A growing number of VPN providers have stopped selling just a VPN. NordVPN has Plus and Complete tiers. Surfshark has Surfshark One and One+. The pitch is simple: one subscription, one app, your VPN plus a password manager plus antivirus plus identity monitoring.
Sometimes that’s a genuinely good deal. Sometimes it’s a way to make the base VPN look artificially cheap while the “real” price is in a higher tier you’re nudged toward. Here’s how to tell the difference.
What the major bundles actually include
| Provider | Base tier | Higher tiers add |
|---|---|---|
| NordVPN | Basic (VPN + Threat Protection Lite) | Plus: password manager, data breach scanner. Complete: adds encrypted cloud storage |
| Surfshark | Surfshark Starter (VPN + basics) | Surfshark One: antivirus, identity/data breach alerts. One+: adds identity theft insurance in supported regions |
| ExpressVPN | VPN standalone | Identity Defender add-on: identity theft protection and data removal, sold as an add-on rather than a full tier |
| ProtonVPN | VPN standalone (or part of Proton Unlimited) | Proton Unlimited bundles VPN with Proton Mail, Proton Drive, Proton Pass (password manager) at the Proton ecosystem level, not VPN-tier level |
The pattern: the VPN core is always identical across tiers from the same company. What changes is which additional standalone products get bundled in, and Nord, Surfshark, and Proton have each built out a broader security or productivity ecosystem around their VPN rather than treating it as a single product.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
When the bundle is a genuinely good deal
If you’re currently paying for a password manager, antivirus, and a VPN as three separate subscriptions, consolidating into one provider’s bundle can lower your total monthly spend meaningfully, sometimes by close to half, because bundled pricing is discounted relative to buying each piece at full standalone price.
It also simplifies billing and reduces the number of apps and accounts you have to manage, which has real value even setting aside the pure dollar math. One login, one renewal date to track, one support channel if something breaks.
See NordVPN’s Plus and Complete tiers
When you’re paying twice for the same thing
If you already use and like a specific password manager (1Password, Bitwarden) or antivirus (Bitdefender, Malwarebytes), a VPN bundle doesn’t save you anything: you’d either keep paying for your existing tool alongside the bundle, defeating the purpose, or switch to a less familiar tool just because it happened to be bundled.
The password manager category especially rewards sticking with a dedicated, focused product. Password managers live in your browser and every device you own for years; switching has real friction (re-saving every credential, re-training browser autofill habits), and a VPN provider’s password manager is rarely the best-in-class option in that category on its own merits.
Also worth noting: none of these bundles make the VPN itself better. Nord’s Threat Protection, Complete, and Plus tiers all run the identical VPN infrastructure, speed, and server network as Basic. You’re never buying a faster or more private VPN by upgrading tiers, only additional unrelated products.
The identity monitoring and antivirus add especially varies
Antivirus and identity-theft monitoring, when bundled, are frequently licensed from or built by a different underlying company than the VPN itself, and quality varies. Some bundled antivirus engines score well in independent testing (AV-Test, AV-Comparatives); others are more basic than what a dedicated antivirus product offers at a similar price point. If antivirus protection is a serious priority rather than a nice-to-have, check independent antivirus test results for the specific engine behind the bundle rather than assuming “comes from a well-known VPN provider” implies “well-tested antivirus.”
Identity monitoring (dark web scans, data breach alerts) tends to be more uniformly useful across providers, since it’s largely a database-lookup service rather than something that needs deep, continuously updated malware detection engineering.
How to decide
Starting from scratch with no password manager, no antivirus, and shopping for a VPN anyway: a bundle from NordVPN or Surfshark One is worth comparing against buying three separate best-in-class tools. The bundle will usually be cheaper in raw dollars, though not always by as much as the marketing implies.
Already have tools you like: buy the base VPN tier only. Don’t let an upsell talk you into paying for a password manager or antivirus you’ll never actually use because you already have a better one.
Specifically want top-tier antivirus or password management: buy those as dedicated products from companies that specialize in them, and buy your VPN separately based on VPN-specific criteria (speed, jurisdiction, audits, streaming performance). A bundle optimizes for convenience, not for best-in-class in every category simultaneously.
NordVPN's Plus and Complete tiers and Surfshark One are the most complete all-in-one security bundles among major VPN providers. They make real financial sense if you're starting from zero on a password manager and antivirus and would otherwise pay for all three separately. If you already have tools you like, skip the upsell and buy the base VPN tier: the VPN itself is identical at every tier, so you're never sacrificing VPN quality by declining the bundle.
Keep reading: Best VPN Money-Back Guarantee and Refund Policies Compared 2026 and NordVPN Pricing Guide 2026: When to Buy for the Best Deal.