On February 5, 2026, ExpressVPN announced four new standalone products in a single press release. ExpressKeys, a dedicated password manager spun out of the VPN app. ExpressMailGuard, a disposable email alias service. Identity Defender, a US-only identity monitoring tool. And ExpressAI, a private AI platform built on confidential computing that launched at the end of March after a delay. The company that built its reputation on a single, clean product (a fast, reliable encrypted tunnel) now sells five separate applications under one subscription.
Gizmodo published a breakdown of where ExpressVPN stands after this expansion, including pricing comparisons against NordVPN and Proton. It’s worth reading the full assessment here before deciding whether the bundle makes sense for your use case.
I think this is the most significant strategic shift in the consumer VPN market since NordVPN launched Threat Protection Pro in 2023. And I’m not entirely sure it’s a good thing.
The Bundle Logic Makes Financial Sense. The Security Logic Is Less Clear.
The pricing is aggressive. ExpressVPN’s Pro plan costs $7.49 per month on a 28-month commitment. That gets you the VPN, ExpressKeys, ExpressMailGuard, ExpressAI, Identity Defender, a dedicated IP, and coverage for up to 14 devices. For context: ChatGPT Plus alone costs $20 per month. A standalone password manager like 1Password runs $3-5 per month. NordVPN’s comparable Prime tier is $7.39 but includes no AI tool and no email masking. Proton Unlimited bundles its own AI assistant (Lumo) but charges $9.99.
The arithmetic works. Five tools for under $8 per month is hard to argue with on price alone.
But bundling creates a specific problem in security software. When a company sells a VPN, a password manager, an email service, and an AI platform under one account, that account becomes a single point of failure. Compromise one set of credentials and the attacker potentially accesses the tunnel configuration, the stored passwords, the email aliases, and the AI conversation history. ExpressVPN uses zero-knowledge encryption on ExpressKeys, which means they can’t read your vault. ExpressAI runs in a confidential computing enclave audited by Cure53. These are real protections. But the surface area is objectively larger than it was when ExpressVPN was just a VPN.
ExpressAI Is the Most Interesting Product. And the Most Concerning.
ExpressAI runs multiple LLMs simultaneously, allows file uploads up to 50MB, and stores conversations in a 2GB encrypted vault. Pro subscribers get 500 daily credits. The privacy model is built on confidential computing enclaves, where encryption keys are generated on the chip itself. ExpressVPN says it cannot access prompts, files, or conversation history. Neither can the cloud provider. The Cure53 audit covered penetration testing, source code review, and cryptographic implementation.
I think ExpressAI is genuinely interesting as a product concept. A privacy-first AI assistant that doesn’t train on your data and runs in hardware-isolated environments solves a real problem. The concern is scope creep. ExpressVPN started as a tool that did one thing exceptionally well: encrypted tunneling via the Lightway protocol, which remains one of the fastest and most lightweight VPN protocols available. Every additional product pulls engineering resources, support bandwidth, and management attention away from that core.
NordVPN went through this same evolution. Threat Protection Pro, NordPass, NordLocker, Saily (eSIM), Incogni (data removal). The VPN itself is still excellent, but the product page now reads like a cybersecurity department store. Proton did it differently: Proton Mail came first, then VPN, then Drive, then Pass, then Calendar. Each product reinforces the privacy ecosystem. ExpressVPN’s approach is closer to NordVPN’s: bolt-on products that extend the subscription’s value proposition without obvious architectural synergy.
The Real Question: Does Lightway Still Get the Attention It Deserves?
Lightway is what made ExpressVPN worth paying a premium for. The protocol is open-source, based on wolfSSL, and consistently outperforms OpenVPN on reconnection speed and battery consumption. ExpressVPN integrated post-quantum encryption into Lightway in January 2025, making it one of the first providers to ship PQE across all platforms. That mattered.
What matters now is whether Lightway continues to evolve at the same pace while the company simultaneously develops an AI platform, a password manager, and an email service. The February 2026 announcements contained no Lightway updates. No new obfuscation features, no protocol-level improvements, no expanded PQE coverage. The engineering announcements were entirely about new products, not the core one.
This might be fine. Product companies can walk and chew gum. But the VPN market in 2026 is not the market of 2022. FISA 702 is up for renewal in the US. The EU is drafting legislation that would require VPN providers to retain user data. Post-quantum cryptography is still only partially deployed. The users who need a VPN most (journalists in censored environments, remote workers on hostile networks, activists routing traffic through foreign infrastructure) need the tunnel to keep improving. A password manager doesn’t help them. An AI chatbot doesn’t help them.
The Ownership Question That Never Goes Away
ExpressVPN was acquired by Kape Technologies in 2021 for $936 million. Kape also owns CyberGhost, Private Internet Access, and ZenMate. The company is controlled by Israeli billionaire Teddy Sagi. ExpressVPN maintains that it operates independently, and its audits (conducted by Cure53 and KPMG) have not flagged data handling concerns. But the ownership structure means that four major VPN brands share a parent company, and the incentive to maximize subscription revenue across the portfolio is structural.
The expansion into AI, password management, and identity protection increases the average revenue per user. That’s the business case. Whether it also increases the security of the users who originally subscribed for an encrypted tunnel is a separate question. And I think it’s the question that matters.
ExpressVPN built its reputation on doing one thing better than almost anyone else. The bet it’s making in 2026 is that doing five things well enough will be worth more than doing one thing exceptionally. I’m not convinced. But at $7.49 for the full stack, a lot of users won’t need convincing. They’ll just need it to work.
