Surfshark Review: An Honest Practitioner Assessment for Australians
Disclosure: Plain Text Security may earn a commission if you sign up through some links in this article, including links to Surfshark and NordVPN. That doesn’t change the verdict, and the section on NordVPN below explains why the relationship matters here specifically. Full affiliate disclosure.
Surfshark’s pitch is simple: unlimited devices for about the price of a coffee a month. For an Australian household with phones, laptops, a tablet, a smart TV and maybe a router, that’s a real argument, and most competitors don’t match it.
That pitch also invites the right sceptical question. How does a VPN this cheap pay for itself without selling your data? Answering that properly means looking at the audit trail, at who actually owns the company, and at the security incident Surfshark disclosed in September 2026. Most reviews skip at least two of those three.
The short verdict
Surfshark is a sound, independently audited, low-cost VPN. It makes the most sense for households that need many devices covered. The Starter plan on the longest term is the one to buy, and most people can ignore the upsell bundles.
It isn’t an independent alternative to NordVPN. Both have sat under the same corporate group since 2022. If you’re choosing between them, you’re choosing between two products from one owner, not between two competitors.
The September 2026 incident doesn’t change the verdict, but it does sharpen it. No user data or VPN traffic was involved, according to Surfshark’s own report. It did expose the limits of what a point-in-time audit can tell you, and that’s worth understanding whichever VPN you use.
Who shouldn’t buy it: anyone whose main requirement is maximum privacy (look at Mullvad), anyone who only needs one or two devices covered and wants the most polished all-rounder (NordVPN), and anyone buying a VPN purely to unlock overseas streaming catalogues.
What you actually get
Surfshark sells three tiers. The VPN itself is identical across all of them; the higher tiers add other products on top.
| Tier | What it adds | Who it’s for |
|---|---|---|
| Starter | Full VPN, ad and tracker blocking (CleanWeb), unlimited devices | Almost everyone |
| One | Starter plus antivirus, Alert (breach monitoring) and private search | People who want breach alerts bundled in |
| One+ | One plus Incogni (data broker removal requests) | A narrow group — see below |
Starter is the right plan for most people. The VPN features that matter are all here: WireGuard, a kill switch, RAM-only servers, MultiHop routing and servers in five Australian cities.
One’s antivirus isn’t a reason to upgrade. On a reasonably maintained Windows or Mac machine, the built-in protection (Microsoft Defender, XProtect) is adequate for most home users. Paying for a second antivirus layer adds cost and another agent on your machine without meaningfully changing your risk. Alert is more useful, but free services such as Have I Been Pwned cover the core of it.
One+ is mostly a vehicle for Incogni. Data broker removal has real value, but its usefulness depends heavily on which brokers actually hold your data. As an Australian, check what Incogni actually covers for your situation before you pay for it as part of a VPN bundle.
The gap between Starter and One is sometimes small enough during promotions that the upgrade feels free. That’s fine if you’d use Alert. Just don’t buy it for the antivirus.
What it costs in Australia
Surfshark prices Australians in AUD. At the time of writing, independent price tracking put Starter at around A$3.49 a month on the longest term (24 months plus 3 free), charged up front at roughly A$94. Month-to-month billing costs several times more per month.
The number that matters is the renewal price, not the sign-up price. Like most VPNs, Surfshark’s headline rate is a first-term promotion. When the first term ends, the plan renews at a higher standard rate, and Surfshark doesn’t make that figure easy to find before checkout. Check the renewal terms on the checkout page, and put a calendar reminder a few weeks before your term ends. Cancelling and re-subscribing on a new promotion is often cheaper than letting it roll over.
Unlimited devices changes the maths. NordVPN’s lowest tier covers a fixed number of devices (10 at last check). For a single person, that’s more than enough and the per-device argument doesn’t matter. For a family of four with two devices each, plus a TV and a games console, Surfshark’s flat price starts to look genuinely good value.
There’s a 30-day money-back guarantee, which is the honest way to test it: install it on everything, check speeds from your own connection, and decide.
Is Surfshark safe?
This is the section that matters most. “Is this VPN safe” breaks down into three separate questions: does it log, how well is it secured, and who controls it.
The no-logs claim: audited, with an important caveat
Surfshark’s no-logs policy has been assessed by Deloitte twice, in 2023 and again in 2025. The 2025 report is an ISAE 3000 reasonable-assurance engagement, which is a recognised professional standard and a stronger form of assurance than a marketing-friendly “security review”.
Read the scope, though. The 2025 engagement is a point-in-time assessment as of 10 June 2025. It tells you that on that date, Surfshark’s systems were configured in line with its no-logs policy. It says nothing about any other date, before or after. This isn’t a criticism unique to Surfshark. NordVPN, ExpressVPN and most other providers commission the same kind of engagement. But “audited” in a VPN’s marketing usually means “audited once, at a moment, against the provider’s own description of its policy.” That’s useful evidence, not a guarantee.
The full report is only available to logged-in Surfshark customers, not publicly. That’s common in the industry, but it means you can’t read the scope before you pay. The 30-day refund window is your chance to do that.
Infrastructure: RAM-only, and recently tested
Surfshark runs its VPN servers on RAM-only infrastructure, meaning nothing is written to persistent disk and a server reboot wipes its state. That’s a genuine architectural control, not just a policy promise. A seized server shouldn’t hold historical data because it was never built to store it.
In January 2026, Polish security firm SecuRing completed an infrastructure penetration test that found no critical or high-risk issues. One medium-risk SSL/TLS configuration finding was reported. Earlier audits by Cure53 covered the browser extensions and apps.
The September 2026 incident
On 9 September 2026, Surfshark published an incident report. An internal engineering test server had been misconfigured — Surfshark attributes it to human error — in a way that made it reachable from the internet, and an unauthorised third party accessed it.
What was exposed: parts of system binaries, internal configurations for some services, and build-related credentials that had been committed to code history at some point. The attacker also reached a separate, isolated server that Surfshark describes as a “content accessibility optimisation” proxy.
What wasn’t, according to Surfshark: user data, VPN traffic and production VPN services. The company says it found no evidence the compromise spread further, and it rotated the exposed credentials.
The timeline: first signs detected 31 August, initially treated as lower risk because the alert came from a test environment; confirmed and contained 2 September; remediation complete 5 September; public disclosure 9–10 September.
Reading this as someone who has run incident response, here’s my assessment.
What they did well. The disclosure is specific. It names a root cause (human error, misconfiguration), gives a dated timeline, and states what was accessed rather than hiding behind “a sophisticated threat actor”. Ten days from detection to public disclosure for an incident with no confirmed user impact is reasonable. Plenty of organisations would have said nothing at all.
What it tells you. Three things in the report are worth pausing on. The two-day gap between the first alert and confirmed containment came from the alert being triaged as low risk because it came from a test environment. That’s one of the most common failure patterns in the industry, and it’s exactly what attackers count on. Credentials committed to code history is a hygiene finding, not an exotic one. And system binaries and internal configurations are useful reconnaissance material for anyone planning a more serious attack later, even if they contain no user data themselves.
What it means for the audits. The Deloitte engagement assessed production systems against the no-logs policy as of June 2025. The SecuRing test covered network infrastructure as of January 2026. Neither was designed to tell you about a test server that would be misconfigured months later. The audits aren’t invalidated. They just never covered this.
What to watch. Surfshark has committed to an independent audit of its broader infrastructure, including applying production-level controls to test environments. Whether that audit is commissioned, scoped meaningfully and published is the real signal. I’ll update this review when it is.
My view: this incident is not a reason to avoid Surfshark if it otherwise fits your needs. It’s a reminder that a VPN provider’s security is an ongoing operational practice, not a certificate on the wall.
Jurisdiction
Surfshark B.V. is registered in the Netherlands, with offices in Lithuania and Poland. The Netherlands doesn’t impose mandatory data retention on VPN providers. For Australians, the more practical point is that Australia’s own metadata retention regime applies to Australian carriers and service providers. Your ISP can still see that you connected to a VPN server, but an offshore VPN provider isn’t part of that scheme.
Australian practicalities
Local servers. Surfshark has servers in Sydney, Melbourne, Brisbane, Adelaide and Perth. Connecting to the city nearest you keeps latency low enough for video calls and gaming. That matters more in a country as spread out as Australia than the headline global server count does.
Speed. Run your own test during the refund window. VPN speed results depend heavily on your connection type (NBN tier, fixed wireless, 5G home internet), the time of day, and which server you pick. Review-site speed tables measured from another continent tell you very little about your own line.
Streaming. Surfshark markets access to overseas streaming catalogues, and it works some of the time. Streaming services actively block VPN IP ranges, and access changes week to week. If unlocking a particular US catalogue is the main reason you’re buying a VPN, test that specific service during the first 30 days and don’t assume it will keep working for the next two years.
Legality. Using a VPN is legal in Australia. What you do over it is subject to the same laws as anything else you do online.
Surfshark vs NordVPN: the ownership question
This is the comparison most reviews treat as a contest between two rivals. It isn’t one.
Surfshark and Nord Security, the company behind NordVPN, merged in 2022. Both brands continue to operate separately, with their own apps and infrastructure, but they sit under the same corporate group. At the time of the merger, Surfshark said the two would share performance and marketing data but not user data.
Why this matters for you. If part of your reason for choosing Surfshark is to avoid the largest player in the market, the merger undercuts that reason. Any concerns you have about Nord Security as a company apply here too. If you want genuine independence from that group, Mullvad and Proton VPN are the most credible alternatives.
Why it matters for this review. Plain Text Security earns a recurring commission on NordVPN sign-ups. Recommending either brand puts money in the same group’s pockets. I’m telling you this because a review that compared the two without mentioning it would be hiding the most relevant fact.
The practical differences come down to this:
| Surfshark | NordVPN | |
|---|---|---|
| Devices | Unlimited | Fixed limit (10 at last check) |
| Price (long-term promo) | Lower | Higher |
| Australian server cities | Sydney, Melbourne, Brisbane, Adelaide, Perth | Multiple AU cities |
| No-logs assurance | Deloitte, point-in-time (2023, 2025) | Deloitte, point-in-time (multiple years) |
| Most recent public incident | Internal test server, Sept 2026 | Single server compromise in 2018 (disclosed 2019) |
| Corporate parent | Same group as NordVPN | Nord Security |
If you need more devices than NordVPN allows, or price is the deciding factor, Surfshark is the better fit. If you’re a single person covering a few devices and want the most refined apps, NordVPN’s Best VPN for Australia ranking explains why it sits at the top there.
When not to buy Surfshark
You need the strongest privacy guarantee. Mullvad doesn’t require an email address, accepts cash, and has the cleanest privacy model in the consumer market. It pays this site nothing, and I recommend it anyway. The NordVPN vs ExpressVPN vs Mullvad comparison covers it in more depth.
You only want to reach your home network remotely. A self-hosted WireGuard server is free and does that job better than any commercial VPN. See Should You Self-Host WireGuard?.
You’re buying it for one streaming service. Test first. If that service blocks it, you’ve bought a VPN you don’t need.
The September incident has shaken your trust. That’s a reasonable position. Wait for the promised infrastructure audit and judge Surfshark on what it actually publishes.
Final recommendation
Surfshark does what a consumer VPN should do. It doesn’t log, its servers can’t easily retain data, it has local servers across Australia, and it costs less than most competitors while covering every device you own. The 2026 incident was handled with more transparency than the industry norm, though it exposed exactly the kind of gap that point-in-time audits can’t see.
Buy it with clear eyes. It’s a budget brand from the same group as NordVPN, not an independent challenger. Its audits are snapshots, not continuous guarantees. The renewal price will be higher than the price you sign up at.
For households that need to cover a lot of devices without paying per seat, Surfshark Starter on the longest term is the one I’d recommend. Test it on your own connection within the 30-day refund window, and skip the bundles unless you have a specific use for them.
Plain Text Security earns commissions from some of the products recommended on this site. Commissions never determine which products are recommended. Mullvad, mentioned in this article, offers no affiliate program and is not linked. See our affiliate disclosure for details.
