NordVPN shipped a small cluster of consumer-facing features this month that share a common theme: making its existing security tools visible rather than invisible. The headline addition, scam protection statistics, rolled out to Android on July 21 and iOS shortly after, and it answers a question a lot of users have quietly had about background security features in general: is this actually doing anything?
What the new statistics show
Threat Protection Pro, NordVPN’s bundled security layer, has blocked malicious websites, intrusive ads, trackers, and other unwanted content in the background for a while. Until this update, it did that silently, with no easy way for a user to see what, if anything, had actually been stopped. The new statistics screen changes that, surfacing a running count of blocked malicious sites, intrusive ads, and trackers directly in the app, broken down in a way that makes the feature’s activity visible rather than assumed.
This lands alongside a smaller but related change shipped on July 17: a cookie banner hider built into the app’s next-gen antivirus component, which reduces the number of cookie consent pop-ups a user has to dismiss while browsing. Neither feature is a fundamentally new security capability, both build on tools NordVPN already had, but together they represent a shift toward showing users evidence of what’s happening rather than asking them to take it on faith.
Why visibility features like this matter
Background security tools have a well-known adoption problem: features that work silently are easy for users to forget exist, undervalue, or assume are unnecessary once nothing bad has visibly happened for a while. A visible statistics counter addresses that directly, giving users a concrete reason to trust that a feature they’re paying for (Threat Protection Pro isn’t limited to the free tier of NordVPN’s product) is actually doing something, not just sitting in a settings menu.
It also mirrors what antivirus software has done for years, showing threat counts and scan histories, applied here to a VPN’s bundled security layer instead. As VPN providers increasingly bundle antivirus, ad-blocking, and scam detection into what used to be a single-purpose tunneling app, borrowing this kind of visibility convention from traditional security software is a reasonable, low-risk way to make the bundle feel more substantive.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Part of a steady drip of smaller NordVPN releases in 2026
This isn’t an isolated release. Earlier in July, NordVPN’s browser extensions for Chrome, Edge, and Firefox turned on scam and phishing protection by default for new installations, removing a setup step that previously required users to enable it manually. Going back further this year, the company shipped NordWhisper-based obfuscated servers, a redesigned mobile app experience, and a CrowdStrike-powered Threat Intelligence integration for Threat Protection Pro, all part of the same steady cadence covered in our 2026 NordVPN updates recap.
None of these individually amount to a major architectural shift, but the cumulative pattern is a company treating its bundled security features as an active product line getting regular attention, rather than a checkbox added once and left alone. For users deciding between providers with similar core VPN performance, this kind of ongoing feature cadence is a reasonable secondary signal of how much active investment a provider is putting into the product beyond the tunnel itself.
How this stacks up against what competitors show
Most major VPN providers that bundle a security layer, Surfshark’s CleanWeb, ExpressVPN’s Threat Manager, and others, offer some version of ad and tracker blocking, but visible, ongoing statistics inside the app itself have been the exception rather than the norm. Some competitors surface a one-time count during setup or a vague “protected” badge rather than a running, updating tally. If NordVPN’s statistics screen holds up well with users, it’s a reasonably low-cost feature for competitors to copy, and given how closely providers already track each other’s feature releases, a similar statistics view from at least one other major provider within the next few release cycles wouldn’t be surprising.
Availability
Both the scam protection statistics and the cookie banner hider are live now in the current NordVPN app versions for Android and iOS, included for all Threat Protection Pro users without a separate opt-in or higher-tier subscription requirement. Updating to the latest app version from the Play Store or App Store is all that’s needed to see the new statistics screen.
What to check if you want to see it yourself
Existing NordVPN subscribers on Threat Protection Pro don’t need to change any settings to get this, updating the app is the only step. Once updated, the statistics screen sits in the app’s security or protection section alongside the existing Threat Protection Pro toggle, and it starts counting from whenever the update was installed rather than retroactively estimating past activity. Give it a few days of normal browsing before checking the numbers, a fresh install with an hour of use won’t show much simply because there hasn’t been enough browsing activity yet for the counters to reflect anything meaningful.
Neither feature here is groundbreaking on its own, but the pattern behind them is worth noting: NordVPN is making its bundled security tools legible rather than leaving them as background assumptions. For existing subscribers this is a welcome, no-cost visibility improvement. For anyone comparing providers, it's a small data point in NordVPN's favor on ongoing product investment, though not a reason on its own to switch providers.
What the statistics screen actually shows
In practice, the new screen breaks its counts into a few categories: malicious and phishing sites blocked before they loaded, intrusive ad and tracker requests stopped, and a running total since the feature was last reset or the app installed. It’s presented as a simple dashboard rather than a detailed log, there’s no per-site history to browse, which is a deliberate privacy choice: showing aggregate counts gives users the reassurance of visible activity without creating a stored record of exactly which sites triggered each block, the kind of data a no-logs-focused provider has reason to avoid retaining even locally on-device in a browsable form.
A reasonable response to a common criticism
Bundled VPN security features (ad blocking, malware protection, scam detection) have drawn some skepticism over the years precisely because they’re hard for an average user to evaluate. Unlike a VPN’s core function, hiding your IP and encrypting your traffic, which most people can verify themselves with a quick IP lookup, a background threat-blocking feature offers no easy way to confirm it’s doing anything at all. A visible statistics counter is a fairly direct answer to that skepticism, even if it’s a relatively simple feature to build. Whether competitors follow with something similar is worth watching, since bundled security features are becoming a bigger part of how VPN providers differentiate from each other now that core VPN performance across the top providers has become fairly similar.
What to make of the numbers themselves
One caveat worth keeping in mind: a high block count isn’t automatically a sign of superior protection, it can also reflect aggressive default filtering that flags borderline content along with genuinely malicious sites. Without a shared benchmark across providers, NordVPN’s counter is useful mainly as a personal, relative signal, more blocked this week than last week, rather than a number you can meaningfully compare against a competitor’s own statistics screen if one appears. Treat it as a visibility feature rather than a scoring mechanism, and the update is a straightforwardly positive one regardless of how the raw counts compare across apps.
Keep reading: NordVPN’s 2026 Updates Recap and NordVPN’s NordWhisper Obfuscated Servers, Explained.