2025 has been a year of significant VPN shake ups. We've seen new providers burst onto the scene, established names leading industry innovation, and middle-of-the-road VPNs undergo some serious improvements.
Norton VPN can certainly be described as doing the latter. It's now a notable challenger to the best VPNs, having undertaken a huge feature drive this year. It's totally revamped its product offering and has been aided by ex-ExpressVPN Head of Product, Himmat Bains, joining its ranks.
Are the walls closing in on VPNs?
This year hasn't been completely plain sailing for the VPN industry. We've seen an increase in attacks on VPNs and global age verification legislation has directly impacted and targeted use of the privacy tools.
Combine this with anti-piracy court cases and increasing internet censorship, VPNs are being targeted more than ever.
VPN Product Lead Himmat Bains stopped short of saying the walls are closing in, but admitted there is a "pressure." Product Communications Lead, Mike Healey, added that attacks on VPNs are happening.
"It's happening and I think that it's going to be something that it's likely to continue to happen," Healey said. "But our fundamental priority here is to provide privacy protection for people, and we will continue to do that, whatever the case may be."
Norton VPN's primary defence against internet censorship is its proprietary obfuscating protocol is Mimic. As its name suggests, it's designed to mimic regular internet traffic.
John Mah, Norton VPN's Engineering Director, said the team has seen "significant usage" of Mimic in certain global regions. The team is confident in its ability to protect those who need it and live under internet censorship – something Mah described as an "evolving space" and "cat and mouse game."
The Mimic protocol has just passed its first independent audit with flying colors.
We have seen examples this year of VPN providers forming a united front, opposing attacks on the industry and fighting legal cases. The VPN Trust Initiative (VTI), part of the i2 Coalition, is the most prominent example of VPN collaboration. Members include NordVPN, ExpressVPN, and IPVanish.
Norton VPN isn't a member of the VTI, or any other VPN coalition. It was a smaller player this time last year, but now that the product has grown, Bains wants to devise a plan on how to become a "bigger part" of the industry conversation.
"Things like the i2 Coalition are great initiatives. They're super initiatives, and we are always evaluating things that we can be a part of as a company," said Bains.
Our fundamental priority here is to provide privacy protection for people
Mike Healey, Communications Lead
Despite being competitors in a crowded market, most VPN companies share a commitment to protecting the online privacy of internet users. Bains personally "wouldn't be surprised" if continued and growing external pressure would see VPN companies work together more.
Healey said there are many cases of cybersecurity companies coming together against a common cause, but Bains didn't believe this was the quite the time for VPNs to do the same. He thought "it will come" but "not just yet."
US headquarters shouldn't be a concern
As part of Gen Digital, Norton VPN is based in the United States. This is somewhat uncommon for a VPN company, with many providers choosing to be based in countries with stronger data privacy laws.
We asked if privacy-conscious users would be worried by this fact but the Norton VPN team stressed this is only a problem "if you have data to give."
Bains doesn't see Norton VPN's US-base "as a cause for concern." He believed where a VPN is located isn't what users should be worried about. "I'd be looking at, what are you tracking? How long are you keeping data?" Bains continued.
Like all leading VPNs, Norton VPN operates a strict no-logs policy and, following an internal review of its data collection, only collects data "that is absolutely critical and essential."
Norton VPN previously retained connection event data for 24 months but this has been cut to 12 months. This data includes events such as successful and unsuccessful connections. The provider has also cut its application event data storage from 36 months to 18 months. This data includes information on app versions, which allows Norton VPN to determine when it can cut back support for older app versions.
Arguably the most important change has been the change in connection timestamp data. Previously Norton VPN collected this minute by minute. Connections are now recorded as the total number of connections over 24 hours – which Bains said is in line with competitors.
On top of this, Norton VPN releases quarterly transparency reports which detail the number of data requests it receives from government institutions. No customer data is handed over because it doesn't exist.
In October 2025, Norton VPN completed a second independent audit of its no-logs policy – something that will take place annually. The Mimic protocol audit followed in December.
Both audits were completed by VerSprite, with privacy and security standards incredibly high. There were no privacy impacts or exploitable vulnerabilities.
The audits, along with Norton VPN's privacy policy, can be read on the provider's website.
Becoming the VPN for the masses
Throughout our chat, the Norton VPN team didn't hide their ambitions. Martin Budac, Head of Privacy Products at Gen Digital, stated Norton VPN's end goal is "to be the VPN for the masses."
The team believed the way to do that comes down to user experience – something that is receiving a great deal of time and energy. Simplicity, ease of use, reliability, and "a lack of complication" were all motivating factors.
Having previously worked at Private Internet Access (PIA) and ExpressVPN, Himmat Bains brings a wealth of technical experience and knowledge about the VPN industry to Norton VPN.
He said he can bring an understanding of "actual, fundamental VPN." He knows what a VPN can and should look like, along with what it shouldn't. Bains said VPNs shouldn't be difficult to use and should unblock everything, adding "you can turn it on and forget it's there."
Products Bains has worked on range from the super technical to the super simple. With Norton VPN, he isn't going after the "very niche technical customers." The team is building a "technical product" with "usability" at its core.
One of the ways the Norton VPN team tests usability is asking if their parents, grandparents, children, and partners could use the product. Bains asks himself if his grandma could use the Norton VPN app. He said if it's something she understands, it works.
Norton is a big name in the world of cybersecurity and the VPN team said it holds itself to "incredibly high" Norton standards. They cite privacy and data transparency, the industry-leading 60-day money-back guarantee, and the recent feature drive as examples of this.
But this drive hasn't finished – Norton VPN has plenty more coming in the first part of 2026 and beyond. Recent network upgrades include 25 Gbps servers, as well as five new P2P-optimized cities and new server locations.
Alongside Mimic's audit, OpenVPN has received UDP and TCP options and DCO. The Norton VPN team excitedly teased more product upgrades, with announcements coming soon.
Norton VPN has big ambitions and it's well on the way to achieving them. Its VPN is a different beast to the product we saw at the end of 2024 and can now be considered a serious VPN option. Norton VPN is a sleeping VPN giant, and 2026 is looking like the year it wakes up.
We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.