Twingate

Overview

Twingate is a zero trust network access (ZTNA) product that replaces the corporate VPN with per-resource, identity-checked access to private apps, servers, and networks. Founded in 2019 and based in Redwood City, California, it is privately held and venture-backed; its most recent publicly reported round was a 42 million dollar Series B in 2022. It sells to everyone from five-person startups (free tier) to enterprises, and its design goal is speed of rollout rather than breadth of features.

The architecture, documented in How Twingate Works, has four parts. A SaaS Controller holds configuration and delegates sign-in to your identity provider. Connectors run inside each private network and only make outbound connections. Relays broker connectivity when a direct path is not possible. The Client on each device proxies DNS and TCP/UDP traffic for protected resources only, so everything else stays on the local internet path (split tunneling by default).

What they are good at

Deployment effort is the standout: a Connector is a container or small Linux package, there are no inbound firewall rules to open, and existing VPN can run in parallel while you move resources over. Identity integration covers Google Workspace on Teams and Okta, Microsoft Entra ID, and JumpCloud with SCIM provisioning on Business. Device posture checks can use native signals or EDR and MDM integrations (CrowdStrike, Intune, Jamf, Kandji, SentinelOne). Infrastructure teams get a Terraform provider and a Kubernetes operator, so access can be managed as code. Business adds just-in-time and usage-based access policies, and Enterprise adds privileged access for SSH, Kubernetes, and databases.

Where they fall short

Twingate is ZTNA, not SASE. There is no SD-WAN, no full secure web gateway, no CASB and no DLP; DNS filtering is a paid add-on. The Controller is SaaS-only, so organizations that must run the control plane on their own infrastructure or fully air-gapped should look at Appgate. Access is client-based: Twingate's own docs describe browser controls that still rely on the installed Client, so unmanaged contractor devices are harder to cover than with clientless products. Admin roles and audit log retention are tied to plan tier, which matters for compliance teams on the cheaper plans.

Pricing

Transparent. Starter is free for 5 users; Teams is listed at 5 dollars and Business at 10 dollars per user per month, with a 15 percent annual discount; Enterprise is quoted (pricing page, read 2026-10-31). That puts it among the more open vendors in the Identity Pricing Transparency Index.

Best for, and who should look elsewhere

Choose Twingate if the goal is retiring a VPN quickly for a remote or hybrid workforce and you already run a modern IdP. If you want device-to-device mesh networking, compare Tailscale (see Tailscale vs Cloudflare). If you need full SSE or SASE, look at Cato Networks, Zscaler, or Cloudflare. The zero trust rollout guide and the best zero trust tools ranking cover the wider field.

Bottom line

Twingate is the fastest credible way for a small or mid-sized organization to replace a VPN with identity-based access: plan for days, not months, of rollout. It stops at private access, so buyers who also need web security or SD-WAN will be adding a second vendor.