Creative team case study
Protection needs to evolve
From “the most advanced VPN” to an all-in-one digital security app. Here’s how our design team carried NordVPN’s new value proposition across every surface, in three pillars.
- Public launch
- May 27, 2026
- Team
- Design team
Why now
Viruses are no longer the biggest threat
Many of today’s most common and damaging threats (like phishing pages, fake online stores, scam messages, account takeover attempts) don’t rely on a downloadable file at all. Attackers work through deception, compromised credentials, and social engineering.
Traditional antivirus, built around reactive file scanning, wasn’t designed for this. A VPN alone doesn’t cover it either. Yet people still say “antivirus” as shorthand for digital security — so that’s the category our message had to meet. And today’s internet users want stronger online security with less complexity: fewer tools to install, pay for, and manage.
“Protection needs to evolve without compromising the standard of privacy people expect from us.”
The shift
From a VPN with extras to an all-in-one digital security app
For years, NordVPN’s value proposition rested on one claim: the most advanced VPN. Threat Protection, Dark Web Monitor, and other features sat in the “extras” column. Useful, but only as a supporting act.
That framing gradually stopped matching the product. NordVPN’s developers kept adding more protection features for blocking scams, phishing, and malware. And those features were doing the real work: in April 2026 alone, the tool we now call a next-gen antivirus blocked 4.8 million threats, over 3 million of them malware. The extras became the main characters. The value proposition had to catch up — and with it, every surface we design.
Messaging
How do we show next-gen to the world?
The design team faced a question that would end up influencing every asset: how do we show “next-gen” to people who have never even heard the phrase before? It isn’t a single feature you can screenshot. It’s a promise that the “antivirus” people already know has become something new in our hands.
In the end, we settled on three main pillars for our repositioning. We wanted to effectively communicate the “one app” message in a way no list of features ever could. The three pillars became the basis for every layout we touched.
Connect — the most advanced VPN
The claim we built our reputation on. It stays, and it's now the foundation the rest of the app is built on — not the whole story.
Protect — next-gen antivirus
Proactive, real-time protection that helps users avoid phishing, scams, ads, trackers, and malware before they can reach the device. This is the new part of the story.
Monitor — Dark Web Monitor
Continuous monitoring that alerts users when their credentials appear in a data leak, so they can act before an account is taken over.
We didn’t pick the winner ourselves. We put all concepts in front of our users and let the testing decide.
For our next iteration, we took the winner and turned it into a system: one device, three snippets with icons clearly communicating what the app does for you — connect, protect, and monitor. It’s simple enough to read in a second, concrete enough to showcase a product rather than a mood, and scalable from a hero section to a video thumbnail without changing the meaning.
Result
A digital security app that has it all
NordVPN is no longer just a VPN. It’s a digital security app that has both: the most advanced VPN and a next-gen antivirus.
The story landed the way we meant it to. Coverage framed the change as NordVPN moving from a standalone VPN provider to an all-in-one digital security app, and NordVPN’s whitepaper gave the new category substance: stop stacking security tools, instead, use one app built to deal with today’s digital threats.
Threats
4.8M
Threats blocked by the next-generation antivirus in April 2026
Malware
3M+
Malicious downloads blocked by the next-generation antivirus in April 2026
Ready to join the club?
Browse open positions.