# Nord Security Financial Model Multi-brand cybersecurity platform offering VPN, password management, secure storage, and business network security under two parent brands (Nord Security & Surfshark). - Canonical: https://finamodel.com/startups/nord-security - Excel download: https://finamodel.com/startup-models/nord-security.xlsx - Category: Enterprise/Security - Model type: SaaS ARR / Valuation - Funding round: Series A - Founded: 2022 - Geography: Global - 70+ countries [DECK, slide 9]; headquartered in Lithuania [DECK, slide 5]. - Customer: B2B2C ## About the company Nord Security operates a multi-brand cybersecurity platform spanning VPN, password management, secure storage, and business network security. The portfolio includes consumer and SMB products under the Nord Security and Surfshark parent brands. The commercial model is subscription SaaS with freemium entry points and a meaningful affiliate and influencer acquisition engine. Different products and customer segments create opportunities to convert users, retain them through renewals, and cross-sell additional security tools. The model builds subscribers by product and segment, tracking free-to-paid conversion, acquisition channel, monthly or annual pricing, renewal, churn, and cross-sell. Affiliate commissions, infrastructure, support, gross margin, marketing spend, and product investment drive cash flow. ## What's included - 5-year monthly revenue build with stage-appropriate growth assumptions - Full P&L, headcount plan, and operating-expense schedule - Cash-flow statement, runway, and burn-rate tracking - Valuation via exit multiple with a DCF cross-check - Returns analysis with MOIC and IRR - Unit economics including CAC, LTV, payback, and cohort retention ## Product & value proposition Two parent brands, each with a product cluster: **Nord Security brand:** - NordVPN - flagship consumer VPN; PC Editors' Choice; "hard to beat" (PCMag, June 2021) - NordLayer - SMB/Enterprise VPN with Zero-Trust Network (ZTN) and custom gateways; launched 2019, rebranded Sept 2021 - NordPass - password manager with data breach scanner; independently audited; launched Nov 2019 - NordLocker - encrypted secure storage with Dropbox integration; in Beta at deck date - NordWL - white-label VPN solutions for SMBs - Alert - data breach detection service - Incogni - personal data removal from data brokers; launched Dec 2021 **Surfshark brand (acquired/merged):** - Surfshark VPN - consumer VPN; "blazing speeds, unlimited device support" (cnet, Sep 2021) - Search - private search engine; no ads/targeting; launched Nov 2019 - Alert - data breach detection - Antivirus - real-time virus/malware protection; launched Aug 2021 - Incogni - (shared with Nord brand) Vision: "One platform for a radically better internet" - comprehensive suite, simple UX (download, activate, relax). ## Market No explicit TAM/SAM/SOM figures in deck. Demand-side indicators provided: - 45% of consumers expect to be hacked in next 12 months - 47% of businesses view security and privacy as top tech investment - Cyberattacks growing: +600% YoY phishing, +630% YoY cloud attacks, 1 ransomware attack every 11 seconds ## Revenue model - Primary: Recurring subscriptions (B2C and B2B); pricing not disclosed in deck. - Freemium entry: NordLocker and Surfshark Search used as free/low-cost acquisition hooks; upgrade to paid tiers. - White-label (NordWL): B2B licensing of VPN infrastructure to SMBs. - Affiliate channel: 35% of revenue derived from affiliates; 20,000 affiliates across the market's broadest affiliate programme. - Influencer/content marketing: 50 influencer integrations per day, 2bn YouTube views in 2021. - Multi-product upsell: Core VPN user upgraded to password manager, secure storage, breach detection, antivirus. ## Traction & metrics - NordLocker: 220% YoY growth (freemium virality) - NordPass: 570% YoY growth; launched Nov 2019 - NordLayer: launched 2019, rebranded Sept 2021 - no user/revenue figure - Infrastructure: 70+ countries, 160+ data centres, 9,000+ servers - Marketing: 50 influencer integrations/day; 2bn YouTube views in 2021; 20k affiliates; 35% revenue from affiliates - Media mentions: NordPass 2,000+ media mentions; Surfshark 1,000+ media mentions (2021) ## Unit economics - Affiliate channel cost is implicitly low-cost (revenue-share, no upfront spend) - no specific CAC figure. ## Competition / moat Moat framing: - Scale advantage in server network (9,000+ servers, 70+ countries) drives NordLynx speed/security superiority. - Brand flywheel: most trusted VPN → strongest affiliate reviews → lowest CAC → more users → more infrastructure investment. - Rated #1 by major tech media: techradar, CNET, Tom's Guide, PCMag, vpnMentor, comparitech, ProPrivacy. - IP/content marketing as barrier: viral research reports (Top 200 passwords, Digital Quality of Life Index) generate thousands of media mentions annually. - Working with 300+ NGOs on digital freedom - mission-driven positioning. ## Team & funding ask / use of funds - Team: Lithuania-based; recognised as Lithuania's leading technology employer. - Culture: quarterly OKR events, annual 'workation', expert guest speakers, learning & development. --- ## Recommended financial model **Archetype + why:** Multi-product subscription + freemium SaaS P&L model. Nord Security is a subscription-first business with multiple SKUs across two brand clusters (consumer VPN, SMB VPN, password manager, secure storage, antivirus). The core driver is subscriber count × ARPU by product, with a meaningful affiliate revenue-share cost layer and a server/infrastructure capex component. A 3-statement model anchored on ARR build-up by product line, with an affiliate cost waterfall and infrastructure capex schedule, is the appropriate structure. **Forecast horizon & granularity:** - 5-year annual model (2022–2026), with Year 1 monthly for cash flow visibility. - Product-line granularity: NordVPN, NordPass, NordLocker, NordLayer/NordWL, Surfshark VPN, Surfshark ancillaries (Search, Alert, Antivirus, Incogni) as separate revenue streams. **Key drivers & assumptions:** *Subscribers / growth:* - NordVPN subscribers (starting base): ~15M paid subs as of late 2021, based on public market estimates for a top-3 global VPN; deck does not disclose. Rationale: company claims market leadership with 9,000+ servers and 70+ countries, consistent with scale at this order of magnitude. - NordVPN subscriber growth rate: 20–30% YoY; blended from VPN market growth (~15–20% CAGR) plus Nord's brand leadership premium. - NordPass subscriber growth: 570% YoY (historical, slide 12) → decelerating to 100–150% in Year 1 forecast as early hyper-growth normalises. - NordLocker subscriber growth: 220% YoY (slide 12) → 80–120% forward as still in Beta. - NordLayer (B2B) growth: 60–100% YoY; early-stage B2B with large addressable market; no deck figure. - Surfshark VPN subscribers: ~3–5M paid subs; positioned as price-competitive alternative. No deck figure. *ARPU / pricing:* - NordVPN ARPU: ~$60–80/year (blended across plan lengths); consistent with publicly visible pricing tiers. - NordPass ARPU: ~$30–40/year for consumer; ~$50–60/seat/year for teams. - NordLocker ARPU: ~$20–30/year consumer. - NordLayer ARPU: ~$80–120/seat/year; B2B SaaS pricing. - Surfshark ARPU: ~$40–60/year; deck positions as more price-competitive than NordVPN. *Revenue mix / channels:* - Affiliate revenue share: 35% of revenue via affiliates (slide 15) → ~30–35% commission rate on affiliate-sourced subscribers; modelled as a contra-revenue or S&M cost line. - Influencer + content CAC: absorbed into S&M opex; low-cost structure implied by deck narrative. *Costs / margins:* - Gross margin: 70–80%; consistent with mature VPN SaaS (bandwidth + server costs as primary COGS). - Infrastructure capex (servers/data centres): 5–8% of revenue; scales with subscriber base. - R&D: 10–15% of revenue; multi-product innovation pipeline is active (8 products across 2 brands). - S&M: 30–40% of revenue including affiliate commissions; high spend justified by rapid subscriber growth narrative. - G&A: 5–8% of revenue. *Freemium conversion:* - NordLocker free-to-paid conversion: 5–10% of free signups; standard freemium benchmark. - Surfshark Search / Alert as acquisition channel: conversion to paid Surfshark VPN or bundle at 3–8%. **Scenarios (Base / Bull / Bear - which variables flex):** - Base: NordVPN +25% subscriber growth, ARPU flat, S&M at 35% of revenue, infrastructure capex at 6%. - Bull: NordVPN +35% growth driven by geopolitical tailwinds (censorship, surveillance demand); NordLayer acceleration to 120% YoY; bundle cross-sell adds 10% ARPU lift. - Bear: VPN market commoditises; NordVPN growth decelerates to 10%; affiliate commission rates rise to 40%; server cost inflation compresses gross margin to 65%. **Required sheets / outputs:** 1. Assumptions - all drivers in one editable input area 2. Revenue build - by product line (subscribers × ARPU), then channel split (direct vs affiliate) 3. P&L (Income Statement) - revenue, COGS, gross profit, S&M, R&D, G&A, EBITDA, D&A, EBIT 4. Cash Flow - operating CF, capex (server/DC investment), free cash flow 5. Balance Sheet - simplified (cash, fixed assets, deferred revenue, equity) 6. KPI Dashboard - subscribers by product, ARPU, MRR/ARR, affiliate revenue %, gross margin %, EBITDA margin % 7. Scenario toggle - Base / Bull / Bear switch on assumptions sheet ## Frequently asked questions ### Is the Nord Security financial model free? Yes. The Nord Security model is a free Excel download with live formulas. ### Can I change the assumptions? Yes. The workbook is editable and its live formulas recalculate when assumptions change.