In short: NordStellar is Nord Security's threat exposure management platform, now marketed as NordLayer Intelligence by NordStellar. It monitors data breaches, infostealer logs and dark web sources for your company, maps your external attack surface and detects lookalike domains. It is licensed by the number of domains and assets monitored, with unlimited console users, rather than per user.
What NordStellar is
NordStellar looks at your organisation from the outside, the way an attacker would. Rather than protecting a device or a mailbox, it watches the places where company data turns up after a breach and the internet-facing systems attackers probe first, then ranks what it finds by severity so you know which findings matter most.
Nord Security now sells it as NordLayer Intelligence by NordStellar, alongside NordLayer and NordPass, and nordstellar.com redirects to the NordLayer Intelligence pages. It is the same platform under either name. Monitoring starts from your company domains and the keywords you choose, and the platform discovers related internet-facing assets from there.
What NordStellar monitors
The core platform, which Nord Security calls the Security Console, includes all of its monitoring capabilities without feature tiers:
- Data breach monitoring: compromised employee and customer data in leaked databases, plus information-stealer malware that has taken data from company devices
- Dark web monitoring: deep and dark web forums, marketplaces, ransomware leak sites and Telegram channels, with keyword tracking for your domains, email addresses, employee names and brands, and optionally your suppliers and partners
- Attack surface management: discovery of subdomains, IP addresses and shadow IT, with scans for open ports, exposed admin panels, public configuration files and backups, services with known vulnerabilities, subdomain takeover risks, expiring certificates and missing SPF or DMARC records
- Cybersquatting detection: lookalike domains that could be used for phishing or impersonation
- Prioritisation and alerts: risk scoring by severity, real-time alerts by email, Slack or Microsoft Teams, and data export
- Access and integrations: SSO, MFA, role-based access, multi-tenant support, and API and identity provider integrations
Two extras are scoped separately: brand protection, which detects fake domains, social media accounts and copycat apps and includes on-demand takedowns, and the Dark web API, which feeds NordStellar's dark web intelligence into your other security tools.
How NordStellar is licensed
NordStellar is sized by monitored domains and assets, not by people. Assets are the digital items it tracks for exposure, such as domains, IP addresses and identifiers like employee email addresses and phone numbers, and every plan allows unlimited console users. All scopes include the same features. Through Forever Systems it is available in fixed scope bands:
| Scope band | Domains | Assets |
|---|---|---|
| Starter | 5 | 200 |
| Growth | 10 | 400 |
| Professional | 30 | 1,200 |
| Enterprise | 75 | 3,000 |
| Strategic | 150 | 6,000 |
| Elite | 300 | 12,000 |
| Ultimate | 600 | 24,000 |
Nord Security allows a buffer for automatically discovered assets, so normal changes in your estate do not change the scope; it only changes if you consistently exceed what was agreed. If you are unsure how many assets you have, we can help you estimate it before you commit. Prices depend on the scope and term, so ask us for a quote. Brand protection and the Dark web API are quoted individually.
Requirements and deployment
NordStellar is a web platform. You provide the domains you own and the keywords to track, confirm the assets the platform discovers, set up scans and choose which alerts go to whom. Typical first steps are reviewing leaked credentials for current staff and forcing password resets, closing exposed services found by the attack surface scans, and adding SPF and DMARC records where they are missing.
Findings are most useful when someone acts on them. Credential alerts pair naturally with a password manager such as NordPass and with multi-factor authentication, while attack surface findings feed your patching and vulnerability management process.
Who NordStellar suits and how we help
NordStellar suits organisations that want early warning of credential leaks and infostealer infections, have more internet-facing systems than they can track by hand, or worry about lookalike domains being used to phish their customers. Its multi-tenant support also suits groups with several brands or subsidiaries. Compare it with other tools in threat exposure and dark web monitoring.
Forever Systems helps you estimate your asset count, choose a tier, set up alert routing and agree who acts on each type of finding, then handles renewals and tier changes. See all Nord Security products.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is NordStellar licensed per user?
No. NordStellar is sized by the number of domains and assets you monitor. Every plan includes unlimited console users, so your whole IT or security team can use it.
What counts as an asset in NordStellar?
Assets are the digital items monitored for exposure: domains, IP addresses and identifiers such as employee email addresses and phone numbers. The platform discovers many of them automatically, and we can help you estimate your count before you choose a scope.
What is the difference between NordStellar and NordLayer Intelligence?
There is none in substance. Nord Security markets the platform as NordLayer Intelligence by NordStellar, and nordstellar.com now redirects to the NordLayer Intelligence site.
Does NordStellar monitor Telegram and ransomware leak sites?
Yes. Its dark web monitoring covers deep and dark web forums, marketplaces, ransomware leak sites and cybercrime Telegram channels, and alerts you when your tracked keywords appear.
Can NordStellar remove fake websites impersonating us?
Takedowns are part of the brand protection add-on, which detects impersonating domains, social media accounts and apps. It is quoted separately from the core platform.