NordStellar pricing — dark-web & attack-surface monitoring
NordStellar is now branded "NordLayer Intelligence by NordStellar" on Nord's own site — nordstellar.com redirects to nordlayer.com/intelligence/. We keep the NordStellar name here since that's still what the deal, and most buyers, search for. Pricing below is Brocent's Nord Security partner-deal reference price; Nord publishes no public list price for this product.
How NordStellar works
NordStellar runs four monitoring modules: dark- and deep-web monitoring for leaked credentials, data-breach monitoring for exposed employee and customer records, attack-surface management that discovers exposed external assets, and brand protection that flags impersonating domains and phishing lookalikes. Pricing scales on the number of domains you register for monitoring and the number of assets discovered within them — not on user seats.
Starter
$300 / month
0–5 domains, 0–200 assets
Core dark- and deep-web monitoring for leaked credentials and compromised data, plus data-breach monitoring for exposed employee and customer records and malware-infected devices.
Get a quote →Growth
$570 / month
6–10 domains, 201–400 assets
Everything in Starter, plus attack-surface management — discovers exposed external assets before an attacker does.
Get a quote →Professional
Most complete$1040 / month
11–30 domains, 401–1,200 assets
The full module set, including brand protection — flags fake domains, spoofed social accounts and phishing lookalikes impersonating your brand.
Get a quote →Enterprise
$1570 / month
31–75 domains, 1,201–3,000 assets
The same full module set as Professional, at a larger domain and asset ceiling for bigger organizations.
Get a quote →Strategic
$2200 / month
76–150 domains, 3,001–6,000 assets
For large multi-brand or multi-subsidiary organizations that need monitoring coverage across many domains and a large discovered-asset footprint.
Get a quote →Custom
Custom quote
151+ domains, 6,001+ assets
Enterprise-scale coverage for the largest domain and asset footprints — quote-based only.
Get a quote →FX moves; USD figures are for comparison only.
Public list prices observed 2026-07-05. Subject to change by the vendor / operator without notice.
Regional pricing & availability notice
Prices on this page and its vendor sheets are a mix of sourcing bases: NordLayer's own published global USD list price, and NordStellar's Brocent-negotiated partner-deal reference price (Nord publishes no public list price for NordStellar) — neither is Brocent's APAC (Hong Kong, mainland China, Japan, Singapore, Malaysia) list price, currency, or confirmed availability. Actual pricing, invoicing currency, licensing terms, and product/SKU availability vary by country and are set by the vendor or Brocent's partner agreement, not published unilaterally by Brocent. Always confirm exact regional pricing, licensing, and compliance requirements with Brocent before purchase; nothing on this page is a quote.
NordStellar pricing FAQ
What counts as a "domain" vs. an "asset"?
A domain is each root domain you register for monitoring (e.g. yourcompany.com). Assets are the individual things discovered or tracked underneath those domains — subdomains, IP addresses, exposed services and flagged employee accounts. A tier's asset ceiling is shared across all of its registered domains.
Do I need NordLayer to use this?
No. NordStellar is a separate product on a separate pricing model — it scales on domains and assets monitored, not on user seats — and works standalone. You don't need a NordLayer subscription to use it.
Need dark-web & attack-surface monitoring?
We size the right NordStellar tier for your domain and asset footprint, set up monitoring and route alerts to your team. Tell us how many domains you need covered to get started.