V-MIL Domain Audit: NordVPN / Nord Security

Audit Phase: V-MIL (Military Forensics) Target Company: NordVPN / Nord Security Audit Date: 2026-05-01 Jurisdiction Focus: Israel / Occupied Palestinian Territory

Preliminary Notes on Corporate Structure

NordVPN is a consumer virtual private network product operated by Nord Security, a Lithuanian-headquartered cybersecurity conglomerate. The corporate structure involves several interlocking entities: Nord Security (parent brand), Tesonet (the Lithuanian technology incubator from which Nord Security emerged)¹², and the Dutch holding vehicle Cyberspace B.V., through which the Surfshark acquisition was consolidated in 2022³⁴. The flagship products relevant to this audit are NordVPN (consumer), NordLayer (business/enterprise network security), NordPass (credential management), and NordLocker (encrypted file storage)⁵⁶.

Corporate headquarters is registered in Panama for NordVPN’s operating entity, with principal operations and leadership in Vilnius, Lithuania⁷¹. Co-founder Tomas Okmanas is documented as a key figure in the Tesonet ecosystem⁸⁹. Nord Security received a $100 million investment led by Warburg Pincus in September 2023, with Novator Ventures also participating, which doubled the company’s valuation¹⁰¹¹¹². Pre-IPO stock is listed on secondary markets via Forge Global¹³.

No publicly documented ownership interest by any Israeli defence entity, state body, or defence-affiliated investment vehicle has been identified in Nord Security’s confirmed shareholder structure¹⁰¹¹¹².

Direct Defence Contracting & Procurement

No public evidence identified of any contract, tender award, framework agreement, or memorandum of understanding between NordVPN, Nord Security, or any affiliated entity — including NordLayer, NordPass, NordLocker, Tesonet, or Cyberspace B.V. — and the Israeli Ministry of Defence (IMOD), the Israel Defence Forces (IDF), Israel Prison Service, Israel Border Police, or any other Israeli state security body¹⁴¹⁰⁷.

SIBAT, the Israeli Ministry of Defence’s Directorate of Defence Research and Development and international defence cooperation bureau, maintains registries of approved international defence partners and certified export entities¹⁴. No evidence in publicly available records places Nord Security, NordVPN, or any affiliated entity in any SIBAT listing, the Israeli Defence and Homeland Defence Directory, or any international defence exhibition catalogue in connection with Israeli state contracts¹⁴.

Nord Security’s public press area documents corporate activity through the research period, covering product launches, funding rounds, and consumer-facing cybersecurity developments¹⁰. No press release, government announcement, or trade press report in training data discloses defence cooperation, joint ventures, or formal partnership arrangements between Nord Security and any Israeli defence entity.

Investor relations data from Tracxn¹¹¹² and secondary market filings via Forge Global¹³ likewise contain no reference to defence sector contractual relationships with Israeli state or military counterparties.

Dual-Use Products & Tactical Variants

Commercial Product Lines

NordVPN and NordLayer are commercial, off-the-shelf (COTS) civilian products not marketed as ruggedised, tactical, mil-spec, or defence-grade¹⁵⁶. NordVPN is a consumer privacy and security service. NordLayer is positioned as a business network-access security platform targeting corporate and public-sector enterprise customers, marketed on Zero Trust Network Access (ZTNA) architecture⁵⁶.

Inherent Dual-Use Properties

Encrypted VPN and ZTNA products are recognised as possessing inherent dual-use properties by virtue of their core function: encrypting communications, masking traffic metadata, and enabling secure remote access over untrusted networks¹⁵¹⁶. NordLayer’s ZTNA and Meshnet features share architectural characteristics with technologies used in secure military and intelligence communications networks; however, these properties are generic to the encrypted networking software category and do not in themselves constitute evidence of purpose-built military variants or targeted military marketing¹¹⁶.

Meshnet, a commercially available feature launched in June 2022, enables encrypted peer-to-peer device linking for up to 60 devices¹. It is marketed to general consumers and businesses for privacy and remote access. No military-specific variant or purpose-built adaptation for military end-users is documented.

Post-quantum encryption development is documented in a January 2026 report covering NordVPN’s 2026 threat landscape commentary¹⁵. This work is consistent with industry-wide migration toward post-quantum cryptographic standards and does not constitute a military product line.

Third-party consumer guidance publications have included NordVPN in lists of VPNs suitable for military personnel on the basis of general security properties — encryption strength, no-logs policies, and server distribution¹⁷¹⁸ — but this reflects commercial product characteristics, not purpose-built military product design or any contractual arrangement with a military end-user.

NordWhisper Protocol Claim

The prior analytical draft referenced “NordWhisper” as a protocol launched in 2025. This claim could not be verified from NordVPN’s documented product history, press releases, or technology reporting available in training data through April 2026. This claim is flagged as potentially fabricated and is excluded from findings.

Export Control Applicability

VPN and encryption software is generally subject to cryptography export controls under frameworks including the US Export Administration Regulations (EAR, Category 5 Part 2) and the EU Dual-Use Regulation. No public evidence has been identified of any specific export licence decision, end-user certificate requirement, or government export control review applied to Nord Security’s products in connection with Israeli defence or security end-users.

Heavy Machinery, Construction & Infrastructure

This section is structurally inapplicable to NordVPN / Nord Security. The company is a software-as-a-service provider and does not manufacture, supply, or contract for heavy machinery, construction equipment, vehicles, earth-moving equipment, or physical infrastructure of any kind¹⁵.

Equipment in Occupied Territories: No public evidence identified. Not applicable to this target’s product category.

Settlement Construction Supply: No public evidence identified. Not applicable.

Military Installation Construction: No public evidence identified. Not applicable.

Separation Barrier or Demolition Equipment: No public evidence identified. Not applicable.

Supply Chain Integration with Defence Primes

Component Supply to Israeli Defence Manufacturers

Nord Security is a software-as-a-service company. It does not manufacture optical systems, electronic sub-assemblies, propulsion components, structural materials, guidance systems, communications modules, armour materials, or any physical components that could be integrated into weapons systems or platforms¹⁵.

No public evidence has been identified of any verified supply relationship — formal or informal, contractual or transactional — between Nord Security and Elbit Systems¹⁹, Israel Aerospace Industries (IAI), Rafael Advanced Defense Systems, or Israel Military Industries (IMI/Elbit Land). Elbit Systems is publicly documented as Israel’s largest publicly traded defence electronics and systems company, operating across drone systems, surveillance, munitions, and armoured vehicles¹⁹; no link to Nord Security appears in Elbit’s public filings or Nord Security’s corporate disclosures.

The prior analytical draft inferred a potential supply relationship on the basis that NordLayer competes in the same market niche as Check Point Software and Cato Networks, and that defence-prime subcontractors could therefore plausibly use NordLayer for network access. This is an unsupported inference without evidential basis; it has been discarded.

Joint Development & Co-Production

No public evidence identified of any joint development programme, co-production agreement, technology transfer arrangement, or licensed manufacturing agreement between Nord Security and any Israeli defence manufacturer or defence-prime integrator.

Downstream Software Integration

No public evidence identified of any contractual arrangement whereby Nord Security’s software is embedded in, bundled with, or licensed to Israeli defence system integrators for incorporation into weapons platforms, command-and-control systems, or military communications networks.

Logistical Sustainment & Base Services

Service Contracts to Military Installations

No public evidence identified of any contract by Nord Security or affiliated entities to provide catering, transport, fuel supply, waste management, facilities management, telecommunications infrastructure, or any other base support or sustainment services to IDF bases, military training facilities, detention centres, or security installations¹¹⁰⁵.

Server Infrastructure in Israel

NordVPN operates commercial data-centre server infrastructure in Tel Aviv, Israel, as listed on its public server directory²⁰²¹. NordLayer similarly lists Israeli server locations in its network²². These are commercial servers within third-party data centres, available to any paying subscriber anywhere in the world. No public evidence identifies these servers as contracted to, or specifically serving, military installations, West Bank facilities, Golan Heights infrastructure, or East Jerusalem security operations²⁰²¹²².

The existence of commercial servers in Tel Aviv is consistent with NordVPN’s global server network strategy, which covers over 100 countries¹. NordVPN’s server directory pages²⁰²¹ are publicly accessible marketing and technical reference materials. Third-party VPN comparison resources have noted NordVPN’s Israel server presence in the context of consumer access to Israeli streaming and commercial content¹⁸; no military or security end-user context is documented in these sources.

Shipping, Freight & Port Services

No public evidence identified. Not applicable to this target’s product category.

Munitions, Weapons Systems & Strategic Platforms

Lethal Systems Manufacturing

No public evidence identified. Nord Security manufactures no small arms, crew-served weapons, artillery systems, armoured vehicles, tactical or strategic drones, naval vessels, submarines, or any other lethal platform¹⁵.

Munitions & Precursor Materials

No public evidence identified. Not applicable.

Strategic & Existential Defence Systems

No public evidence identified of any role by Nord Security in the manufacture, integration, maintenance, supply of components for, or software support to Iron Dome, David’s Sling, Arrow missile defence, F-35 or other fighter aircraft programmes, Merkava main battle tanks, Saar-class corvettes, or Israeli ballistic missile or nuclear delivery systems.

Sub-System & Critical Component Supply

No public evidence identified of any supply of guidance electronics, fire-control systems, radar components, propulsion units, warhead casings, fuzing mechanisms, or electronic countermeasures to any Israeli or other military end-user.

Surveillance System Supply

NordVPN has published public-facing editorial content addressing government surveillance and spyware²³, specifically in the context of the Pegasus Project. This content is consumer-oriented advocacy and privacy awareness material, not evidence of any relationship with surveillance system developers or procurers. No supply relationship with NSO Group, Candiru, Intellexa, or any other Israeli surveillance technology company is evidenced.

Export Licensing, Regulatory & Legal History

Export Licence Decisions

No public evidence identified of any government decision — in Lithuania, the Netherlands, Panama, the United States, the United Kingdom, or any other jurisdiction — to grant, deny, suspend, or revoke an export licence for Nord Security products to Israeli military or security end-users¹⁷. General cryptography export controls (e.g., US EAR Category 5 Part 2, EU Dual-Use Regulation Annex I Category 5) apply in principle to VPN and encryption software exports, but no specific licence decision involving Nord Security and Israeli defence end-users appears in any publicly available record.

Arms Embargo & Sanctions Compliance

No public evidence identified of any investigation, citation, or enforcement action against Nord Security related to arms embargoes, export control regimes, or sanctions affecting defence trade with Israel or any other jurisdiction. Nord Security’s operational jurisdictions — Lithuania (EU), Panama, Netherlands (EU) — are subject to EU and UN sanctions frameworks, and no enforcement action involving the company in this context has been identified⁷¹.

Data Protection & Regulatory Actions

Nord Security’s most significant documented regulatory exposure involves a 2018 data breach affecting a third-party data-centre provider in Finland, disclosed publicly in 2019¹. This matter is not related to defence contracting or export licensing. No export control or defence-trade regulatory action has been identified.

Legal Challenges & Judicial Review

No public evidence identified of any court proceedings, judicial reviews, or legal challenges brought against Nord Security in connection with any defence supply relationship, export licence decision, or arms trade matter involving Israel or any other jurisdiction¹.

Civil Society Scrutiny & Documented Investigations

NGO & Academic Investigations

No public evidence identified of any published investigation by Who Profits Research and Information Center, Amnesty International, Human Rights Watch, the American Friends Service Committee (AFSC), Corporate Occupation, or any United Nations body (UN OHCHR, UN Special Rapporteur on OPT, UN Human Rights Council) that specifically addresses NordVPN’s or Nord Security’s military, security, or dual-use supply chain relationship with the Israeli state or in the occupied Palestinian territory¹⁵.

This finding reflects a genuine evidentiary absence consistent with Nord Security’s product category: a SaaS cybersecurity company without documented physical presence in the occupied territories, without documented defence contracts, and without documented supply relationships to Israeli weapons manufacturers or settlement infrastructure. It is not solely an artefact of research limitations.

Boycott, Divestment & Exclusion Campaigns

No public evidence identified of any organised boycott or divestment campaign specifically targeting Nord Security or NordVPN in relation to defence sector activities connected to Israel or the occupied territories. No institutional divestment decision by any pension fund, sovereign wealth fund, university endowment, or public investment authority referencing Nord Security in this context has been identified¹¹¹²¹³.

Media Investigations

Open-source technology journalism and VPN industry coverage has focused on Nord Security’s corporate structure, Tesonet connections²⁴²⁵²⁶, ownership transparency²⁴²⁵, and the 2018–2019 data breach¹. No investigative journalism connecting Nord Security to Israeli military or security sector contracting has been identified in training data¹⁶²⁷²⁸.

Corporate Response & Policy Statements

No public evidence identified of any public statement, policy change, contract termination, or end-use monitoring commitment made by Nord Security in response to civil society pressure regarding defence supply chain issues connected to Israel or the occupied territories¹⁰⁷.

Ukraine Context Note

A Hacker News discussion thread²⁶ referenced a claim that Nord Security’s CyberCare subsidiary donated funds to “help arm Ukraine” following the February 2022 invasion. This claim originates from an unverified secondary discussion, not from any primary corporate press release or major news coverage. Nord Security’s official press area¹⁰ does not contain a confirming announcement. This claim is treated as unverified and is not relied upon as a factual finding. It is noted here solely because it was present in prior analytical drafts and has been assessed and excluded.

End Notes