Business VPN & Zero Trust Access
Defguard
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Defguard Sp. z o.o. · defguard.net
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Defguard at a glance
- Vendor
- Defguard Sp. z o.o.
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates Defguard 3.5/5, the mean of 6 judges. Defguard is a self-hosted WireGuard VPN with a built-in identity provider and MFA, from Defguard Sp. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Defguard is a self-hosted WireGuard VPN with a built-in identity provider and MFA, from Defguard Sp. z o.o. of Szczecin, Poland; the vendor describes most of its code as open source, with the enterprise part open code. The bench's strongest marks land on architecture and assurance and on sovereignty, both at 8–9: only a stateless proxy and a single UDP gateway port face the internet, ISEC penetration test reports are published in full — all twenty findings, each fix tracked on GitHub — and the self-hosted design keeps keys, user metadata and traffic logs on your own infrastructure. Identity and policy and visibility and audit sit at a flat 7. Access and connectivity runs 6–7, the weakest of the functional criteria, with judges finding no public information on clientless browser access, private or split DNS, or site-to-site cloud links. Deployment and administration spans 7–8, scriptable end to end though the judges found no public information on MDM client rollout or granular admin roles. The widest spread is pricing transparency at 3–5, a generous free tier against pages that carry no per-user figure.
Speaks for it
- ISEC penetration test reports are published in full, with all twenty findings — including one critical account takeover — each fix tracked through GitHub issues
- Firewall rules generate each user's allowed IPs, so every tunnel carries only the subnets its rules permit
- MFA is enforced at the WireGuard protocol level on every connection, with TOTP, email, WebAuthn/YubiKey and biometric methods
- Deployment paths include Docker Compose, system packages, OVF and Terraform/OpenTofu modules on AWS, alongside a documented REST API, webhooks and CLI management
- The product runs self-hosted, documented to keep keys, user metadata and traffic logs on your own infrastructure, with an offline licence that never contacts the vendor's licensing server
Held against it
- The judges found no public information on clientless browser access, private or split DNS, or site-to-site links into cloud networks
- The judges found no public information on MDM-based client rollout, granular administrator roles, SCIM provisioning or just-in-time access with approval
- Standard support runs by email and ticket expressly without SLA guarantees and on an 'as is' basis, with an SLA offered at the Enterprise tier
- The captured pricing pages carry no per-user figure — Business is a configurable package and Enterprise is listed as 'Custom' — and VAT treatment is not stated
- The vendor states it runs no bug bounty, and the judges found no public information on a public status page, incident history, or a published data processing agreement
Best for
- You run your own infrastructure and want a VPN that keeps cryptographic keys, user metadata and traffic logs on it, with no external cloud relays required
- You need least-privilege remote access — each user's tunnel carries only the subnets their firewall rules allow
- You must show an auditor independent evidence — full ISEC reports with fix tracking, an ISO 27001:2023 certificate with published number and scope, and activity logs streamable to Vector or Logstash
- You are a managed service provider — multiple instances and locations sit in one client, which the vendor pitches as ideal for MSPs
Avoid if
- You want a vendor-managed SaaS VPN — the product is self-hosted by design, with production guidance recommending a dedicated server or VM per component
- You need an SLA-backed support commitment — standard support runs expressly without SLA guarantees and 'as is', with the SLA offered at the Enterprise tier
- You need device posture checks or active-active high availability below the top tier — both are gated to the Enterprise plan, which is priced only on request
- You need to compute your annual cost from published prices — the pages show no per-user figure, Business is a configurator, Enterprise is 'Custom', and offline licences are sold via sales at a one-year minimum
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3.5 of 5 |
| Identity, access policy & device posture | 3.5 of 5 |
| Logs, audit trail & incident response | 3.5 of 5 |
| Deployment, API & administration | 3.5 of 5 |
| Architecture, reliability & security assurance | 4 of 5 |
| European sovereignty | 4 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
WireGuard with native clients for Windows, macOS, Linux, iOS and Android, split tunnelling documented, always-on and pre-logon modes, static IP assignment, and self-run gateways on Linux, FreeBSD and OPNsense. Firewall rules generate each user's allowed subnets, which is exactly the reach-the-ERP-without-opening-the-network story I need; we found no public information on private or split DNS, clientless browser access for contractors, or per-application rather than per-subnet access. 2 8 14 15 20
The DevOps Engineer
WireGuard everywhere with native clients for Windows, macOS, Linux, iOS, Android and a CLI, documented split-tunnel configuration, always-on and pre-logon tunnels, and per-user firewall rules that trim each client's allowed IPs down to only the subnets its rules permit — which is the per-resource model I want. Gateways ship as Docker containers or Terraform modules on AWS and run on Linux, FreeBSD, NetBSD and OPNsense, with active-active HA on Enterprise. It is a client-to-gateway model though — the gateway listens on one inbound UDP port — and we found no public information on site-to-site links into cloud networks, clientless browser access for contractors, or private and split DNS. 2 5 8 14 15 20
The MSP Technician
Native clients for Windows, macOS, Linux, iOS and Android plus a CLI, WireGuard under the hood, admin-enforced full-tunnel or split routing, manual static IPs, always-on and pre-logon modes, and gateways on Linux, FreeBSD, NetBSD and OPNsense cover the daily remote-access needs across my thirty clients. Firewall ACLs driven by SSO users and groups, with each user's config carrying only the subnets their rules allow, push this toward least-privilege, per-resource access. We found no public information on clientless browser access for contractors, private or split DNS, or site-to-site links into AWS, Azure or Google Cloud. 2 8 14 15
The Operations Manager
For freelancers on their own laptops this is the right shape: native apps for Windows, macOS, Linux, iOS and Android speaking WireGuard, documented split tunnelling where only the configured networks ride the tunnel, and each user's configuration generated from firewall rules so a contractor's tunnel carries only the subnets their rules allow — one project system and nothing else. Always-on and pre-logon tunnels arrive on the Enterprise tier and gateways keep serving even when the core goes down, but I found no public information on clientless browser access, site-to-site links into cloud networks, or private DNS, so nobody gets in without the client installed. 8 14 15
The Information Security Officer
Native clients cover Windows, macOS, Linux, iOS and Android plus a CLI on WireGuard, with split tunnelling configured through allowed IPs, admin-enforced or user-selected full tunnel, always-on and pre-logon service locations, and firewall ACLs that shrink each user's tunnel to only the subnets their rules permit — the per-resource model I need for control-system access. Gateways run wherever we host them (Linux, FreeBSD, OPNsense), keep operating if the core goes down, and active-active high availability is documented. We found no public information on clientless browser access for contractors, peer-to-peer connections with relays, or private DNS handling. 2 8 9 14 15
The Skeptic
Native clients for Windows, macOS, Linux, iOS, Android and a CLI, kernel and userspace WireGuard, split tunnelling configured per location with full-tunnel or split routing, always-on and pre-logon tunnels, and gateways that keep carrying traffic even when the Core goes down. Access control runs down to subnets — each user's config only includes the subnets their firewall rules allow — with active-active gateways and edges documented. I found no public information on clientless browser access, private or split DNS, or relay fallback for NAT traversal, which keeps it below the highest level. 14 15 2 8 9
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Single sign-on with Microsoft Entra ID, Google Workspace and Okta is documented, plus two-way LDAP and Active Directory sync, group-driven firewall rules, and connection-level MFA including YubiKeys and biometrics — the leaver story I want. Device posture goes well past OS version (disk encryption, antivirus, patch age, AD membership), though we found no public information on SCIM provisioning, just-in-time access, or posture fed from Intune or an EDR tool. 2 3 4 8 14
The DevOps Engineer
Access genuinely follows identity: a built-in OIDC provider or external SSO with Entra ID, Google Workspace, Okta and JumpCloud, two-way LDAP/AD sync, group-based ACLs, and MFA enforced at the connection level rather than only at login — TOTP, email, biometrics and YubiKeys — plus SSH authentication with hardware keys. Device posture covers OS, kernel and client versions, disk encryption, antivirus, AD membership and patch age, with policies manageable through the documented REST API. We found no public information on SCIM provisioning, just-in-time access with approval, or posture fed from third-party EDR or MDM tools, and hardware device attestation is listed as coming. 2 3 7 8 14 16 17 22
The MSP Technician
Single sign-on works with Microsoft Entra ID, Google Workspace, Okta, JumpCloud and any OIDC provider on top of a built-in identity provider, two-way Active Directory and LDAP sync auto-enrols synced users with directory-sync events showing leavers being disabled, and MFA is enforced at the WireGuard protocol level on every connection with TOTP, email, WebAuthn/YubiKey or biometrics. Posture checks reach operating system and client versions, disk encryption, antivirus, Active Directory membership and security-patch age across all five platforms, though the Enterprise plan is required for them. We found no public information on SCIM provisioning, just-in-time access with approval, or posture conditions fed from EDR or MDM tools. 3 8 14 17
The Operations Manager
This is where the product earns its keep for me: access is per user and group, each location can be gated to specific groups, external single sign-on works with Google, Microsoft Entra ID, Okta and JumpCloud or the built-in OpenID provider, and two-way LDAP and Active Directory synchronisation means a terminated freelancer disappears from the tunnel. Multi-factor is enforced at connection level — TOTP, email or biometric on every connect, not just login — and posture checks cover operating system version, disk encryption, antivirus and security-update age, though posture requires the Enterprise plan. I found no public information on SCIM provisioning, just-in-time approval, or posture checks fed from MDM or EDR tools. 2 3 8 14 17
The Information Security Officer
Single sign-on works with Microsoft Entra ID, Google Workspace, Okta, JumpCloud and any OIDC provider on top of a built-in identity provider, and MFA is enforced at the WireGuard protocol level so every connection — not just the login — is challenged. Device posture is checked before a connection and covers operating system and kernel versions, disk encryption, antivirus, Active Directory membership, device integrity and security-update age, with default-deny for unconfigured operating systems and failed checks written to the activity log. We found no public information on SCIM provisioning, just-in-time access with approval, or posture fed from EDR/MDM tools, and hardware-backed device attestation is only announced for a future release. 2 3 8 14 17
The Skeptic
Built-in OpenID Connect identity provider or external SSO with Google Workspace, Microsoft Entra ID, Okta and JumpCloud, multi-factor authentication enforced at the tunnel level — every connection, not just the login — with TOTP, email, WebAuthn hardware keys and biometrics, group-based per-location policies, two-way Active Directory and LDAP sync, and deep built-in posture checks covering OS version, disk encryption, antivirus, domain membership and patch age. I found no public information on SCIM provisioning, just-in-time access with approval, or posture fed from EDR or MDM tools, and hardware device attestation is listed as coming, not shipped. 14 3 8 2
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
The activity log is documented event by event — every VPN connection, MFA result and admin action with user, IP and device — searchable and filterable, with streaming to Vector and Logstash on the Business and Enterprise plans. We found no public information on a stated retention period, per-resource flow logs, or an explicit way to terminate a live session, which caps this for me. 2 4 9 14 18 19
The DevOps Engineer
The activity log is a real audit trail: every event carries user, IP, module and device, the VPN module records connections and MFA outcomes per location, and the full event taxonomy is published with searchable, role-scoped filtering by username, module, event and device. Streaming to SIEM platforms through Vector or Logstash is documented on Business and Enterprise plans. We found no public information on network flow logs per resource, retention guarantees, or alerts keyed specifically to security events beyond generic webhooks and email notifications. 2 4 18 19
The MSP Technician
The activity log captures who did what, from which IP and device, across VPN connections, MFA attempts, posture evaluations and directory sync, searchable by user, module, event and device with date-range filtering and role-based visibility — the kind of evidence I show a client after an incident. Admin actions in the web console are part of the trail, the Business and Enterprise plans stream the log in real time to Vector or Logstash, and because everything is self-hosted the retention is whatever we hold in our own database. We found no public information on automated alerts for unusual access, CSV export, or an administrator ending a live session directly. 2 4 18 19
The Operations Manager
When a client asks who touched what, the activity log answers: date, user, IP, event, module and device, across VPN connections, enrollment, posture evaluations and directory sync, with case-insensitive search and inclusive date-range filtering, and every admin action is recorded. Activity logs stream in real time to Vector or Logstash on the Business and Enterprise plans, and because the whole thing is self-hosted the records sit on my own infrastructure with retention in my hands; I found no public information on alerts for unusual access or an explicit control to end a live session. 4 14 18 19
The Information Security Officer
The activity log records date, user, IP, event, module and device across VPN connections, MFA outcomes, posture pass/fail and directory synchronisation, plus admin actions in the core interface, searchable and filterable by user, module, event, device and time range. Audit logs stream in real time to SIEM pipelines (Vector, Logstash) on the Business and Enterprise plans, and because the stack is self-hosted the records stay in our own database — which answers my auditor's question about who reached the control systems. We found no public information on tamper-evident or signed logs, a statement of what traffic data is not logged, or an administrator control to terminate a live session. 2 4 10 18 19
The Skeptic
The activity log records every module — VPN connects and disconnects, MFA outcomes, enrollment, directory sync, posture decisions and admin operations — with user, IP, device and date, searchable and role-scoped, and it streams in real time to Vector or Logstash from the Business plan up. Because everything is self-hosted, the logs sit in the customer's own database rather than the vendor's; I found no public information on a stated retention period, a live session view with a kill switch, or tamper-evident storage for investigations. 4 18 19 14
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
Deployment as Docker, system packages, OVF or Terraform modules for AWS, a documented REST API with webhooks and CLI management, and a multi-instance client pitched at MSPs — strong for a three-person team. The gaps that bite us: we found no public information on pushing clients through Intune or another MDM, granular admin roles are thin, and the terms state support comes without SLA guarantees unless we go to sales. 3 5 8 11 14 16 20
The DevOps Engineer
Terraform modules for core, edge and gateway on AWS with OpenTofu support, Docker Compose and Debian packages and an OVF image as alternatives, gateways deployable as containers or cloud images, a documented REST API with webhooks, CLI management, and multiple instances and customer sites in one client pitched at MSPs — this is close to the Git-and-Terraform workflow I run. The Terraform path is self-described as recently introduced and still improving. We found no public information on pushing clients through MDM with preconfigured settings, and staged rollout of client and gateway updates is not described. 1 5 7 14 20
The MSP Technician
Rolling a client out is scriptable end to end — Docker Compose, system packages, OVF, and Terraform or OpenTofu modules for core, proxy and gateway on AWS — with a documented REST API, webhooks and CLI management, and the desktop client holds multiple instances and locations in one app, which the vendor pitches at MSPs. The whole product is the self-hosted edition, documented for production with dedicated servers recommended per component. What I still do per customer is run a separate instance: we found no public information on a central multi-tenant console with per-tenant billing, MDM-based client rollout, granular admin roles, or staged update rollouts, and standard support is expressly without SLA guarantees. 5 7 11 14 20
The Operations Manager
My hourly external provider can run this without inventing anything: Docker Compose with a worked example repository, Terraform and OpenTofu modules for core, proxy and gateway on AWS, automatic database migrations, plus a documented REST API, webhooks and CLI management. Multiple instances and locations in one client are pitched as ideal for service providers and the product is self-hosted by design, though the pages say the Terraform path is recently introduced and still improving, support runs by email and ticket without SLA guarantees unless I ask sales, and I found no public information on pushing clients out through Intune or Jamf or on granular administrator roles. 5 7 11 14 20
The Information Security Officer
Deployment is documented for Docker Compose, system packages, OVF and Terraform/OpenTofu modules on AWS with core, edge and gateway separated, and a documented REST API, webhooks and CLI management are available. Multiple instances and locations sit in one client with real-time configuration sync, which the vendor positions for managed service providers, and support runs via email and a ticketing system with an SLA offered at the enterprise tier. We found no public information on client rollout through MDM tools with preconfigured settings (Intune, Jamf, Kandji) or on granular administrator roles. 5 7 8 11 14 20
The Skeptic
Deployment by Docker Compose, Debian packages, OVF and a Terraform/OpenTofu path to AWS with modules for Core, Proxy and Gateway, a documented REST API with webhooks, CLI management, and a client that holds all sites and customers in one place for service providers. Support runs over email and a ticket system explicitly without SLA guarantees unless you buy the Enterprise tier, and I found no public information on MDM-based client rollout or granular administrator roles. 20 5 16 11 14
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
A published architecture with only two internet-facing components, a control plane that can sit in the intranet, mTLS everywhere, and gateways that keep operating when Core goes down. Periodic ISEC penetration tests are published in full with fix tracking — including a critical account-takeover finding — alongside Cosign-signed images, daily SBOM/CVE reports and ISO 27001:2023 with certificate number and scope; the vendor states it runs no bug bounty because the software is open source, and we found no public information on a status page or incident history. 8 9 10 14 23
The DevOps Engineer
The published architecture states plainly what each component sees: the proxy is stateless and holds no user or network data, the control plane can sit entirely in the intranet, and gateways keep forwarding even when the core is down, with mTLS between internal components. Most of the code is open source with the enterprise part open code, images are Cosign-signed with daily CVE and SBOM reports, and ISEC's periodic penetration test reports are published in full — findings, severities and fixes tracked to GitHub issues — which is exactly the verifiable assurance I look for. The vendor states it runs no bug bounty, pointing to the open code, and we found no public information on a vendor status page or published incident history. 6 9 14 23
The MSP Technician
The architecture is published down to component level — an isolated control plane, a stateless proxy, gateways exposing only the WireGuard port, mTLS between components — with gateways that keep operating when the core goes down and active-active HA on the Enterprise plan. ISEC penetration test reports are published in full with all twenty findings, including a critical account takeover, each fix tracked through GitHub, alongside Cosign-signed images, daily SBOM and CVE reports and an ISO 27001:2023 certificate with number and scope. The vendor states it offers no bug bounty because the software is open source, and we found no public information on a public status page or availability history. 8 9 14 23
The Operations Manager
The proof is public, which is rare: ISEC penetration test reports are published in full with severity counts and GitHub issues tracking each fix, down to a critical account-takeover finding, and the architecture is documented to the point of naming that only the proxy over HTTPS and the gateway on a single UDP port face the internet, with the control plane deployable on the intranet and mutual TLS between components. Most code is open source with the enterprise part open code, Docker images are Cosign-signed with daily CVE and SBOM reports, gateways survive the core going down, and active-active high availability exists on Enterprise. There is no bug bounty — the vendor points to open source — and I found no public information on a status page or a default availability SLA. 8 9 10 14 23
The Information Security Officer
The architecture is published down to which components face the Internet — only a stateless edge proxy and the WireGuard gateway — with mutual TLS between internal components and a control plane that can live permanently in the intranet, and gateways keep existing connections when the core is down. Periodic ISEC penetration tests are published in full with findings, severity counts, tested versions and links to the fixes, which is exactly the independent audit evidence my auditor would demand; the vendor also discloses ISEC is an investor and states there is no bug bounty because the code is open. We found no public information on a public status page, incident history with post-mortems, or published availability figures. 9 14 22 23
The Skeptic
This is the rare vendor that publishes the actual reports: twenty findings from the August 2026 ISEC test, including a critical account takeover in the core, each linked to the GitHub issue and fix, under recurring audits, with the vendor describing most of its code as open source and the enterprise part as open code. The control plane deploys inside the intranet, only the Edge and a single UDP gateway port face the internet, the proxy is stateless with no user data, and gateways keep operating when the Core is down. 23 9 14 10
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
A Polish company with KRS and VAT numbers published, Polish law and Szczecin courts, their own services in an ISO 27001 data center at Technopark Pomerania, and above all a strictly self-hosted product that keeps keys, user metadata and traffic logs on our own infrastructure with no external relays required. The named Google, Microsoft and Cookiebot subprocessors serve the marketing website, with analytics transfers outside the EEA disclosed under the Data Privacy Framework, and an offline licence that never contacts their licensing server is available for the paid tiers. 9 10 11 12 14
The DevOps Engineer
The contracting entity is a Polish company with a KRS registration, EU VAT number and Polish governing law, and the product is self-hosted first — documented to keep all keys, user metadata and traffic logs on your own infrastructure with no external cloud relays or third-party auth required, which puts the whole chain under my control on European hardware. ISO 27001:2023 is stated with certificate number, scope and validity, and the vendor's own services run in a named Polish ISO 27001 data centre. Website subprocessors are listed with purposes; we found no public information on a published data processing agreement. 9 10 11 12 14
The MSP Technician
The contracting entity is Defguard Sp. z o.o. in Szczecin — Polish KRS number, EU VAT ID, Polish law and Szczecin courts — and the product keeps all keys, user metadata and traffic logs on your own infrastructure with no external cloud relays required; an offline licence needs no contact with any licensing server. The vendor's own services sit in a named ISO 27001 data centre at Technopark Pomerania in Poland, and the ISO 27001 certificate number and scope are published. Website subprocessors Google, Microsoft and Cookiebot are named but may transfer analytics outside the EEA under the Data Privacy Framework, and we found no public information on a published data processing agreement. 6 9 10 11 12
The Operations Manager
The chain is short enough to explain to a client over coffee: the contracting entity is Defguard spółka z ograniczoną odpowiedzialnością in Szczecin under Polish law, with its registry and EU VAT numbers published, ISO 27001:2023 certified with the certificate number and scope on the page, and the product runs entirely self-hosted so cryptographic keys, user metadata and traffic logs stay on my own servers with no external cloud relays required. An offline licence that never contacts their licensing server closes the last call-home; I found no published data processing agreement for the product, and the vendor's own website analytics run through Google and Microsoft with transfers outside the EEA under the Data Privacy Framework, which touches their marketing site rather than my deployment. 6 9 10 11 12 14
The Information Security Officer
The contracting entity and data controller is Defguard Sp. z o.o. in Szczecin, entered in the Polish National Court Register with an EU VAT number, governed by Polish law, developed in Poland, and ISO 27001:2023 certification is published with certificate number and scope. The product is self-hosted first — keys, user metadata and traffic logs stay on our own infrastructure with no external cloud relays or third-party authentication required — and an offline licence that never contacts the vendor's licensing server can be bought, though subscriptions otherwise renew against that server. We found no public information on a published data processing agreement, and the named subprocessors (Google, Microsoft, Cookiebot) relate to the vendor's website rather than the product. 6 9 10 11 12 14
The Skeptic
The contracting entity is a Polish company in Szczecin under Polish law and Polish courts, and the entire product — cryptographic keys, user identities, connection logs, relays and gateways — runs on the customer's own infrastructure with no external cloud relays required; an offline licence variant never contacts the vendor's licence server at all. The only non-EEA transfer I can find is website analytics under the Data Privacy Framework, which touches the marketing site, not the customer's network. I found no public information on a published data processing agreement or documented export and deletion of product data, which keeps it off the top step. 10 12 11 6 9
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
The free tier is clear — open source unlimited, Business free up to 10 users and 1 location — with monthly or yearly subscriptions, licence limits by users and locations, and the Enterprise tier shown only as custom. No per-user price figure appears on the captured pricing pages, so I cannot compute the annual cost for 140 people, and VAT treatment and the offline licence price (contact sales, minimum one year, discounts do not apply) are not stated. 6 8 11
The DevOps Engineer
The three tiers and their feature mapping are public — open source always free with unlimited users and locations, Business described as a configurable package "free up to 10 users and 1 location", Enterprise "Custom" — and the licence scales by users, VPN locations and optionally device counts, with monthly or yearly subscriptions, a 14-day grace period and electronic invoicing stated. The captured pages give no per-user price figures, and the offline licence is quote-based with a twelve-month minimum and pricing-page discounts excluded. 6 8 11
The MSP Technician
The free side is unusually clear — the open-source edition is always free with unlimited users and locations, Business is free up to 10 users and one location, and licences are limited by users, VPN locations and optionally device counts on monthly or yearly subscriptions. Quoting a larger client is where it stops: the pricing page offers a configurator for Business and simply "Custom" for Enterprise, the pages we read carry no per-user figure, offline licences start at twelve months via sales with pricing-page discounts excluded, and we found no public information on VAT treatment. The Enterprise software is free to test within stated limits, with no refunds after purchase. 6 8 11
The Operations Manager
The tiers and their edges are public: an always-free open-source edition with unlimited users and locations, a Business licence free up to 10 users and 1 location with a configurable package to calculate the price, Enterprise custom-priced on request, licences limited by users and VPN locations and optionally device counts, monthly or yearly billing and a 14-day grace period. But I found no public information on an actual price per user, VAT treatment or minimum seats, so I cannot compute our annual cost for fifty people plus freelancers from these pages alone — Enterprise, where posture and high availability live, is a sales conversation. 6 8 11
The Information Security Officer
A free tier is public and generous — open source always free with unlimited users and locations, Business free up to 10 users and 1 location, and an Enterprise version usable without a licence to test — and licences scale by users and VPN locations with monthly or yearly billing and a 14-day grace period on subscriptions. However, no price figures for paid tiers appear on the captured pages: Business is a "configurable package - calculate price" and Enterprise is custom pricing, so I could not compute an annual cost. Offline licences carry a one-year minimum, pricing-page discounts do not apply to them, and they are sold by contacting sales. 6 8 11
The Skeptic
The tiers and their feature gates are public — open source free and unlimited, Business free up to 10 users and 1 location, Enterprise listed as Custom — with monthly or yearly subscriptions and licence limits defined per user, location and optionally devices, plus a stated 14-day grace period. But the captured pages carry no per-user or per-location figures, only a configurable package with a calculate-price prompt; the offline licence is a sales contact with pricing-page discounts excluded, refunds are not processed, and VAT treatment is not stated, so a buyer cannot compute a real annual cost from what I read. 8 6 11
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Defguard
Is Defguard European?
Yes. whats-best.ai classifies Defguard as EU-Made.
Where does Defguard store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Defguard have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Defguard?
As of 6 Nov 2026, the panel rates Firezone (3.5/5), Tailscale (3.5/5) and Cloudflare Zero Trust (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is GoodAccess (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Defguard alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 12 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (23)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage defguard.net Checked 5 Nov 2026 Details →
- 2 Documentation (features overview) docs.defguard.net Checked 5 Nov 2026 Details →
- 3 Documentation (device posture) docs.defguard.net Checked 5 Nov 2026 Details →
- 4 Documentation (activity and audit logs) docs.defguard.net Checked 5 Nov 2026 Details →
- 5 Documentation (deployment) docs.defguard.net Checked 5 Nov 2026 Details →
- 6 Documentation (enterprise licence) docs.defguard.net Checked 5 Nov 2026 Details →
- 7 Documentation docs.defguard.net Checked 5 Nov 2026 Details →
- 8 Pricing page defguard.net Checked 5 Nov 2026 Details →
- 9 Security / trust page defguard.net Checked 5 Nov 2026 Details →
- 10 Compliance page defguard.net Checked 5 Nov 2026 Details →
- 11 Terms of service (names the operating company) defguard.net Checked 5 Nov 2026 Details →
- 12 Privacy policy defguard.net Checked 5 Nov 2026 Details →
- 13 GDPR page defguard.net Checked 5 Nov 2026 Details →
- 14 Access model & connectivity — found from sitemap defguard.net Checked 5 Nov 2026 Details →
- 15 Access model & connectivity — found from sitemap docs.defguard.net Checked 5 Nov 2026 Details →
- 16 Identity, access policy & device posture — found from sitemap docs.defguard.net Checked 5 Nov 2026 Details →
- 17 Identity, access policy & device posture — found from sitemap docs.defguard.net Checked 5 Nov 2026 Details →
- 18 Logs, audit trail & incident response — found from sitemap docs.defguard.net Checked 5 Nov 2026 Details →
- 19 Logs, audit trail & incident response — found from sitemap docs.defguard.net Checked 5 Nov 2026 Details →
- 20 Deployment, API & administration — found from sitemap docs.defguard.net Checked 5 Nov 2026 Details →
- 21 Deployment, API & administration — found from sitemap docs.defguard.net Checked 5 Nov 2026 Details →
- 22 Architecture, reliability & security assurance — found from sitemap docs.defguard.net Checked 5 Nov 2026 Details →
- 23 Architecture, reliability & security assurance — found from sitemap defguard.net Checked 5 Nov 2026 Details →