The improbable world capital of the VPN

In the offices of the Cyber ​​Citythe new Technological Campus of Vilna (Lithuania) that houses 3,000 employees, Vytaautas Kaziukonis (in the upper image) moves his hands while explaining something that seems to challenge all business logic.

The Surfshark CEO, one of the most popular VPNs in the world, has just described how your company works completely independent of Nordvpn, although Both belong to the same group since 2022.

“Everything is separated: servers, applications, code, infrastructure. It would be very easy to merge everything, but then we would kill creativity, we would kill the brand identity,” he says while on the glass wall behind him the stickers of Signal and Tor are seen in the developer’s laptops. Subtle signals of the company’s culture.

The history of how Lithuania, a country of just 2.8 million inhabitants, became the world epicenter of digital privacy is as unlikely as the business strategy that Nord Security has chosen: to keep alive and compete with each other to the two greatest brands of VPN of the planet.

From vile with privacy

“When you are a small country, you can’t do business just for the local market. It is too small, so you automatically think about the world,” explains Kaziukonis during our conversation at the Surfshark offices. This forcedly global mentality is just a piece of the Lithuanian puzzle.

The transformation began when foreign companies established technological centers after the independence of 1990. International banks needed developers and created demand, universities responded with specialized programs. But when Lithuania became “too expensive” for some, the talent remained. “Those young people learned how to do international marketing, how to develop global products. Some left those companies and created their own startups,” the CEO continues.

The result: four technological unicorns in a country with the population of Galicia or the province of Valencia (The most famous is Vinted). To internationalize the comparison, Austria, “an old and rich country in the heart of Europe” with triple population, He recently got his first unicorn (Bitpanda), says Kaziukonis with a smile that suggests national pride content.

The fusion that was not fusion

On February 2, 2022, the world of cybersecurity witnessed something unpublished. Nord Security, owner of Nordvpn, announced Fusion with Surfshark To create a giant valued at 1.6 billion dollars (which would duplicate to 3,000 million just a year later). But here comes the turn: They didn’t touch anything.

“People assume that when there is a fusion, everything integrates. We did exactly the opposite,” explains Marijus Briedis, Cto de Nord Security, in a talk in their facilities. Surfshark offices are in a different building on the same campus. The equipment is not mixed. Infrastructure remains separate. Even security audits are made separately.

“We could save short -term money by merging everything,” admits Donatas Budvytis, surfshark cto. “But We would kill innovation. We have people here who have been working in Surfshark for eight years. For them, Surfshark is part of their identity. If we simply crush everything … “.

The strategy reminds how the Volkswagen Group has kept Volkswagen, Seat and Skoda with separate identities even though they share platforms, engines and even factories. Nord Security maintains the same level of separation.

Both proposals reduce the monthly price by more than 50% if one or two years are paid. There you can see well how both brands aggressively encourage long -term commitments. The real business is not to be cheap, but in seem cheap while you ensure early payments of years.

“We never try to position Surfshark as the cheap option,” Kaziukonis replies when I mention the price difference. “Our goal was always to be an affordable solution for as many people as possible.”

The invisible technological career

In the laboratories of both companies, internal competition produces constant innovations:

1. Surfshark developed Nexusa network that connects all its servers in a global mesh, allowing functions such as Dynamic IP Automatic every 5-10 minutes.
2. Nordvpn responded with Nordlynxits implementation of the Wireguard protocol that promises to be “hundreds of mb/s faster.”

“If you look at the independent audits, sometimes the performance is better in one and times in the other,” says Dominikas Virbickas, Nordvpn engineer. “That shows that they are really different infrastructure.”

Paranoia for privacy permeates everything. Both companies have traveled to Solo-RAM servers, where all the information is deleted with each restart. The policies of No-Logs They are audited annually by Deloitte. “In 2024, we received a judicial data application,” reveals a Nordvpn transparency report. “We couldn’t provide anything because we had nothing”.

Beyond the VPN tunnel

Nord Security’s real bet goes beyond VPN. During the presentations, it is clear that the vocation of the company is to build a complete digital security ecosystem. NordPass For passwords, NordLocker For encrypted storage, but also more ambitious products.

THREAT PROTECTION PRO It is your response to malwarecapable of blocking threats at the URL level, not just domain. “Traditional antivirus come from the world of files. We come from the world of connections,” explains Rokas Slavinskas while presenting NordStellara tool that monitors the Dark Web in search of business data leaks.

But perhaps the most unique movement is that of Incognia service that automatically contacts more than 400 Brokers of data to request the elimination of personal information. “Last year we completed 90 million elimination applications,” says Sarunas Sereika. “This year we point to 300 million.”

And then it is Sailyyour entrance to the market esim For travelers. It is the only brand in the group that does not carry “Nord” in the name. In fact it has its own visual identity. “We launched four months earlier than planned, with the supplier contract signed three weeks before and confirmed data plans three days before launch,” Briedis confesses. “Now is our fastest growing startup.”

The true Moat Lithuanian

During lunch at a traditional Lithuanian restaurant, the inevitable question arises: can this model of independent brands last? The VPN industry is consolidating. Kape Technologies bought Expressvpn for 936 million. Ziff Davis control Ipvanish and Hotspot Shield. And there are new Asian actors entering with aggressive prices that touch the unsustainable.

“People think that VPNs are a product Commoditizedthat does not matter which one you use, “Kaziukonis reflects.” But ask anyone who has tried to see Netflix from China or access their bank from Iran. The details matter. Consistency matters. And that requires constant investment. “

The Lithuanian government seems to understand the value of the sector. The 15% tax rate for technology companies, the incentives for R&D that allow to deduce expenses three times, the program of Visas for entrepreneurs. Everything aims to keep the momentum.

But the real one Moat It is not technological or regulatory. It is cultural. “We are like the short basketball player who has to train harder,” says Kaziukonis, returning to his favorite metaphor. “Lithuania always tries to hit over its weight.”

• A “Moat“o Defensive pit in technology is that competitive advantage difficult to replicate that protects a company from its competitors, such as the Facebook users network or Amazon scale economies.

The future of privacy according to Vilna

In the last hours in Vilna, while the surfshark security team demonstrates how its new function of the emails of Phishing (“I’m going to install my parents,” says a French journalist), a fascinating paradox arises. These companies that sell privacy and almost paranoid anonymity have built their success being completely transparent about their strange business structure.

“Surfshark users are our people,” insists fair Pukys, brand manager. “We do two user interviews per week. Each employee, no matter if it is finance or human resources, has to participate in at least one user interview every several months.”

This obsession to understand the user, combined with the peculiar independence between brands, has created something unique. It is not just that Nord Security controls the two largest VPNs in the western world. The thing is He has discovered how to make them compete with each other without destroying each other.

When I ask Kaziukonis if they ever considered to simply kill one brand and keep the other, his answer is instantaneous: “It would be like asking a father which of his children prefers. Both brands have their identity, their purpose, their community. Why destroy something that works?”

When leaving the Cyber ​​City campus, with its 35,000 square meters of ultramodern offices in what was previously the Soviet industrial periphery of Vilna, it is clear that the Lithuanian experiment in cybersecurity is much more than a geographical anomaly. It is a commitment that in the era of technological consolidation, maintaining internal diversity can be more valuable than economies of scale.

If they are right, the rules of technological mergers will have rewritten. If they are wrong, at least they will have shown that a smaller country that Castilla-La Mancha can, for a brilliant moment, dominate the Internet privacy infrastructure.

The final irony is fantastic: Companies that promise to make you invisible online have put Lithuania on the world technological map. And they have done so by keeping their two main products in perpetual competition, as brothers who fight in the patio but defend the family home with nails and teeth.

In Xataka | Beware of aircraft wifi: there are scammers that create false networks on flights

Outstanding image | Xataka