End Infrastructure
Complexity Chaos

A VPN grants broad network access after authentication - once connected, a user can reach anything on that network segment, with no resource-level controls and no session attribution. Teleport is an identity-based access platform that grants access to specific resources - a single server, database, or Kubernetes cluster - using short-lived certificates tied to a verified identity. Each connection is a separate authenticated, authorized, and recorded request. Because access is scoped to resources rather than network segments, a compromised session can't be used to move laterally across the environment. Teleport also eliminates the operational overhead of managing VPN configurations, firewall rules, and bastion hosts, replacing them with a single access policy applied consistently across every environment. For the same connectivity experience without a VPN tunnel, see Teleport VNet.

Teleport VNet intercepts DNS requests for any TCP application or SSH server enrolled in Teleport and proxies connections through Teleport's identity and access controls, handling certificate-based authentication transparently in the background. Engineers connect to internal services by hostname - the same experience as a VPN - without a separate tunnel, internal IP management, custom DNS entries, or firewall reconfiguration. Unlike a VPN, every connection through VNet is individually authenticated, authorized against the user's current role and device posture, and recorded. There are no DNS reconfigurations required, and VNet works consistently across cloud, on-prem, and hybrid environments without per-environment setup.

Teleport implements zero trust network access by issuing short-lived X.509 certificates for every connection, requiring each session to be explicitly authenticated and authorized before reaching any resource. There are no standing privileges, no implicit network trust, and no static credentials to steal or reuse. Access is scoped to individual resources - not network segments - using role-based policies that factor in identity, device posture, and context. Every session is recorded and attributed to a verified identity. Teleport applies these ZTNA principles uniformly across servers, databases, Kubernetes, cloud consoles, and internal applications from a single control plane, rather than enforcing zero trust at the network layer only.

Teleport supports passwordless authentication via WebAuthn hardware keys (YubiKey, Touch ID, Windows Hello) and biometric devices. When a user authenticates through their identity provider or directly via Teleport's SSO, they are issued short-lived X.509 certificates tied to their verified identity and enrolled device - these expire automatically at the end of the session, leaving no persistent credentials to steal, rotate, or accidentally expose. Machine identities, CI/CD pipelines, and AI agents authenticate through the same certificate-based model via Teleport's tbot agent, eliminating API tokens and long-lived SSH keys from automation workflows entirely.

Teleport Zero Trust Access secures connections to Linux and Windows servers (SSH and RDP), databases (PostgreSQL, MySQL, MongoDB, CockroachDB, and more), Kubernetes clusters, AWS/GCP/Azure cloud consoles, internal web applications, MCP servers, and GitHub repositories - all from a single control plane. Resources are enrolled in Teleport and maintained in a self-updating inventory with auto-discovery, so new infrastructure is protected as it spins up without manual configuration. See the full list of supported protocols and resources.

Traditional VPNs and bastions grant broad network access after a single authentication event - a compromised credential gives an attacker the same reach as a legitimate engineer, with no additional barriers to moving across the environment. Teleport's zero trust model eliminates implicit network trust entirely: every connection requires a separate authenticated request using a short-lived certificate scoped to one specific resource. There are no standing privileges and no persistent credentials to harvest. Even if a session is compromised, the blast radius is contained to that one resource and that one session, with a full session recording available for forensic review.
 

Yes. Teleport enforces the access controls required by SOC 2, FedRAMP, ISO 27001, HIPAA, and PCI DSS 4.0 by default - least privilege access, session recording, MFA, and a complete audit trail - rather than as configuration add-ons. Every privileged session is recorded with full identity attribution, dual authorization can be required for sensitive actions, and structured audit logs are exportable to SIEM platforms. This significantly reduces the manual evidence-gathering work that typically precedes an audit and supports continuous compliance monitoring rather than point-in-time prep.
 

Most zero trust implementations focus on human users and leave machine identities - CI/CD pipelines, service accounts, microservices, and AI agents - relying on static API tokens, SSH keys, and long-lived secrets that are difficult to rotate and easy to compromise. Teleport extends the same certificate-based zero trust model to non-human identities through Teleport Machine & Workload Identity. The tbot agent issues short-lived certificates to machines and workloads under the same policy engine and RBAC controls as human users, with full audit logging and just-in-time access. For AI agents and LLMs accessing infrastructure resources via MCP, Teleport governs and records their sessions the same way it governs engineer access - with automatic expiry and no persistent credentials.
 

Both Tailscale and Google IAP solve narrower problems than zero trust infrastructure access and hit meaningful limitations at scale.

Tailscale builds a WireGuard-based encrypted mesh network that improves on traditional VPNs for device connectivity - but it still operates at the network layer. Once a device is on the tailnet, access is governed by IP-based ACLs rather than per-resource identity policies. There is no native session recording, no identity-attributed audit trail, and no just-in-time access to individual resources. A compromised device on the tailnet still has broad network reach.

Google IAP is a GCP-native proxy that handles authentication for web applications running on Google Cloud. It works well within that boundary, but it doesn't extend to SSH, databases, Kubernetes, or on-prem infrastructure, can't govern non-human identities with the same policy engine, and produces no session recordings or structured audit logs. Teams running multi-cloud or hybrid environments have to layer additional tools to cover the gaps.

Teleport operates at the identity and resource layer across all environments - issuing short-lived certificates per connection, enforcing least privilege against role-based policies, recording every session, and applying the same controls to humans, machines, and AI agents regardless of whether the target resource is on GCP, AWS, Azure, or on-prem. See the full comparisons: Teleport vs. Tailscale and Teleport vs. Google IAP.