-share cost layer and a server/infrastructure capex component. A 3-statement model anchored on ARR build-up by product line, with an affiliate cost waterfall and infrastructure capex schedule, is the appropriate structure.

Forecast horizon & granularity:

• 5-year annual model (2022–2026), with Year 1 monthly for cash flow visibility.
• Product-line granularity: NordVPN, NordPass, NordLocker, NordLayer/NordWL, Surfshark VPN, Surfshark ancillaries (Search, Alert, Antivirus, Incogni) as separate revenue streams.

Key drivers & assumptions:

*Subscribers / growth:*

• NordVPN subscribers (starting base): ~15M paid subs as of late 2021, based on public market estimates for a top-3 global VPN; deck does not disclose. Rationale: company claims market leadership with 9,000+ servers and 70+ countries, consistent with scale at this order of magnitude.
• NordVPN subscriber growth rate: 20–30% YoY; blended from VPN market growth (~15–20% CAGR) plus Nord's brand leadership premium.
• NordPass subscriber growth: 570% YoY (historical, slide 12) → decelerating to 100–150% in Year 1 forecast as early hyper-growth normalises.
• NordLocker subscriber growth: 220% YoY (slide 12) → 80–120% forward as still in Beta.
• NordLayer (B2B) growth: 60–100% YoY; early-stage B2B with large addressable market; no deck figure.
• Surfshark VPN subscribers: ~3–5M paid subs; positioned as price-competitive alternative. No deck figure.

*ARPU / pricing:*

• NordVPN ARPU: ~$60–80/year (blended across plan lengths); consistent with publicly visible pricing tiers.
• NordPass ARPU: ~$30–40/year for consumer; ~$50–60/seat/year for teams.
• NordLocker ARPU: ~$20–30/year consumer.
• NordLayer ARPU: ~$80–120/seat/year; B2B SaaS pricing.
• Surfshark ARPU: ~$40–60/year; deck positions as more price-competitive than NordVPN.

*Revenue mix / channels:*

• Affiliate revenue share: 35% of revenue via affiliates (slide 15) → ~30–35% commission rate on affiliate-sourced subscribers; modelled as a contra-revenue or S&M cost line.
• Influencer + content CAC: absorbed into S&M opex; low-cost structure implied by deck narrative.

*Costs / margins:*

• Gross margin: 70–80%; consistent with mature VPN SaaS (bandwidth + server costs as primary COGS).
• Infrastructure capex (servers/data centres): 5–8% of revenue; scales with subscriber base.
• R&D: 10–15% of revenue; multi-product innovation pipeline is active (8 products across 2 brands).
• S&M: 30–40% of revenue including affiliate commissions; high spend justified by rapid subscriber growth narrative.
• G&A: 5–8% of revenue.

*Freemium conversion:*

• NordLocker free-to-paid conversion: 5–10% of free signups; standard freemium benchmark.
• Surfshark Search / Alert as acquisition channel: conversion to paid Surfshark VPN or bundle at 3–8%.

Scenarios (Base / Bull / Bear - which variables flex):

• Base: NordVPN +25% subscriber growth, ARPU flat, S&M at 35% of revenue, infrastructure capex at 6%.
• Bull: NordVPN +35% growth driven by geopolitical tailwinds (censorship, surveillance demand); NordLayer acceleration to 120% YoY; bundle cross-sell adds 10% ARPU lift.
• Bear: VPN market commoditises; NordVPN growth decelerates to 10%; affiliate commission rates rise to 40%; server cost inflation compresses gross margin to 65%.

Required sheets / outputs:

1. Assumptions - all drivers in one editable input area
2. Revenue build - by product line (subscribers × ARPU), then channel split (direct vs affiliate)
3. P&L (Income Statement) - revenue, COGS, gross profit, S&M, R&D, G&A, EBITDA, D&A, EBIT
4. Cash Flow - operating CF, capex (server/DC investment), free cash flow
5. Balance Sheet - simplified (cash, fixed assets, deferred revenue, equity)
6. KPI Dashboard - subscribers by product, ARPU, MRR/ARR, affiliate revenue %, gross margin %, EBITDA margin %
7. Scenario toggle - Base / Bull / Bear switch on assumptions sheet