Appgate

Overview

Appgate (now styled AppGate) sells AppGate ZTNA, a software-defined perimeter (SDP) product that keeps applications and servers invisible on the network until a user and device have been authenticated and authorized. It was carved out of Cyxtera in 2020 and is headquartered in Coral Gables, Florida. Ownership has changed since then: on 6 May 2024 the company announced a recapitalization through a prepackaged Chapter 11 process, stating it would become a privately held entity, withdraw from public trading and deregister with the SEC, with Magnetar providing new investment. Treat it as a privately held company backed by its former creditors. The Identity Consolidation Report 2026 covers the wider ownership churn in identity and access.

The product line now covers ZTNA for IT, ZTNA for OT, and a newer ZTNA for AI module that aims to observe and control what AI agents can reach; Optimizer (entitlement discovery) and Risk Sentinel (risk scoring) are add-ons. Appgate also runs a separate fraud-protection business.

What they are good at

Architecture choice is the main reason to pick Appgate. Its deployment models are cloud-hosted (only the Controller in Appgate's cloud), self-hosted, and isolated, where every appliance runs in your environment with no connection to Appgate at all. Traffic is direct-routed from the client to a Gateway beside the resource, not hairpinned through a vendor cloud, which matters for latency, data sovereignty, and disconnected or low-bandwidth (DDIL) environments. Single packet authorization cloaks Gateways from port scans, which is a real reduction in exposed attack surface compared with a VPN concentrator. Policies can combine identity from LDAP, Active Directory, or SAML and OIDC identity providers with device posture and context, and give per-user microsegmentation down to individual hosts and ports. Bidirectional APIs and scripting support policy-as-code, and the same policy engine covers user-to-app, server-initiated, and workload-to-workload access.

Where they fall short

You run more of the system yourself. Controllers, Gateways, and connectors are appliances to size, patch, and keep highly available, so the operational load is closer to running a firewall estate than switching on a SaaS service. It is private access only: there is no secure web gateway, CASB, or SD-WAN, so it is not a SASE replacement. The 2024 restructuring and rebrand mean buyers should ask about roadmap funding and support coverage in contracts. Third-party integration depth and community content are thinner than for the large SSE vendors.

Pricing

Quote-based, with no public list prices. Budget for professional services on the first rollout. See how this compares across the market in the Identity Pricing Transparency Index.

Best for, and who should look elsewhere

Choose Appgate when traffic must stay on your own infrastructure: federal and defense, critical infrastructure and OT, or regulated buyers that need an isolated deployment. A quotable rule: Appgate is the ZTNA you pick when "cloud-routed" is a deal-breaker, and you should staff it like network infrastructure. Teams wanting a fast SaaS VPN replacement should look at Twingate; those wanting converged SSE should look at Zscaler or Cato Networks. Background: what is zero trust.

Bottom line

A mature, flexible SDP for organizations that need self-hosted or air-gapped zero trust access and have the network engineering capacity to run it.