The investigation into the economic footprint of Surfshark requires a multifaceted forensic approach, examining not only the direct operational presence of the entity but also the complex layers of ownership, capital flows, and institutional associations that define its market position. Within the global cybersecurity landscape, the consolidation of consumer-facing privacy tools has created an intricate web of corporate entities and investment vehicles that frequently intersect with state security apparatuses and militarized technology hubs. This report documents the institutional architecture of Surfshark and its parent organization, Nord Security, to determine the degree of material and ideological support for the Israeli technology sector, the defense industry, and the systems of surveillance that characterize the regional geopolitical environment.
The origin and structural evolution of Surfshark are central to understanding its economic complicity. Founded in 2018, Surfshark initially operated as an independent Virtual Private Network (VPN) provider before undergoing a series of strategic realignments that culminated in its 2022 merger with Nord Security.1 This merger was not merely a tactical partnership but a fundamental reorganization under a unified holding structure known as Cyberspace BV, registered in the Netherlands.3 The selection of the Netherlands as a primary jurisdiction is a strategic decision rooted in the European Union’s GDPR framework and the country’s lack of mandatory data retention laws for VPN providers, which serves to enhance the brand’s privacy-focused marketing.4
However, the forensic trail reveals that both Surfshark and Nord Security have deep roots in the Lithuanian technology sector, specifically within the Tesonet business incubator in Vilnius.3 This incubator functioned as a developmental nexus for several high-growth cybersecurity products. While Surfshark maintains that it operates independently with a separate infrastructure and product development roadmap from NordVPN, the shared governance under Cyberspace BV and the unified flow of institutional capital suggest a higher degree of strategic alignment than is often presented to the public.2
| Entity | Role | Legal Jurisdiction | Operational Hubs | Key Founders |
|---|---|---|---|---|
| Surfshark B.V. | Subsidiary (VPN/Security) | Netherlands | Lithuania, Poland, Germany | Vytautas Kaziukonis 1 |
| Nord Security | Subsidiary (Cybersecurity) | Lithuania | Lithuania, UK, USA, Poland | Tom Okman, E. Sabaliauskas 6 |
| Cyberspace BV | Holding Company | Netherlands | Amsterdam | Combined Leadership 3 |
| Tesonet | Business Incubator | Lithuania | Vilnius, Kaunas | Tom Okman, E. Sabaliauskas 3 |
The transition from the British Virgin Islands to the Netherlands for Surfshark’s headquarters in October 2021 reflects a broader industry trend of “jurisdictional arbitrage,” where companies seek to balance consumer privacy protections with the needs of global financial compliance and investor expectations.4 This structural shift was a prerequisite for the subsequent massive influx of venture capital, which brought the entity into the orbit of some of the world’s most influential technology investors, many of whom maintain extensive portfolios in the Israeli defense and surveillance sectors.
The most significant indicator of Surfshark’s economic complicity is found in its investment history. The entity achieved “Unicorn” status in 2022 following a $100 million investment round that valued the company at $1.6 billion.1 A second $100 million round in 2023 doubled this valuation to $3 billion.7 The firms leading these rounds—Novator Partners, Warburg Pincus, and General Catalyst—are not merely financial backers; they are strategic players in the global security-industrial complex, with deep and documented ties to the Israeli technology ecosystem.
Novator Partners, led by the Icelandic billionaire Thor Björgólfsson, was a primary investor in the 2022 funding round.7 While Novator’s portfolio is diverse, encompassing telecommunications (Play in Poland, WOM in Chile) and fintech (Monzo), its involvement in the Israeli cybersecurity market is substantial and of particular forensic interest.11 Novator participated in a $400 million Series E investment round for Claroty, an industrial cybersecurity company with headquarters in New York and deep R&D roots in Israel.11
Claroty is widely regarded as an elite player in the protection of critical infrastructure and is frequently staffed by veterans of the Israel Defense Forces’ (IDF) technological intelligence units. The financial link between Novator—a lead investor in Surfshark—and Claroty—a pillar of the Israeli industrial security market—creates a material nexus where capital is pooled and redistributed between consumer-grade privacy tools and state-level industrial defense systems. This overlap suggests that the revenue generated by Surfshark users contributes to the financial health of an investment firm that simultaneously fuels the growth of high-level Israeli defense unicorns.
The 2023 funding round for Surfshark’s parent group was led by Warburg Pincus, a private equity giant with over $85 billion in assets under management and a history of investing in more than 1,100 companies.14 Warburg Pincus operates with a “One Firm” model, integrating expertise across technology, financial services, and healthcare.14 The firm’s commitment to environmental, social, and corporate governance (ESG) is publicized, yet its portfolio includes multiple entities that are deeply embedded in the Israeli security infrastructure.15
For instance, Warburg Pincus was a major investor in Cyren (formerly Commtouch), an Israeli cloud security solutions developer.15 Furthermore, the firm has backed companies like Personetics, which maintains research and development centers in Nazareth and Tel Aviv.17 The firm’s leadership often holds positions in charitable and civic organizations that support the welfare of the communities where they invest, which, in the case of Israeli-based firms, indirectly contributes to the socio-economic stability of the state’s technology sector.16 The participation of Warburg Pincus as a lead financier for Surfshark establishes a pipeline of capital that links the Lithuanian-founded VPN directly to one of the primary architects of the global security investment landscape.
General Catalyst, another significant investor in the Surfshark/Nord Security group, has increasingly focused its capital on the Israeli cybersecurity sector.7 In 2025, reports indicated that global venture capital firms, led by giants like General Catalyst, Sequoia, and Greylock, surpassed domestic Israeli investors in every stage of funding for the first time.18 This internationalization of the Israeli “Cyber Nation” involves a total investment flow of $4.4 billion across 130 rounds in 2025 alone.18
General Catalyst often utilizes a “split-seed” strategy, co-investing with local Israeli VCs to leverage “boots on the ground” expertise while providing the scale and reach of global capital.20 By including Surfshark in its portfolio alongside dozens of Israeli cyber startups, General Catalyst effectively integrates the consumer VPN market into a broader financial strategy that prioritizes the growth and global dominance of Israeli-led security platforms. This strategy ensures that Surfshark’s financial success is interconnected with the overall health and expansion of the Israeli technology sector, which is a key driver of the state’s economic and military power.
| Investor Firm | Key Israeli / Security Holdings | Nature of Support | Nexus of Complicity |
|---|---|---|---|
| Novator Partners | Claroty, Monzo, Play, WOM | Growth Capital, Series E | Industrial defense/Critical infra 11 |
| Warburg Pincus | Cyren, Personetics, Perfios | Cloud security, R&D Nazareth | Cloud defense/Financial tech 15 |
| General Catalyst | Multiple Israeli Cyber Startups | Seed & Early-stage, Split-seed | “Cyber Nation” leadership 18 |
| Burda Principal Inv. | Nord Security, various fintech | Late-stage growth capital | Broad tech infrastructure 7 |
Beyond the layers of ownership and investment, Surfshark maintains a physical operational presence within the Israeli jurisdiction. This footprint is essential for providing its users with Israeli IP addresses and high-speed local connectivity.21 However, from a forensic accounting perspective, this presence necessitates fiscal and legal engagement with the Israeli state and its private sector infrastructure providers.
Surfshark operates eight servers in Tel Aviv, characterized as high-speed, RAM-only nodes.21 The use of RAM-only (diskless) servers is a technical safeguard designed to ensure that data is not persistently stored on hardware, which is a critical feature for users seeking to avoid state surveillance.21 Despite these technical mitigations, the physical location of these servers within Tel Aviv means that Surfshark must lease space, bandwidth, and power from local data centers and telecommunications providers.
The revenue generated by these lease agreements contributes to the Israeli economy and the tax base of the state. Furthermore, the parent organization, Nord Security, maintains an even larger footprint in Tel Aviv, with over 20 servers.23 When viewed as a unified holding group under Cyberspace BV, the collective infrastructure in Israel is substantial, making the organization a material customer of the Israeli technology and telecommunications industry.
| Provider | Location(s) | Server Count | Tech Specs | Jurisdictional Risk |
|---|---|---|---|---|
| Surfshark | Tel Aviv | 8 | RAM-only, Bare-metal | “Fourteen Eyes” associate 21 |
| NordVPN | Tel Aviv | 20+ | RAM-only, Tor support | Physical hardware access 23 |
| ExpressVPN | Tel Aviv | 1+ | RAM-only, Lightway | Owned by Kape Tech (Israeli) 23 |
| CyberGhost | Jerusalem, Tel Aviv | 51+ | RAM-only | Massive footprint in Jerusalem 23 |
| Proton VPN | Petah Tikva, Tel Aviv | 14+ | High-security Core | Minimal regional ties 22 |
The presence of servers in Jerusalem (as seen with CyberGhost) is particularly significant due to the city’s contested status and the ongoing occupation. While Surfshark has focused its infrastructure on Tel Aviv, the unified management of Cyberspace BV implies that the group as a whole must navigate the complex legal and regulatory requirements of the Israeli state, including potential requests for cooperation from the Ministry of Communications or security agencies.21
The prompt identifies the “Aggregator Nexus” (e.g., Mehadrin, Hadiklaim) as a core intelligence requirement for determining economic complicity. These firms aggregate agricultural and industrial produce from across the Green Line, facilitating the international sale of products from Israeli settlements in the West Bank and Gaza. While Surfshark is a digital service provider rather than an agricultural importer, a forensic supply chain audit reveals several indirect points of overlap within the aggregator nexus.
The financial institutions and private equity firms that back Surfshark—such as Warburg Pincus—also maintain significant interests in the broader Israeli economy, which includes industrial and manufacturing sectors that overlap with agricultural aggregators.14 For example, Warburg Pincus’s “One Firm” model focuses on Industrials and Business Services, sectors that provide the logistics, software, and financial instruments used by large-scale exporters like Mehadrin.14
The 2025 “Cyber Nation” report highlights that Israeli companies are increasingly becoming “platform builders,” acquiring other startups to create consolidated technology suites.18 This consolidation mirror the aggregator models seen in agriculture. In the same way that Mehadrin aggregates produce to control market share and bypass international scrutiny, firms like Nord Security/Surfshark aggregate privacy and security tools to control the flow of user data and subscription revenue.3 The capital flow from these aggregators is ultimately fungible, contributing to the overall liquidity and stability of the Israeli banking system, which is the primary financier of the occupation.30
The infrastructure used to protect and manage the digital assets of firms like Surfshark often shares providers with the security firms that protect industrial and agricultural assets in the occupied territories. The “security for AI” and “endpoint security” surged in 2025, with dozens of rounds led by US VCs like General Catalyst.18 These technologies are increasingly “dual-use,” being deployed both for consumer privacy and for the surveillance and monitoring of critical infrastructure, including the water and power grids that service settlements and the “security fence”.31
The IDF spokesperson and the internal security agency Shabak have revealed the use of sophisticated digital campaigns and IoT tracking to monitor troop movements and thwart intelligence leaks.32 The technology required for these operations—ranging from VPN-like obfuscation to advanced traffic analysis—is developed within the same “Cyber Nation” ecosystem that Surfshark’s investors are actively building.18
Seasonality analysis is traditionally applied to agricultural cycles, where the export of settlement produce peaks during specific months. In the forensic audit of a cybersecurity firm, seasonality is observed in the correlation between regional conflict cycles and the surge in market demand for privacy tools, as well as the timing of investment rounds.
Research indicates that internet disruptions and state-sponsored surveillance often peak during periods of geopolitical instability.32 Surfshark’s “Internet Shutdown Tracker” provides a year-round record of these disruptions, yet the entity’s own marketing and growth are frequently buoyed by the increased visibility of digital rights issues during such times.1 The 2025 data shows that despite the ongoing war, investment in the Israeli cybersecurity industry hit new records, reaching $4.4 billion.20 This “security surge” is a form of digital seasonality where the escalation of conflict provides a catalyst for both state-led innovation and the influx of foreign venture capital.
Analysts describe 2025 as a “building year” for the Israeli cyber industry, with a sharp increase in seed and Series A rounds.20 This timing aligns with Surfshark’s own rapid expansion following its 2022-2023 funding rounds.1 The strategic influx of $100 million rounds for Surfshark was timed to coincide with a broader market consolidation and a period of heightened awareness of the importance of digital security in a multipolar, conflict-prone global environment.3
The “split-seed” strategy favored by firms like General Catalyst allows them to enter the market during these periods of high risk and high opportunity, mitigating risk by co-investing with local experts who have “boots on the ground”.20 This cyclical investment pattern ensures that the capital flows into Surfshark are part of a broader, season-sensitive strategy that capitalizes on the persistent demand for security solutions in the Middle East and beyond.
A critical component of institutional complicity in the Israeli context is the relationship between private technology firms and the elite technological units of the IDF, most notably Unit 8200.15 While Surfshark’s founders are Lithuanian, the entity’s integration into the global cybersecurity market brings it into constant proximity with the veterans of these units.
The Israeli high-tech sector is characterized by a “revolving door” where military intelligence officers transition into the private sector to found unicorns like Claroty, Cyren, and XM Cyber.11 These firms are often built using technologies developed during military service, effectively commercializing tools designed for state-level surveillance and signals intelligence.31
Surfshark’s economic complicity is evidenced by its inclusion in the investment portfolios of firms that are the primary financiers of this military-to-civilian transition. When General Catalyst or Warburg Pincus lead funding rounds for Surfshark, they are using the same capital pools that support firms founded by Unit 8200 veterans.18 This creates a state of “ideological and material support” for the militarization of the technology sector, as the financial success of consumer tools provides the necessary capital and legitimacy for the expansion of more overtly militarized cybersecurity entities.
The technologies used by Surfshark—such as encryption, traffic obfuscation, and IP rotating—are inherently dual-use.21 In a consumer context, they protect digital rights. In a state context, they are used by agents to conduct covert operations, as seen in the recruitment of Israelis by Iranian agents via social media or the IDF’s thwarting of avatar infrastructures.32 The Israeli “Cyber Nation” report for 2025 emphasizes that the industry is consistently producing “category-leading companies at global scale” that define the market.18 By being a participant in this market, Surfshark contributes to the overall technological and economic strength of a system that is fundamentally geared toward the maintenance of security dominance.
The objective of this report is to provide the data necessary to rank Surfshark based on its economic complicity. The forensic audit has mapped the footprint across five key dimensions: ownership, investment flows, infrastructure, supply chain overlap, and institutional associations.
Surfshark is owned by Cyberspace BV, a Dutch holding company with deep ties to the Lithuanian tech incubator Tesonet.1 While its founders are not Israeli, the leadership has consciously chosen to integrate the entity into a global financial system dominated by investors with substantial Israeli defense portfolios.7 This structural choice represents a material and ideological alignment with a capital market that prioritizes the growth of the Israeli security industry.
The entity has received $200 million in funding led by Novator Partners, Warburg Pincus, and General Catalyst.7 These firms are primary backers of Israeli cybersecurity unicorns and are the leading sources of capital for the “Cyber Nation” ecosystem.11 The capital generated by Surfshark users flows into firms that are simultaneously funding the commercialization of technologies developed by Israeli military intelligence.
Surfshark maintains 8 servers in Tel Aviv, and its parent group maintains 20+ more.21 These servers are housed in Israeli data centers, requiring ongoing fiscal engagement with the Israeli state and private sector. This presence subjects a portion of Surfshark’s traffic to the jurisdictional reach of the Israeli legal and security apparatus, an associate of the “Fourteen Eyes” alliance.22
While not an agricultural importer, Surfshark shares financial sponsors and logistical service providers with the broader Israeli industrial sector.14 The entity operates as a “digital aggregator,” mirroring the market-control strategies of firms like Mehadrin. The technologies it utilizes are dual-use, with significant overlap in the R&D labs that produce surveillance and monitoring tools for both consumers and state security forces.31
| Complicity Dimension | Key Evidence / Data Point | Status |
|---|---|---|
| Direct Ownership | Cyberspace BV (Netherlands/Lithuania roots) | Moderate Indirect |
| Institutional Invest. | $200M from Novator, Warburg, General Catalyst | High Material 7 |
| Investor Portfolios | Claroty, Cyren, Personetics (Israeli security) | High Material 11 |
| Local Infrastructure | 8 servers in Tel Aviv; 20+ for parent group | Physical Presence 21 |
| Jurisdictional Link | Fourteen Eyes associate jurisdiction (Israel) | Regulatory Exposure 22 |
| Market Sector | Participant in “Cyber Nation” ecosystem | Structural Complicity 18 |
The forensic audit of Surfshark must be viewed within the context of the wider VPN and cybersecurity industry. The consolidation of the market has seen several major players come under the control of entities with even more direct ties to the Israeli security establishment.
Kape Technologies, owned by Israeli billionaire Teddy Sagi, represents the highest level of direct economic complicity in the industry.26 Kape owns ExpressVPN, CyberGhost, and Private Internet Access, and was once associated with adware distribution.26 In contrast, Surfshark’s complicity is characterized by its financial and institutional architecture. While Surfshark lacks the direct “founder-to-state” link of Kape, its reliance on global VCs like General Catalyst—which “doubled down” on Israeli cyber in 2025—places it firmly within the same security-industrial ecosystem.20
Proton AG, based in Switzerland and owned by a non-profit foundation, represents the lowest level of economic complicity in the context of this audit.37 Proton maintains a minimal regional presence and its ownership structure is designed to maximize independence from state and venture capital influence.22 Surfshark’s choice to pursue massive VC-led funding at a $3 billion valuation represents a fundamental departure from the model of jurisdictional and financial neutrality.7
