In short: NordLayer is Nord Security's cloud network access service for businesses. It combines a business VPN, zero trust access controls, web threat protection, DNS filtering and a cloud firewall, managed from one control panel with apps for Windows, macOS, Linux, iOS and Android. Plans run from Lite to Premium, with an Enterprise offer.
What NordLayer is
NordLayer is the business network security service from Nord Security, the company behind NordVPN and NordPass. It is delivered entirely from the cloud: users install the NordLayer app on Windows, macOS, Linux, iOS or Android (or use the browser extension on the Premium plan), sign in with your identity provider and connect through Nord's gateways rather than through a firewall in your office.
It covers the three jobs most smaller organisations want from SASE without a large project:
- Secure access: an encrypted business VPN using NordLynx, Nord's WireGuard-based protocol, with always-on VPN and (from Core) split tunnelling
- Access control: zero trust rules that decide which users and devices can reach which private resources, with device posture checks and IP allowlisting
- Threat prevention: web protection against malicious and phishing sites, download protection that removes malware from newly downloaded files and, from Core, DNS filtering by category
Nord Security has also released NordLayer Browser, an enterprise browser that brings policy into the browser itself. If that approach interests you, see our guide to browser security.
How NordLayer works
There is no hardware to install. An administrator sets up the organisation in the NordLayer Control Panel, connects an identity provider (Microsoft Entra ID, Okta, Google Workspace, OneLogin and JumpCloud are listed for single sign-on) and invites users.
Traffic can leave through shared gateways, which give secure internet access from a choice of locations, or through virtual private gateways with a dedicated IP that belongs only to your organisation. A dedicated IP is the usual way to lock SaaS apps, cloud consoles and firewalls down to traffic from your own users: you allowlist the NordLayer IP instead of every home broadband address.
From the gateway you can reach private resources in a cloud network or an office network through site-to-site connectors, and the cloud firewall (firewall as a service) segments who can reach what. Device Posture Security checks devices against rules you set, such as an allowed and up-to-date operating system, an up-to-date NordLayer app and no jailbreak or root, and can alert on or block devices that fail.
That model is close to a modern business VPN with zero trust controls layered on. It is quick to deploy, but it is not a full proxy-based secure web gateway with TLS inspection and inline data loss prevention.
NordLayer plans compared
NordLayer sells per user, in three published plans plus an Enterprise offer. The table reflects NordLayer's published plan comparison in October 2026. Feature placement changes from time to time, so we confirm the current plan contents when we quote.
| Capability | Lite | Core | Premium | Enterprise |
|---|---|---|---|---|
| Shared gateways, NordLynx, MFA, SSO, always-on VPN | Yes | Yes | Yes | Yes |
| Web protection and download protection | Yes | Yes | Yes | Yes |
| Split tunnelling | No | Yes | Yes | Yes |
| DNS filtering by category, application blocking | No | Yes | Yes | Custom |
| Virtual private gateway with dedicated IP | No (shared gateways only) | Yes | Yes | Custom |
| IP allowlisting | No | Yes | Yes | Custom |
| Device Posture Security | No | Add-on | Yes | Custom |
| Cloud firewall (FWaaS) | No | On request | Yes | Custom |
| Site-to-site connector, browser extension | No | No | Yes | Custom |
Lite suits teams that mainly want safer internet use on public Wi-Fi. Most businesses that need access to private systems start at Core, because that is where the dedicated IP, split tunnelling and DNS filtering arrive. Premium includes Device Posture Security, the cloud firewall, site-to-site connectors and the browser extension, which matter once you have more than a handful of private resources. Enterprise is a custom offer for larger teams. Pricing depends on users, plan, gateways and add-ons, so ask us for a quote.
Who NordLayer suits
NordLayer works well for:
- Hybrid and remote teams that need a straightforward replacement for an ageing office VPN appliance
- Organisations that allowlist by IP for SaaS, banking portals or cloud admin consoles
- Smaller IT teams that want something users can install and understand without training
- Businesses preparing for Cyber Essentials, where secure remote access and MFA on cloud services are part of the controls (see Cyber Essentials)
It is a weaker fit if you need full TLS inspection of web traffic, inline data protection for SaaS apps or a single policy engine across branch offices, guest Wi-Fi and remote users. In those cases a broader platform such as WatchGuard FireCloud, Todyl or Microsoft Entra Private Access with Entra Internet Access may suit better.
NordLayer compared with other SASE and ZTNA options
| Option | Approach | Strongest fit |
|---|---|---|
| NordLayer | Cloud business VPN with zero trust rules, dedicated IPs and DNS-level protection | Smaller teams replacing a VPN quickly |
| Timus SASE | Always-on agent with ZTNA, secure web gateway and cloud firewall, delivered through managed service providers | Organisations wanting one agent for access and web security |
| WatchGuard FireCloud | Cloud FWaaS and web protection, with ZTNA to private apps in Total Access | WatchGuard Firebox estates |
| Todyl | Modular platform: SASE plus EDR, SIEM and managed XDR | Businesses consolidating security through one provider |
| Microsoft Entra Private Access | Identity-centric ZTNA inside Microsoft Global Secure Access | Microsoft 365 organisations already using Microsoft Entra ID |
| Zero Networks | Microsegmentation and MFA on network ports, plus secure remote access | Stopping lateral movement inside the network |
For the wider picture of how these fit together, read our ZTNA and SASE guides. Licensing detail for Timus is on Software Licensing UK.
NordPass and NordLayer Intelligence from the same vendor
Nord Security sells two related business products that often come up in the same conversation:
- NordPass is a business password manager with shared vaults, password health checks and breach alerts. We compare it with Keeper and 1Password in our business password managers guide.
- NordLayer Intelligence by NordStellar (NordStellar's own website now points to it) is an external threat monitoring service. It looks for stolen employee credentials and session cookies, data taken from company devices by infostealer malware, company data on dark web forums, lookalike domains and fake profiles, and exposed internet-facing assets such as forgotten subdomains or open admin panels. It pairs well with an autonomous penetration test as part of understanding what an attacker can already see.
How we help
We start by looking at how people connect today, which systems are allowlisted by IP and what your identity provider can enforce. Then we recommend the right NordLayer plan, or tell you if another option fits better, and handle the rollout: identity provider integration, gateway and dedicated IP setup, connectors to your cloud network or office, device posture rules and user onboarding.
Contact us for a quote or a second opinion on your remote access.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is NordLayer the same as NordVPN?
No. Both come from Nord Security, but NordVPN is a consumer privacy service. NordLayer is built for businesses, with a central Control Panel, single sign-on, dedicated IPs, zero trust access rules and, on the higher plans, device posture checks and a cloud firewall.
Is NordLayer a SASE platform?
NordLayer covers several SASE building blocks: secure access, zero trust rules, DNS-level web protection and a cloud firewall. It does not offer the full proxy-based web inspection, CASB and inline data loss prevention of larger SASE platforms, so it is best described as a hardware-free network access security service.
Which NordLayer plan do I need for a dedicated IP?
A virtual private gateway with a dedicated IP is available from the Core plan upwards, and in the Enterprise offer. Lite uses shared gateways only, and also leaves out split tunnelling and DNS filtering by category.
Does NordLayer work with Microsoft Entra ID?
Yes. NordLayer supports single sign-on with Microsoft Entra ID, as well as Okta, Google Workspace, OneLogin and JumpCloud, so users sign in with their existing work accounts and access can be removed centrally when someone leaves.
How much does NordLayer cost?
NordLayer is licensed per user on the Lite, Core and Premium plans, with add-ons such as Device Posture Security on Core, and Enterprise is a custom offer. The total depends on the plan, user count, gateways and add-ons you need, so ask us for a quote.