How Threat Protection works: A detailed guide

How does Threat Protection Pro work?

NordVPN’s Threat Protection Pro goes beyond what a VPN typically offers. With Threat Protection Pro, you get some of the functions found in antivirus software — but with even more privacy.

Threat Protection Pro improves your online security by:

• Blocking malicious websites.
• Scanning downloaded files for malware.
• Preventing user tracking.
• Blocking potentially malicious ads.

How Threat Protection Pro blocks malicious URLs, trackers, and ads

Threat Protection Pro runs a transparent proxy — also known as an inline proxy — on the user’s device to filter out and block unwanted content.

Transparent proxies provide a secure way to filter out unwanted and potentially dangerous content — which is what Threat Protection Pro does with malicious URLs, intrusive trackers, and ads.

When Threat Protection Pro is on, all traffic goes to the transparent proxy first instead of accessing the internet directly. The proxy, acting as a guardian, checks the predefined settings to see if the request:

• Will direct you to a dangerous, malware-ridden site.
• Is trying to send tracking information about you.
• Is asking you to download a potentially malicious ad.

If so, the proxy blocks the request, preventing your device from being exposed to these threats. According to Marijus Briedis, CTO at NordVPN, NordVPN’s Threat Protection Pro feature blocks around 300,000 malware infections per month. In addition, the proxy checks what you are receiving back from the web — and filters out the content again.

During this process, all sensitive data remains on the user’s device and isn’t exposed.

How Threat Protection Pro scans files for malware

Threat Protection Pro also ensures that the files you download are safe for your device.

When you download a file, Threat Protection Pro immediately scans it for malware. If anything malicious is detected, it removes the file to prevent damage to your device.

It’s a quick and easy way to scan files for viruses — and it all happens automatically, as long as the feature is enabled.

Is Threat Protection Pro secure?

Nord Security — the company behind NordVPN and Threat Protection Pro — is one of the leading cybersecurity solution providers globally.

It doesn’t just understand the importance of cybersecurity and user privacy — but places it at the forefront of every feature, product, and service.

Here’s how NordVPN ensures that Threat Protection Pro is secure:

• Threat Protection Pro uses its own malware protection solution without any third-party applications running on the user’s device.
• This solution is developed and meticulously tested by experienced Nord Security engineers and QA teams to ensure it delivers the highest level of security.
• The components used in the malware protection solution are developed especially for this feature. Even machine learning engines are architectured and trained by an in-house data scientist.

Does Threat Protection Pro collect user data?

Threat Protection Pro doesn’t collect any personal data that could identify the user.

NordVPN exists to increase and protect users' digital privacy, with Threat Protection Pro taking it even further by blocking ads, trackers, and malware.

However, to protect users from threats effectively, it’s important to evaluate how Threat Protection and other NordVPN features are performing.

For this reason, NordVPN collects anonymous, unidentifiable data about the service. Users can choose to opt out of this on the NordVPN app, so the data is only collected if the user is happy to provide it. However, no personal data is collected, meaning it can’t be linked to a specific individual.

The data collected helps NordVPN improve its services, monitor cyber threats more effectively, and answer important questions about Threat Protection Pro functionality — such as:

• Are there any errors in the libraries responsible for traffic inspection and malware blocking?
• Is Threat Protection Pro successfully blocking the content it should?
• What domain was blocked or allowed access?

Threat Protection Pro vs. Threat Protection

Threat Protection is a lightweight version of Threat Protection Pro. It doesn’t offer as many features and capabilities, but it still provides some additional security and privacy benefits.

Here are the main differences between Threat Protection Pro and Threat Protection:

• Threat Protection Pro works without being connected to the VPN. To use Threat Protection, you’ll need to connect to a NordVPN server beforehand (for now).
• Threat Protection only blocks malicious URLs and ads at the domain level without inspecting the URL.
• Threat Protection doesn’t scan files for malware.
• While Threat Protection Pro is only available on Windows and macOS apps (excluding the App Store version), Threat Protection is available on all other apps and VPN proxy extensions.

Stay safe online with Threat Protection Pro

Threat Protection Pro is a safe and secure way to enhance your digital privacy and security. Using NordVPN’s own malware protection solution, Threat Protection Pro blocks malicious URLs, trackers, and ads — so you can work, browse, and access content safely.

Threat Protection Pro doesn’t collect any identifiable information about its users — and continues evolving and introducing new security measures.

So if you’re looking to take your online security and privacy further, consider taking advantage of Threat Protection Pro now. NordVPN offers it with most subscriptions for all-round online digital security and privacy — or you can get Threat Protection Pro on its own without a VPN for Windows and macOS devices.