Best Security Affiliate Programs 2026

The VPN and antivirus programs, measured rather than ranked by vibe. Including the one company that refuses to pay affiliates anything, which tells you more about this category than any commission rate does.

Published August 27, 2026 · Computed from 22 security and VPN programs · Tables rebuild from live data on every deploy

Start with the company that pays nothing

Before any table, the most informative program in this category is the one that does not exist.

Mullvad runs no affiliate program, and not because nobody got around to building one. They publish a policy page on reviews, advertising, influencers, and affiliates stating that they do not have affiliates and do not pay for influencers, and that they do not pay anyone to write about Mullvad, good or bad.

Think about what that costs them. Almost every "best VPN" list you have ever read was assembled, at least partly, from providers that pay a commission on the click. A company that pays nothing is invisible to that entire machine. Mullvad chose to be left out of the biggest distribution channel in its own industry, permanently, and said so in public.

We are part of that machine. This site earns affiliate commission on some of the listings below, and every one of them is named on our disclosure page. So read this page for what it is: a measurement of the programs that pay, written by a site that gets paid. Mullvad still gets a listing here, with a grade, earning us nothing, because a directory that only contains its own revenue sources is a price list.

What the 22 programs actually look like

Before picking a winner, it is worth seeing the shape of the category.

Two rows deserve attention. 5 recurring programs out of 19 makes this one of the weakest categories for repeat income that we track, and 5 programs advertising a maximum instead of a rate makes it one of the least transparent on pricing. Both are symptoms of the same business model, which the rest of this page unpacks.

Every paying program, ranked

Ranked by the affiliatejob grade, which reads documented terms rather than headline generosity, then alphabetically inside each grade. The grade is a judgement on commission, cookie, recurring structure, and the network behind the payout. It is not a measurement of whether a company pays on time, which nobody has reliable public data for.

Windscribe sits outside that table. It carries a strong grade on the strength of the product and the terms we could verify, but the commission is not published in a form we can quote, so we do not quote one. See the individual listing for what we could confirm.

The 5 that pay more than once

This is the shortest list on the page and the most valuable one. Everything else here pays you a single time per customer, however large that payment is.

PureVPN is the most complete structure in the category. All of the first month, or a flat 40%, and then 35% for as long as the customer stays, behind a 90 day cookie. Every component is at or near the best available here, which is rare in a category where programs usually trade one strength for another.

ProtonVPN is the closest competitor and the interesting one, because Proton sells privacy as its entire proposition and still runs an affiliate program. It pays the full first month and then 30% ongoing, plus 10% on affiliates you refer, which is one of only 2 two tier deals in the category. Proton and Mullvad sit at opposite ends of the same argument about whether privacy companies should pay for coverage, and both positions are defensible.

TorGuard pays a smaller 30% but attaches it to a lifetime cookie, the only one in this category and one of very few anywhere in the directory. There is no window to miss. An attribution recorded today still counts if the visitor buys next year.

hide.me pays 30% on a lifetime revenue share basis behind a 45 day cookie, which is the same shape as TorGuard with a longer runway on the rate and a shorter one on the cookie.

Worth noticing: 4 of the 5 recurring programs are VPN, the exception being SherGuard, and 4 of 5 run in house rather than through a network. The providers willing to share revenue long term are the ones who kept control of their own affiliate system, which is not a coincidence and is explained further down.

The "up to" problem

5 of the 19 paying programs advertise a maximum rather than a rate. This is the single most misleading pattern in the category and it is worth learning to read.

"Up to 117%" and "up to 100% of the first payment" are real numbers and they are not lies. A VPN can afford to hand over an entire first payment because the discounted first term is close to break even anyway and the profit lives in renewal three years later. What those figures do not tell you is what a new affiliate with no volume history actually gets, which is usually a long way below the headline.

The honest counterpoint sits in the banded group. Kaspersky publishes 20% to 50% and ExpressVPN publishes $13 to $36. Both bottom ends are unexciting, which is exactly why publishing them is worth something. You can plan against a floor. You cannot plan against a ceiling.

The practical move is the same one that works everywhere in this industry. Ask the affiliate manager, in writing, what the starting rate is for an account with no history, and what volume moves it. Keep the reply. Our piece on commission cuts covers what happens when those answers change later.

Why 7 of them refuse to use a network

Across the directory as a whole, most programs run through a network. In this category 7 of 19 do not: ExpressVPN, Private Internet Access, ProtonVPN, VeePN, PureVPN, hide.me, SherGuard. That is a much higher in house share than any comparable category, and there is a straightforward reason.

An affiliate network is a third party tracking system. It sets cookies, follows users across domains, and builds a record of who clicked what. A company whose entire product is preventing exactly that has an awkward decision to make when it wires up its partner programme, and several of them resolved it by keeping the tracking in house rather than handing it to Impact or CJ.

For the affiliate this is a genuine trade with costs on both sides. Networks give you one dashboard, one consolidated payment, one threshold, and somebody to appeal to when a merchant stops responding. In house programs give you none of that. 7 in house programs means 7 logins, 7 thresholds, and 7 separate balances that each have to clear on their own before any money moves. When a payment goes missing there is no arbitrator, only the merchant who owes you.

The programs that do use networks spread across 7 of them: CJ Affiliate (5), Impact (2), FlexOffers (1), Lemon Squeezy (1), Partnerize (1), PartnerStack (1), Rakuten Advertising (1). CJ Affiliate carries the largest share, which matters mostly because CJ does not pay through PayPal. If PayPal is your rail, check our guide to programs that pay through PayPal before you build content around a CJ merchant, not after your balance is stuck.

Cookie windows, and the one that never closes

Cookie length is usually a footnote. In this category it is close to a headline, because almost nobody buys security software on first contact. They read a comparison, open four tabs, close them, and come back a fortnight later after something in the news scares them.

10 programs run a 30 day window, which is the category default and is already short for a purchase people deliberate over, and one goes shorter still: SherGuard at 7 days. TorGuard's lifetime cookie is the standout and changes how you would use the program: evergreen content that keeps earning attribution years after publication, rather than a campaign that has to convert inside a month.

Our cookie window calculator puts numbers on the difference, and the cookie duration study compares this category against the rest of the directory.

Antivirus pays differently from VPN

The 8 non VPN programs behave like a separate category wearing the same label, and mixing them up is how people end up disappointed.

Nothing here approaches a VPN first payment bounty. What they offer instead is order value and patience. Antivirus sells in multi device and family bundles at prices well above a VPN subscription, so 20% of a five device family licence is not the small number the percentage suggests, and Norton backs it with the longest conventional cookie in the category at 60 days.

Keeper Security is the clearest illustration of why a headline rate is a bad way to choose. It pays 10%, the lowest number on this page, and carries the highest grade in the category. The rate is low; everything else is not. It runs on PartnerStack, which consolidates every program you hold on the network into a single payment on a fixed monthly date from a $25 threshold, and password managers renew year after year with very little churn because moving a vault is genuinely painful. A grade that reads terms rather than percentages puts it top, and the terms are right.

1Password pays in an unusual shape worth reading carefully: $2 on signup plus 25% of the first year. The $2 lands on a free trial start, so it pays something on traffic that never converts, which is friendlier to a large audience than it looks.

Two tier exists here, barely

2 programs in this category pay you on affiliates you recruit, not just customers: ProtonVPN at 10% and VeePN at 10%. Both are VPN, both run in house, and both sit at 10%.

That scarcity is the point. In finance and crypto a second tier is close to standard, and the RedotPay review walks through one in detail. In security it is a rounding error. If building a downline is your model, this is not the category for it, and our two tier hub shows where those programs actually live.

What happened to Atlas VPN, and why it is still listed

Atlas VPN appears in this directory with no public program, and the reason is not that it stopped paying affiliates. Nord Security shut the product down in April 2024 and migrated its users into NordVPN. The company is gone.

We keep the listing because people still search for it and deserve a straight answer rather than a dead end, and because it is the cleanest available lesson in a risk this category carries more than most. Security is consolidating. A well known consumer VPN with millions of users was absorbed and switched off, and any affiliate whose income depended on it watched that income end on a date somebody else chose.

That is the argument against building a site around a single program, in any category, but especially this one. Our public changelog records every term change we detect with the date it was caught, which is the closest thing to an early warning that exists.

How to actually pick one

Four situations, and what fits each.

• You publish comparison content at volume. Take the largest first payment bounty and do not think too hard about duration. VPN churn is high enough that recurring rarely outruns a big front loaded payment, and front loaded money funds the next article sooner.
• You are building something evergreen. TorGuard's lifetime cookie and PureVPN's 90 day window are built for content that earns for years. A 30 day cookie wastes most of the value of a page that ranks slowly and then stays there.
• You want income that continues. There are 5 options, and PureVPN and ProtonVPN are the strongest structures among them. Accept that this category is thin on recurring and put the rest of your effort into software programs, where it is normal rather than exceptional.
• Your audience is business rather than consumer. Keeper and 1Password, both on established networks with real B2B renewal behaviour, beat consumer VPN economics on lifetime value even though the headline rates look worse.

One rule underneath all four: check the payout rail before the rate. CJ Affiliate carries more of this category than any other network and does not pay through PayPal. A commission you cannot receive is not income, and that is a much more common way to lose money here than picking a rate that is two points too low.

Methodology

Every table on this page is computed at build time from the 22 programs in the affiliatejob directory currently categorised as VPN or Security, so the counts regenerate on every deploy and cannot drift from the prose around them. Commission, cookie, and network are recorded from each program's published affiliate terms and carry a verification date on the individual listing.

Rate wording is classified in three groups. A commission using "up to" or offering one figure "or" another is read as a ceiling, because the published maximum is not the rate a new affiliate receives. A commission stating both a lower and an upper figure is read as banded. Anything stating a single number is read as fixed, including NordVPN's "40% / 30%", which is a documented new customer and renewal split rather than a hedge.

Grades are the trust layer described in our methodology. They rate documented terms and are never influenced by placement or by whether we earn from a listing. The limitation is worth stating plainly: this measures what programs publish, not what they pay. A program can publish excellent terms and still settle late, and no public dataset exists that would let anyone claim otherwise honestly.

We earn affiliate commission on some listings on this page. Every one is named on the disclosure page, and the programs that earn us nothing, including Mullvad, are graded on the same basis as the ones that do.

FAQ