Surfshark just raised the stakes in the consumer cybersecurity market. The Lithuania-headquartered VPN provider announced that its top-tier subscription plan, Surfshark One+, now includes up to $1 million in identity theft insurance coverage — a move that signals how aggressively VPN companies are expanding beyond their original mandate of encrypting internet traffic.
The new coverage, underwritten through a partnership with an undisclosed insurance provider, applies to financial losses stemming from identity theft, including stolen funds, legal fees, and recovery expenses. It’s bundled into Surfshark One+, which already packages the company’s VPN service with antivirus protection, a data breach monitoring tool called Alert, a private search engine, and an ad-blocking feature known as CleanWeb. As TechRadar reported, the addition transforms what was already one of the more comprehensive consumer security bundles on the market into something that looks less like a VPN plan and more like a digital insurance policy.
This isn’t a vanity number. A million dollars in coverage addresses the real arithmetic of identity theft recovery, which the Federal Trade Commission has documented can stretch into tens of thousands of dollars in direct losses for severe cases — and sometimes far more when legal costs, lost wages, and credit restoration are factored in. The FTC received more than 1.1 million identity theft reports in 2023 alone, a figure that has roughly doubled since 2019.
So why is a VPN company getting into the insurance business?
The answer lies in a structural shift across the consumer cybersecurity industry. Pure VPN services have become commoditized. Encryption protocols are largely standardized. Server networks have expanded to the point where most major providers cover 100+ countries. Price wars have compressed margins. The result: VPN providers need to sell more than just encrypted tunnels to justify their subscription fees and reduce churn. Surfshark’s response has been to build an integrated security product that bundles prevention, detection, and now financial remediation into a single monthly payment.
Surfshark One+ is priced at $5.99 per month on a two-year plan, or $17.95 month-to-month. That positions it at a premium to the base Surfshark Starter plan ($2.19/month on a two-year commitment) but competitively against standalone identity theft protection services from companies like LifeLock, which can run $25 or more per month. The bundling strategy is deliberate — it makes the upsell to One+ more attractive by stacking value layers that would cost significantly more if purchased separately.
The identity theft insurance component works as a reimbursement mechanism. If a subscriber’s identity is stolen and they incur covered losses, they can file a claim for reimbursement up to the $1 million cap. The coverage reportedly extends to expenses like legal fees, lost wages due to time spent resolving the theft, and costs associated with restoring credit and financial accounts. Surfshark’s Alert tool, which monitors for personal data appearing in known breach databases, serves as the early-warning system designed to catch compromises before they escalate to full-blown identity theft.
This model mirrors what Norton has done with Norton 360 with LifeLock, which bundles VPN, antivirus, dark web monitoring, and identity theft insurance into tiered plans. Norton’s LifeLock integration — born from its $4.7 billion acquisition of LifeLock parent Symantec’s consumer division restructuring and subsequent deals — has been one of the more commercially successful examples of this convergence. Surfshark is essentially replicating that playbook without the acquisition overhead, instead partnering with an insurance underwriter to bolt on coverage.
But Surfshark faces a credibility question that Norton doesn’t. Norton has decades of brand recognition in security software. Surfshark, founded in 2018, is still a relative newcomer. And while the company has grown rapidly — it merged with Nord Security in 2022, creating a combined entity that also owns NordVPN — it still carries the perception of being a VPN-first company trying to stretch into adjacent categories. Whether consumers will trust a VPN brand to be their identity theft insurer is an open question.
The merger with Nord Security is itself a relevant backdrop. The combined company hasn’t fully consolidated its product lines; NordVPN and Surfshark continue to operate as separate brands with distinct pricing and feature sets. But the shared infrastructure and resources have allowed both brands to accelerate feature development. NordVPN has its own expanded offering, NordProtect, which similarly includes identity theft insurance for U.S. customers. The parallel development suggests this is a strategic priority across the entire Nord Security portfolio, not just a Surfshark marketing initiative.
Industry analysts have noted that the consumer security market is increasingly defined by breadth of coverage rather than depth in any single category. Consumers don’t want to manage five separate subscriptions for VPN, antivirus, password management, breach monitoring, and identity protection. They want one. The companies that can credibly offer a unified product at a reasonable price point are positioned to capture disproportionate market share. Surfshark’s One+ bundle is a direct play for that consolidation.
There are limitations, of course. The $1 million figure is a ceiling, not a guarantee. Claims are subject to policy terms and conditions that Surfshark hasn’t fully detailed publicly. Insurance reimbursement processes can be slow and bureaucratic. And the coverage is currently available only to subscribers in select markets — primarily the United States, where identity theft insurance is a regulated product that requires specific underwriting partnerships.
The timing of the announcement also coincides with heightened consumer anxiety about data breaches. The past 12 months have seen major incidents affecting AT&T, Ticketmaster, Change Healthcare, and others, exposing hundreds of millions of records. Each headline-grabbing breach drives a spike in consumer interest in identity protection services. Surfshark is positioning itself to capture that demand at the moment of maximum concern.
There’s a broader competitive dynamic at work, too. Apple has expanded its privacy features with iCloud Private Relay and is rumored to be exploring deeper security integrations. Google offers dark web monitoring through its Google One subscription. Even credit bureaus like Experian sell identity theft protection plans. The market is getting crowded from every direction — tech giants, financial services companies, and dedicated cybersecurity firms are all converging on the same consumer need.
For Surfshark, the $1 million insurance addition is as much a retention tool as an acquisition tool. Subscribers who rely on Surfshark for identity monitoring and who have an active insurance policy through their subscription are far less likely to cancel. The switching costs become psychological as much as financial. Cancel your VPN, and you lose your identity theft safety net. That’s a powerful lock-in mechanism.
Whether the coverage will ever be tested at scale remains to be seen. Identity theft insurance claims are relatively infrequent compared to, say, auto or health insurance claims, which keeps the cost of underwriting manageable. For the insurance partner, the economics likely work because the expected payout across the subscriber base is modest relative to the premium revenue flowing through Surfshark’s subscription fees. For Surfshark, the cost of adding insurance to the bundle is likely a small fraction of the subscription price — a low-cost feature with outsized perceived value.
The move also raises a question about what comes next. If VPN companies are now offering million-dollar insurance policies, what’s the next logical extension? Credit monitoring with real-time alerts? Automated fraud dispute resolution? Direct integration with banking apps? The trajectory points toward VPN providers becoming comprehensive digital safety platforms — a far cry from the single-purpose tools they were a decade ago.
Surfshark’s bet is that consumers will pay a modest premium for peace of mind wrapped in a single subscription. Given the relentless pace of data breaches and the growing sophistication of identity thieves, it’s a bet that looks increasingly rational. The question isn’t whether bundled security-plus-insurance products will find a market. It’s whether Surfshark can build enough trust to own that market before the giants do.
WebProNews is an iEntry Publication