NordLayer

NordLayer is the business connectivity and network security product from Nord Security, the company behind the consumer NordVPN service. Where NordVPN protects an individual user on a laptop or phone, NordLayer protects an organisation: its employees, its offices, its cloud workloads and the traffic moving between them. It bundles remote access VPN, site-to-site tunnels, DNS-level threat filtering and centralised user management into a single control panel that an IT administrator runs from a browser. The typical buyer is a small or mid-sized business with a distributed workforce, a handful of offices, cloud infrastructure on AWS, Google Cloud or Microsoft Azure, and no appetite for operating its own VPN concentrators. Larger organisations with dedicated network teams also use it, usually for subsidiaries, acquisition integrations or contractor access.

At the core of the product is the cloud VPN gateway. Instead of installing and maintaining a physical appliance, an administrator provisions a gateway in a chosen region, downloads a configuration file, and deploys it as a virtual machine or container in the target cloud. Traffic from employees then terminates in that gateway before reaching internal resources, so nothing has to be exposed on a public IP address. Gateways can be placed in front of specific subnets, security groups or Kubernetes clusters, which lets a company segment access by team rather than opening the whole network to every authenticated user.

For offices, NordLayer provides site-to-site connectivity through dedicated gateway appliances. These link two fixed locations into one continuous network so that printers, file shares, ERP systems and other on-premises resources behave as if they sit on the same LAN. Site-to-site tunnels remove the need for every employee at a branch to run a client, and they let head-office-only applications stay reachable from smaller locations. Setting up this part does require networking knowledge, because address ranges must not overlap and firewall rules need to allow the tunnel traffic.

Remote access is handled by native clients for Windows, macOS, Linux, iOS and Android. The clients support the NordLynx protocol, a WireGuard-based implementation that negotiates a connection quickly and keeps latency low, alongside OpenVPN for environments where UDP is blocked or where policy requires it. Encryption uses AES-256-GCM. Two behaviours matter operationally. The first is always-on, which forces the client to stay connected and blocks application traffic when the tunnel is down. The second is auto-reconnect with a kill switch, which prevents an unencrypted session from quietly taking over when a user moves between a hotel network and mobile data.

Identity integration is where NordLayer differentiates itself most clearly from a plain VPN subscription. Administrators can federate login with Google Workspace, Microsoft Entra ID and Okta, so account creation and deactivation follow the corporate directory. When a person leaves the company and their identity is disabled, their VPN access disappears with it. Two-factor authentication can be enforced at the NordLayer layer through an authenticator app, and device posture checks allow access rules to depend on whether a machine is managed, encrypted and up to date. User groups map people and devices to specific gateways, which is how a company gives the finance team access to the accounting subnet while engineering reaches only the development environment.

On the security side, ThreatBlock performs DNS and HTTP filtering against continuously updated lists of malicious, phishing and command-and-control destinations. It applies to all users on the account rather than only to those currently inside a VPN tunnel, so it functions as a lightweight secure web gateway for a workforce that spends most of its time on the public internet. The control panel also keeps connection logs, user activity records and download history of configuration files, which supports internal audits and compliance questionnaires. NordLayer positions this combination of network access, identity and threat filtering as a practical entry point into the secure access service edge category rather than a full SASE stack.

Commercially, NordLayer is sold per user per month in three tiers. Lite covers remote access VPN, centralised management, basic identity federation and two-factor authentication for small teams that only need encrypted connectivity. Core adds site-to-site gateways, cloud gateways with granular network segmentation, ThreatBlock filtering, device posture and richer administrative controls. Premium adds the advanced management features such as extended audit logs, priority support and additional compliance tooling, and it is the tier usually quoted to companies with formal security requirements. NordLayer has moved away from publishing a fixed public price list, and minimum seat counts and discounts vary by region and contract length, so the current per-user figure should be confirmed directly on the vendor page or with a sales quote before budgeting.

Compared with a consumer VPN bought in bulk, NordLayer adds the administration, identity and auditing that a business actually needs, and it is priced and licensed for commercial use. Compared with enterprise SASE vendors, it is considerably simpler to deploy and does not require a professional services engagement, but it also offers less depth in data loss prevention, application-level policy and cloud access security brokering. Against newer zero-trust network access products that broker connections at the application layer, NordLayer remains closer to a classic network-layer model with segmentation bolted on, which some administrators prefer because it behaves predictably with legacy software that does not tolerate per-application proxies.

The limitations are worth stating plainly. There is no endpoint protection, no antivirus and no patch management included, so it must sit alongside an existing device security stack. Threat filtering happens at the DNS and URL level, which a determined attacker using an unlisted domain can bypass. Advanced routing, custom protocol support and high-availability gateway clusters are constrained relative to what a hardware appliance vendor offers. Support quality depends heavily on the tier purchased, and companies on the entry plan should expect slower response times during an incident. Configuration mistakes around overlapping subnets are the most common source of deployment problems.

NordLayer fits companies with roughly ten to a few hundred users that need dependable remote access, one or two office interconnects and directory-based administration, without hiring a network engineer. It suits agencies, software businesses, professional services firms and e-commerce operators whose sensitive systems live in a cloud provider. It does not fit organisations that require full SASE capabilities such as inline data loss prevention, deep cloud application controls or private application brokering at scale, and it is a poor choice for environments that must run air-gapped or on-premises-only infrastructure. For buyers comparing options, NordLayer is best judged against Perimeter 81-style network access platforms and application-layer tools such as Twingate. It wins on familiarity, protocol choice and ThreatBlock coverage for a mixed office-plus-remote estate. It loses to Cloudflare One or Netskope when the requirement is browser isolation and granular cloud application policy, and it loses to Twingate when the requirement is narrow, per-application access with no client-managed network stack.