NordVPN Threat Protection: what each level does and which plan has it

NordVPN’s Threat Protection now comes in two levels, both renamed in 2026. The full version, formerly Threat Protection Pro, is now called Scam, phishing, and malware protection. It scans downloads for malware, checks for malicious links and blocks ads and trackers, runs without the VPN connected, and works only on Windows 10 (64-bit), Windows 11 and the Mac app downloaded from NordVPN’s website. The basic level, formerly Threat Protection, is now Scam and phishing protection: DNS-based blocking of ads, trackers and unsafe domains. Every plan includes the basic level; only Complete and Prime include the full version.

The names changed twice

“Threat Protection” has meant two different features. In October 2024, NordVPN renamed its full feature from Threat Protection to Threat Protection Pro, and its lighter one from Threat Protection Lite to Threat Protection. In 2026 it renamed both again. Its support article, last edited on 24 July 2026, says: “Previously known as ‘Threat Protection Pro™,’ it is now called Scam, phishing, and malware protection. ‘Threat Protection’ is now called Scam and phishing protection. You may still see the old names in some parts of the app while the update rolls out.”

Marketing adds a third label. NordVPN calls the full feature a “next-gen antivirus,” and its old Threat Protection feature page now redirects to a next-gen antivirus page that says: “Find it in your NordVPN app as ‘Scam, phishing, and malware protection’.” The US pricing grid uses the marketing wording.

What each level does

According to NordVPN’s support article, Scam, phishing, and malware protection (formerly Threat Protection Pro) includes:

• malware scanning of downloads, with quarantine; quarantined files “are automatically deleted after 30 days”
• app vulnerability checks, on Windows only
• advanced browsing protection: malicious URLs, scam alerts, session-hijack detection, email protection and crypto-wallet checks
• an ad and tracker blocker

NordVPN says the feature is “powered in part by nexos.ai.”

Scam and phishing protection (formerly Threat Protection) is a “DNS-based security feature that blocks ads, trackers, and unsafe domains,” in NordVPN’s words. It doesn’t scan files, quarantine anything or check apps for vulnerabilities. NordVPN’s privacy notice says it’s “included in all NordVPN subscription plans at no additional charge.”

Ad blocking needs a note. The pricing grid marks “Ad and tracker blocker” as not included in Basic, yet the DNS-based feature on every plan blocks ads and trackers. NordVPN doesn’t explain the difference; the likeliest reading is two separate blockers, DNS-based on all plans and app-level on Complete and Prime.

Where each level runs, and whether it needs the VPN

NordVPN puts it plainly: “Android, iOS, Linux, and browser extension users can only use Scam and phishing protection.” On a phone or a Linux computer, Complete and Prime give you the same protection level as Basic.

For the full version, NordVPN says it works “without requiring an active VPN connection.” The DNS-based level is different. Support says “it requires an active VPN connection to function,” then adds: “(Unless you are using it on Mobile phones. Then you can use it without having an active VPN connection.)” The next-gen antivirus page contradicts that exception: “DNS-based threat blocking only works when you’re connected to a VPN server.” Until NordVPN settles it, assume a phone needs the VPN on for this protection.

Mac buyers should check two more details. The protection article lists macOS 12 Monterey as the minimum, but NordVPN’s download page says its Mac apps require macOS 14 Sonoma or later, so the app’s requirement comes first. And the full feature needs the website version: support says it’s “not available on the Mac App Store version,” although a separate macOS comparison table lists “Real-time protection: Yes limited” for the App Store app. We follow the protection article.

What we could not verify

We haven’t tested how much malware, phishing or tracking either level catches. NordVPN cites a West Coast Labs “Validated AAA” certification for its next-gen antivirus on Windows and macOS (July 2026); that’s a NordVPN-cited result, not our test, and we haven’t read the report. On the apps’ own security, NordVPN says a Cure53 assessment that began in June 2024 covered Threat Protection Pro and Threat Protection, and that the high-severity issues it found were fixed. Our guide to whether NordVPN is safe covers its wider record.

How Threat Protection should affect your plan choice

Start with your devices. If you mainly use an iPhone, an Android phone, Linux or browser extensions, Basic already includes the only protection level NordVPN offers there. Complete’s malware scanning matters only on Windows 10 or 11 (64-bit) or the website version of the Mac app.

Complete also adds services beyond threat protection. The US grid lists unlimited email protection, call and message protection (marked “Android only, iOS coming soon”), the NordPass password manager, 1 TB of NordLocker cloud storage, Dark Web Monitor Pro and bank transaction monitoring. Prime adds Coveron identity services for US residents; it doesn’t change the protection level.

Here are the bills in USD, before tax:

On the 27-month term, Complete’s monthly equivalent is $4.49 ($121.23 ÷ 27), against Basic’s $3.49. The bigger gap comes at renewal: $80.40 more each year ($219.48 − $139.08). Our NordVPN price guide explains how the renewal works.

Decide before checkout. NordVPN’s pricing FAQ says a plan change made in Nord Account “will take effect when your current subscription expires.” Our NordVPN plans comparison sets out every plan and term, or you can open the NordVPN offer (affiliate link) to see all three plans at the current price.

Common questions

Is Threat Protection Pro still available?

Yes, under a new name. NordVPN now calls it Scam, phishing, and malware protection and markets it as a next-gen antivirus. It’s included in Complete and Prime, not Basic.

Does NordVPN Basic include Threat Protection?

Basic includes Scam and phishing protection, the DNS-based level that used to be called Threat Protection. It doesn’t include malware scanning, the Windows vulnerability checks or the grid’s separate ad and tracker blocker.

Does Threat Protection work on iPhone and Android?

Only the DNS-based Scam and phishing protection does. NordVPN says Android, iOS, Linux and browser extension users can only use that level, even on Complete or Prime.

Does Threat Protection work when the VPN is off?

The full Scam, phishing, and malware protection does; NordVPN says it runs without a VPN connection. The DNS-based level needs the VPN on desktop, and NordVPN’s pages disagree about phones.