You buy a VPN to protect yourself from corporate surveillance. The question that almost no review will answer is: which corporation are you handing your traffic to?
Five years of mergers and acquisitions have quietly turned the consumer VPN market into a much smaller club than the marketing implies. The “comparison” articles ranking ten products often turn out to be ranking variations of the same three or four parent companies. Here’s the actual picture as of mid-2026, with names attached.
Kape Technologies is the consolidator that gets the most coverage, and probably deserves it. Originally a company called Crossrider — which, to put it charitably, had a complicated history with adware in the early 2010s — Kape rebranded and pivoted into the privacy space starting around 2017. They now own ExpressVPN (acquired 2021 for ~$936M), Private Internet Access (acquired 2019), CyberGhost (acquired 2017), and Zenmate (acquired 2018). The four brands continue to operate independently with separate infrastructure, but the financial and strategic decisions roll up to the same Tel Aviv-headquartered parent. Kape was itself taken private in early 2023 by Unikmind Holdings, controlled by founder Teddy Sagi. If you’re doing the math: a non-trivial fraction of the “competitive” VPN market is making decisions in the same boardroom.
Nord Security, the parent of NordVPN, completed a merger with Surfshark in early 2022. Both brands continue to market against each other and operate separate apps and server fleets, but the holding company is the same, and both ultimately trace back to the Lithuanian Tesonet ecosystem (which also operates Oxylabs, a major proxy network). Tesonet, in turn, has been the subject of persistent questions about its early NordVPN involvement that Nord has spent years addressing. The current corporate structure is cleaner than the early days, but if you specifically want a VPN that has no relationship to Surfshark, NordVPN is not it.
Proton AG, headquartered in Plan-les-Ouates near Geneva, remains genuinely independent. The company is structured as a Swiss stock corporation with the Proton Foundation holding the controlling stake — an unusually privacy-protective ownership structure that limits the kind of acquisition pressure that has consumed most competitors. Proton was founded by physicists from CERN and has held the same leadership since 2014. Whatever you think of their product, the corporate alignment with their stated mission is among the strongest in this market.
Mullvad, owned by the Swedish company Amagicom AB, is similarly independent and similarly small. Their refusal to do affiliate marketing, refusal to offer discount pricing, and refusal to accept anything other than cash, Bitcoin, Monero, or PayPal for payment are all design choices that signal their priorities. Mullvad has never been acquired and has stated repeatedly that they’re not interested in growth at the expense of independence. They remain the favorite of the privacy purists for reasons that go beyond product features.
IVPN (operated by Privatus Limited in Gibraltar) is another small independent that has resisted consolidation. The product is reasonable, the company is principled, and the customer base remains modest.
A handful of other notable players: Windscribe (Canadian, independent, founder-controlled), AirVPN (Italian, run by hacktivists, idiosyncratic), TunnelBear (acquired by McAfee in 2018, which is itself now part of a complicated PE-controlled portfolio), Hotspot Shield/Pango (acquired by Aura in 2020, which is owned by World Wide Web Solutions), and Hide.me (German parent, independent).
The pattern that emerges:
The largest and most aggressively-marketed VPNs are mostly owned by two holding companies (Kape and Nord Security). The independents — Proton, Mullvad, IVPN, Windscribe — tend to be smaller, less marketed, and run by people with explicit ideological commitments to staying that way.
There’s no rule that says ownership concentration is inherently bad. Plenty of well-run consumer products belong to large parent companies. But for a category like VPN where the entire pitch is “trust this company with your traffic,” it’s worth knowing whose company you’re trusting. A “comparison review” that ranks ExpressVPN above CyberGhost above PIA is, in some meaningful sense, ranking three siblings.
When you next see a “10 best VPNs” article that pretends these are ten independent choices made on merit, do the corporate-ownership lookup. The results are usually instructive.
—
This piece is part of our News & Industry coverage. We publish ownership and structural analysis because it doesn’t usually appear in product reviews, and because it changes the meaning of those reviews. To suggest a topic, email [email protected].
Sources: Kape Technologies investor disclosures (2021–2023); Nord Security press release (Feb 2022); Proton AG corporate filings via Swiss commercial registry; public statements from Mullvad and IVPN; RestorePrivacy and TechCrunch coverage of acquisitions referenced. We have no current or past commercial relationship with Kape Technologies, Nord Security, or any holding company referenced.