NordLayer
Toggle-ready network security platform for businesses
About NordLayer
NordLayer is a cloud-based network security platform from Nord Security that combines business VPN, zero trust network access (ZTNA), cloud firewall, and threat prevention in one service. IT teams use it to give remote and hybrid staff encrypted access to company resources through shared or dedicated gateways, enforce access rules per user and device, and block malicious sites and downloads without deploying hardware. It started in 2019 as NordVPN Teams and was rebranded as NordLayer in 2021.
Pros & Cons
Pros
- Fast rollout: admins can deploy it to a team in minutes without hardware, and reviewers repeatedly cite easy setup and user management
- Combines business VPN, ZTNA, cloud firewall, and web threat protection in one console, replacing several point tools
- Dedicated IP gateways make IP allowlisting for SaaS apps and cloud resources simple
- SSO with Okta, Entra ID, OneLogin, Google, and JumpCloud plus MFA on every plan
- NordLynx (WireGuard-based) protocol delivers speeds up to 1 Gbps
- Holds ISO 27001, SOC 2, HIPAA, and PCI-DSS compliance
Cons
- No free plan and a 5-user minimum (200 for Enterprise), so it doesn't fit solo users or very small teams
- Dedicated gateways cost an extra $40-$50 per month on Core and Premium
- Key controls such as Cloud Firewall, Device Posture Security, and Site-to-Site are gated to Premium or sold as add-ons
- Reviewers report limited advanced configuration and thin reporting, so some teams add separate monitoring tools
- Monthly billing costs up to about 25% more than yearly billing
Key Features
Business VPN with shared gateways
Encrypted connections through shared gateway locations in 40+ countries at speeds up to 1 Gbps, using the WireGuard-based NordLynx protocol or OpenVPN (UDP/TCP).
Virtual Private Gateways with dedicated IP
Private gateways with a dedicated IP address reserved for your organization, used for IP allowlisting so only your team can reach protected resources.
Cloud Firewall (FWaaS)
Network segmentation rules that control which users and teams can reach which resources, ports, and services.
Device Posture Security
Blocks devices that fail predefined compliance rules, such as OS version or missing security checks, from connecting to the network.
Site-to-Site connector and Cloud LAN
Links remote offices and cloud environments to the gateway with encrypted tunnels and lets connected devices share files endpoint-to-endpoint.
Threat prevention
Web Protection blocks malicious domains from threat intelligence feeds, Download Protection scans and removes malware from new files, and DNS filtering blocks 50+ website categories.
Application Blocker
Blocks 400+ applications, services, and protocols for users connected to a Virtual Private Gateway.
SSO, MFA, and user provisioning
Single sign-on with Okta, Entra ID, OneLogin, Google, and JumpCloud, plus multi-factor authentication, biometrics, and automated onboarding and offboarding through Entra ID and Okta.
Always On VPN and auto-connect
Forces traffic through the VPN and connects automatically when a device goes online, with session duration controls for automatic logout.
NordLayer Browser
A managed enterprise browser that controls uploads, downloads, and copy-paste, detects shadow IT apps and extensions, and enforces browser-level access policies.
Pricing
- Billed yearly ($10/user/month billed monthly)
- 5 users minimum
- Shared gateways in 40+ countries, up to 1 Gbps
- Web Protection and Download Protection
- SSO, MFA, Always On VPN, auto-connect
- Activity monitoring reports
- 6 devices per license
- Billed yearly ($14/user/month billed monthly)
- Everything in Lite
- Virtual Private Gateway with dedicated IP (+$40/month yearly, +$50 monthly)
- IP allowlisting and split tunneling
- DNS filtering by category, custom DNS, Application Blocker
- Biometrics and manual configuration
- Cloud Firewall via sales; Device Posture Security as add-on
- Billed yearly ($18/user/month billed monthly)
- Everything in Core
- Cloud Firewall (FWaaS) and Device Posture Security
- Site-to-Site connector and Cloud LAN
- Browser Extension with URL-based split tunneling
- User provisioning with Entra ID and Okta
- 200 users minimum, yearly plans only
- Starts with Lite capabilities; price varies with plan and add-ons
- Virtual Private Gateways in up to 60 countries
- Custom feature configuration
- Talk to sales
Best For
Securing remote and hybrid teams
Give distributed staff encrypted access to internal tools and the internet from any network, with Always On VPN and auto-connect enforcing protection.
IP allowlisting for SaaS and cloud resources
Route staff through a dedicated IP gateway so admin panels, databases, and SaaS apps accept connections only from that address.
Zero trust access and network segmentation
Use the cloud firewall, SSO, and device posture checks to limit each team to the resources it needs and block non-compliant devices.
Connecting offices and cloud environments
Link branch offices, AWS or Azure networks, and remote users with Site-to-Site tunnels instead of maintaining hardware VPN appliances.
Meeting compliance requirements
Support ISO 27001, HIPAA, SOC 2, and PCI-DSS programs with encrypted access, activity monitoring reports, and enforced authentication.
Similar Tools
GreyNoise
Real-time intelligence for modern threats
Ory
Open-source identity and access management platform
Avira Endpoint Security
Lightweight endpoint protection with cloud-based threat intelligence
ARCON PAM
Enterprise privileged access management for identity security
Coro
AI-powered all-in-one cybersecurity platform for lean IT teams
NoPorts
They can't attack what they can't see