# Defguard — Business VPN & Zero Trust Access Defguard by Defguard Sp. z o.o. holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: EU-Made; sovereignty: not determined. - Vendor: Defguard Sp. z o.o. (https://defguard.net) - Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md) - Provenance (editorial classification): EU-Made - Canonical page: https://whats-best.ai/software/business-vpn/defguard - Alternatives: https://whats-best.ai/software/business-vpn/defguard/alternatives ([markdown](https://whats-best.ai/software/business-vpn/defguard/alternatives.md)) - Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: Defguard Sp. z o.o. - Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026 - Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026 - Free plan: Not stated on the vendor’s pages as of 5 Nov 2026 ## The panel's verdict Defguard is a self-hosted WireGuard VPN with a built-in identity provider and MFA, from Defguard Sp. z o.o. of Szczecin, Poland; the vendor describes most of its code as open source, with the enterprise part open code. The bench's strongest marks land on architecture and assurance and on sovereignty, both at 8–9: only a stateless proxy and a single UDP gateway port face the internet, ISEC penetration test reports are published in full — all twenty findings, each fix tracked on GitHub — and the self-hosted design keeps keys, user metadata and traffic logs on your own infrastructure. Identity and policy and visibility and audit sit at a flat 7. Access and connectivity runs 6–7, the weakest of the functional criteria, with judges finding no public information on clientless browser access, private or split DNS, or site-to-site cloud links. Deployment and administration spans 7–8, scriptable end to end though the judges found no public information on MDM client rollout or granular admin roles. The widest spread is pricing transparency at 3–5, a generous free tier against pages that carry no per-user figure. **Speaks for it:** - ISEC penetration test reports are published in full, with all twenty findings — including one critical account takeover — each fix tracked through GitHub issues - Firewall rules generate each user's allowed IPs, so every tunnel carries only the subnets its rules permit - MFA is enforced at the WireGuard protocol level on every connection, with TOTP, email, WebAuthn/YubiKey and biometric methods - Deployment paths include Docker Compose, system packages, OVF and Terraform/OpenTofu modules on AWS, alongside a documented REST API, webhooks and CLI management - The product runs self-hosted, documented to keep keys, user metadata and traffic logs on your own infrastructure, with an offline licence that never contacts the vendor's licensing server **Held against it:** - The judges found no public information on clientless browser access, private or split DNS, or site-to-site links into cloud networks - The judges found no public information on MDM-based client rollout, granular administrator roles, SCIM provisioning or just-in-time access with approval - Standard support runs by email and ticket expressly without SLA guarantees and on an 'as is' basis, with an SLA offered at the Enterprise tier - The captured pricing pages carry no per-user figure — Business is a configurable package and Enterprise is listed as 'Custom' — and VAT treatment is not stated - The vendor states it runs no bug bounty, and the judges found no public information on a public status page, incident history, or a published data processing agreement **Best for:** - You run your own infrastructure and want a VPN that keeps cryptographic keys, user metadata and traffic logs on it, with no external cloud relays required - You need least-privilege remote access — each user's tunnel carries only the subnets their firewall rules allow - You must show an auditor independent evidence — full ISEC reports with fix tracking, an ISO 27001:2023 certificate with published number and scope, and activity logs streamable to Vector or Logstash - You are a managed service provider — multiple instances and locations sit in one client, which the vendor pitches as ideal for MSPs **Avoid if:** - You want a vendor-managed SaaS VPN — the product is self-hosted by design, with production guidance recommending a dedicated server or VM per component - You need an SLA-backed support commitment — standard support runs expressly without SLA guarantees and 'as is', with the SLA offered at the Enterprise tier - You need device posture checks or active-active high availability below the top tier — both are gated to the Enterprise plan, which is priced only on request - You need to compute your annual cost from published prices — the pages show no per-user figure, Business is a configurator, Enterprise is 'Custom', and offline licences are sold via sales at a one-year minimum ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion. | Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Access model & connectivity | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Identity, access policy & device posture | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Logs, audit trail & incident response | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Deployment, API & administration | 3.5/5 | 4/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 | | Architecture, reliability & security assurance | 4/5 | 4.5/5 | 4/5 | 4/5 | 4/5 | 4/5 | | European sovereignty | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4.5/5 | | Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r | | **Weighted verdict** | **3.5/5** | **4/5** | **3.5/5** | **3.5/5** | **4/5** | **4/5** | ### The judges - **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round. - **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see. - **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first. - **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby. - **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed. - **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Hosting location | Not determined | — | — | | Hosting options | Not determined | — | — | | Open source | Not determined | — | — | | Data processing agreement | Not determined | — | — | | Transfer impact assessment | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - Analytics transfer: Analytics data may be transferred outside EEA [S12] - Audit trails: yes [S1] - Bug bounty: no [S9] - Cookie banner: EEA · UK · Switzerland · Cookiebot [S12] - Finding dg2608 12 biometric key planting: DG2608-12 · Broken Access Control in enrollment RegisterMobileAuth allows cross-user biometric key planting · Medium · core [S23] - Finding dg2608 15 risk accepted: DG2608-15 · Core pushes the deployment's external TLS private key and a deployment-wide cookie master key to every adopted edge · Medium · yes [S23] - Finding dg2608 17 setup dos: DG2608-17 · Unauthenticated initial setup endpoints cause permanent DoS and persist rejected settings · Medium · core [S23] - Finding dg2608 18 client ip: DG2608-18 · Client IP address is taken from attacker-controlled forwarding headers and forwarded to Defguard Core · Medium · proxy [S23] - Finding dg2608 20 edge adoption: DG2608-20 · Unauthenticated Edge or Gateway adoption allows full core impersonation · Medium · proxy, gateway [S23] - Finding dg2608 3 refresh token: DG2608-3 · OAuth2 refresh_token grant skips client authentication and returns tokens unrotated · High · core [S23] - Finding dg2608 4 account takeover: DG2608-4 · Full Account Takeover due to unescaped LIKE wildcards in find_by_email · Critical · core [S23] - Finding dg2608 9 signing key: DG2608-9 · Instance master signing key exposed in support configuration bundle · High · core [S23] - Findings counts: 7 · 2 · 2 · 20 · 8 · 1 [S23] - Frameworks: ISO27001 · NIS2 · GDPR · HIPAA [S1] - Frameworks supported: GDPR · HIPAA · PCI DSS · NIST [S10] - GDPR rights: access · rectification · erasure · restriction · objection [S12] - Isec supervision: yes · ISEC [S9] - ISO 27001: yes [S1] - ISO 27001: 2023 · yes [S9] - ISO 27001 certified: Poland, EU · yes [S14] - ISO certificate number: PL018610/P [S10] - ISO scope: Delivering IT cybersecurity solutions for identity, SSO, remote access, and device access management in networks [S10] - ISO validity: 2026-01-07 · 2029-01-06 [S10] - Non eea cookies default: Outside banner regions, analytics/marketing cookies are set by default without consent banner [S12] - Open source: yes [S14] - Pentest report public: ISEC · yes [S9] - Pgp key: https://defguard.net/pgp-key.txt · 3CC9 D7FD A5F5 DE35 52D8 806E FA1F 797D FA71 B44A [S9] - Public penetration reports: GitHub issues linked to pull requests · yes [S23] - Public pentests: yes [S14] - Regulatory alignment: ISO 27001 · NIS2 · GDPR · HIPAA · yes [S14] - Report date 2026 08: 2026-08-27 [S23] - Report tested versions: 1.7.0-beta1 · 2.1.0-beta1 · 2.1.0-beta1 [S23] - Sbom: yes · yes · yes [S10] - Sbom: yes · yes [S9] - Sbom cve: yes · yes [S14] - Sbom public pentest: yes · yes [S1] - Security measures: technical and organizational measures including encryption and access controls [S12] - Vulnerability disclosure: security@defguard.net · yes [S9] **Data** - Categories: contact info, billing info, support inquiries, cookies/website usage data [S12] - Retention billing: 5 [S12] - Retention cookie consent: 12 [S12] - Retention support: 2 [S12] - Sale of data: no [S12] **Hosting** - Datacenter: Technopark Pomerania · yes [S9] - EU based: yes · Poland · no [S1] - Hq poland: Poland · no [S10] - No vendor lock in: No vendor lock-in [S9] - On premise: On-premise / self-hosted first [S9] **Integrations** - API webhooks: yes · yes [S22] - Device posture admin required: yes [S16] - Device posture get endpoint: cookie session (defguard_session, required) · GET · get a device posture check policy · /api/v1/device-posture/{id} [S16] - Docker signing: yes · yes [S9] - Example repository: yes [S5] - Posture cli management: yes [S3] - Release checksums: yes [S9] - Rest API: yes · yes [S7] - Webhooks rest API: yes · yes [S2] **Legal** - Changes notice: 24 [S12] - Company: defguard sp z o.o [S8] - Controller: Defguard spółka z ograniczoną odpowiedzialnością · office@defguard.net · ul. Cyfrowa 6/317, 71-441 Szczecin, Poland [S12] - Entity: defguard sp z o.o [S1] - Entity: defguard sp z o.o [S10] - Entity: Szczecin · Defguard Sp. z o.o. · ul. Cyfrowa 6/317, 71-441 Szczecin · Poland [S11] - Entity: defguard sp z o.o [S9] - Entity: defguard sp z o.o [S14] - Governing law: Polish law · Szczecin, Poland [S11] - Governing law: Polish law · Szczecin, Poland [S12] - Isec investor: yes [S9] - Registration: 0001168794 · PL851-332-92-06 · National Court Register [S11] - Terms changes: 24 [S11] **Pricing** - Business model: configurable package, calculate price · 10 · 1 [S8] - Enterprise license: Defguard Enterprise license exists with scope, limits, and purchasing process [S7] - Enterprise model: custom pricing, request a quote · yes [S8] - Free business license: Business · yes · https://defguard.net/get-free-business/ [S6] - Free enterprise version: no · yes [S11] - Free license: yes [S14] - Invoices: yes [S11] - Offline license: sales@defguard.net · yes · no [S6] - Offline license no grace period: 0 [S6] - Offline licenses: 12 · no [S11] - Open source free: Always free, unlimited users and locations · yes [S8] - Payment processing: Provider does not store or process payment information; managed by payment processor; retains billing info for invoicing only [S11] - Siem streaming enterprise: enterprise · yes [S4] - Siem streaming plans: Business · Enterprise [S18] - Subscription grace period: 14 · yes [S6] - Subscription monthly yearly: https://defguard.net/pricing/ · monthly · yearly · yes [S6] - Subscription renewal process: yes · yes [S6] **Product** - Acl least privilege: centralized ACLs · ISO 27001 A.5.15 [S10] - Active active ha: Enterprise · yes [S14] - Activity log date filter: UTC · yes [S4] - Activity log events defguard: defguard · UserLogin · UserLoginFailed · UserLogout · UserMfaLogin · UserMfaLoginFailed [S4] - Activity log events enrollment: enrollment [S4] - Activity log events ldap: active_directory · ldap [S4] - Activity log events oidc sync: oidc_directory_sync [S4] - Activity log events posture: posture [S4] - Activity log events vpn: vpn [S4] - Activity log fields: Date · User · IP · Event · Module · Device [S4] - Activity log modules: defguard, client, enrollment, vpn, posture, active_directory, ldap, oidc_directory_sync [S4] - Activity log overview: Activity Log tracks user interactions as an audit trail, viewable in the core Web UI [S4] - Activity log permissions: yes · yes [S4] - Activity log search: Username · Module · Event · Device · yes · yes [S4] - Admin dashboard: yes [S2] - Admin device management: yes [S14] - Allowed ips from firewall: yes [S8] - Always on vpn: yes [S14] - Ami requirements: yes · yes [S20] - Analytics tools: Google Analytics and Microsoft Clarity used for website analytics, advertising measurement with consent [S12] - Architecture control plane: Control plane deployable in Intranet, not Internet-accessible [S9] - Attack surface: Edge HTTPS · Gateway single UDP port [S14] - Audit filtering: yes [S2] - Audit logging: yes [S2] - Audit logs: yes [S8] - Audit logs: yes [S14] - Automatic ip allocation: yes [S2] - Biometric approval: yes [S14] - Biometric MFA: yes [S1] - Biometric MFA: protocol · FaceID · TouchID [S10] - Biometry device indicator: fingerprint icon shown next to device name for biometry-configured devices [S17] - Biometry internal MFA: internal MFA method · mobile devices · yes [S17] - Builtin identity provider: OpenID Connect provider for user authentication [S8] - Business features: External SSO (Google, Microsoft EntraID, Okta, JumpCloud), external SSO VPN MFA, real-time client config sync, firewall ACLs, LDAP/AD sync, admin-only device management, client traffic policies, SIEM log streaming, REST API [S8] - Business plan features: REST API · LDAP and Active Directory integration · external OpenID providers · firewall (ACL) · activity log streaming · client behaviour customisation [S6] - Client disconnect threshold: client disconnected after inactivity threshold met · 60 [S17] - Client vendor lockin: yes [S14] - Compliance section: Documentation includes a compliance section covering common security standards and regulations [S7] - Components: WireGuard VPN · SSO/Identity Provider · firewall access control · zero-touch enrollment [S14] - Components listed: Core · Proxy · Gateway · Desktop Client · Mobile Client [S23] - Core database: postgres:18-alpine · PostgreSQL [S5] - Core database: PostgreSQL [S20] - Core default port: 8000 [S5] - Core image registry: ghcr.io/defguard/defguard [S5] - Database migrations automatic: yes [S5] - Dedicated server recommendation: each service on a dedicated server or VM [S5] - Default instance type: t3.micro [S20] - Default vpn port: 50051 [S20] - Deployment: Docker · system packages · OVF [S1] - Device attestation: coming to 2.2 · no [S8] - Device posture: yes [S2] - Device posture: yes [S8] - Disconnect threshold recommendation: 300 [S17] - Docker compose components: Core · Edge · Gateway [S5] - Docker image tags: latest · vX.Y · vX.Y.Z · vX.Y-alpha1 · pre-release · dev [S5] - Edge image registry: ghcr.io/defguard/defguard-proxy [S5] - Edge ports: 8080 · 80 · 443 [S5] - Enforced client: block non-Defguard WireGuard clients [S8] - Enterprise features: Active-Active HA, device posture policies, service VPN locations (pre-login & always on), device attestation (coming soon), multi-step MFA workflows (coming in 2.2 November), allowed IPs from firewall rules, offline license, pay by invoice… [S8] - Enterprise invoicing: Enterprise offers offline license and pay by invoice [S8] **Subprocessors** - Named: analytics, tag management, ads (with consent) · cookie banner and consent record · Clarity analytics [S12] **Support** - Channels: yes · yes · yes [S7] - Channels: support@defguard.net · email · ticketing system [S11] - Demo available: yes [S1] - Enterprise SLA: Enterprise Support SLA and Pilot Deployment offered [S8] - License configuration: Settings -> License -> Enter license [S6] - Rights contact: support@defguard.net [S12] - Scope: Deployment/setup assistance and resolving functionality issues [S11] - SLA: no · sales@defguard.net [S11] - Warranty disclaimer: no [S11] 152 more facts on the canonical page: https://whats-best.ai/software/business-vpn/defguard ## Questions ### Is Defguard European? Yes. whats-best.ai classifies Defguard as EU-Made. ### Where does Defguard store data? Not stated on the vendor’s pages as of 5 Nov 2026. ### Does Defguard have a free plan? Not stated on the vendor’s pages as of 5 Nov 2026. ### What are the best alternatives to Defguard? As of 6 Nov 2026, the panel rates [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone), [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) and [Cloudflare Zero Trust (3.5/5)](https://whats-best.ai/software/business-vpn/cloudflare-zero-trust) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [GoodAccess](https://whats-best.ai/software/business-vpn/goodaccess) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Defguard alternatives](https://whats-best.ai/software/business-vpn/defguard/alternatives). ## What this page leaves out - 12 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 6 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. ## Sources - [S1] Vendor homepage: https://defguard.net/ (checked 2026-11-05) - [S2] Documentation (features overview): https://docs.defguard.net/about/features-overview (checked 2026-11-05) - [S3] Documentation (device posture): https://docs.defguard.net/features/device-posture-verification (checked 2026-11-05) - [S4] Documentation (activity and audit logs): https://docs.defguard.net/features/activity-log (checked 2026-11-05) - [S5] Documentation (deployment): https://docs.defguard.net/deployment-strategies/docker-compose (checked 2026-11-05) - [S6] Documentation (enterprise licence): https://docs.defguard.net/enterprise/license (checked 2026-11-05) - [S7] Documentation: https://docs.defguard.net/ (checked 2026-11-05) - [S8] Pricing page: https://defguard.net/pricing (checked 2026-11-05) - [S9] Security / trust page: https://defguard.net/security (checked 2026-11-05) - [S10] Compliance page: https://defguard.net/compliance (checked 2026-11-05) - [S11] Terms of service (names the operating company): https://defguard.net/tos (checked 2026-11-05) - [S12] Privacy policy: https://defguard.net/privacy (checked 2026-11-05) - [S13] GDPR page: https://defguard.net/gdpr (checked 2026-11-05) - [S14] Access model & connectivity — found from sitemap: https://defguard.net/enterprise-wireguard-vpn/ (checked 2026-11-05) - [S15] Access model & connectivity — found from sitemap: https://docs.defguard.net/features/wireguard/create-your-vpn-network/split-tunnel-configuration (checked 2026-11-05) - [S16] Identity, access policy & device posture — found from sitemap: https://docs.defguard.net/for-developers/rest-api/core/device-posture/get-a-device-posture-check-policy (checked 2026-11-05) - [S17] Identity, access policy & device posture — found from sitemap: https://docs.defguard.net/features/wireguard/multi-factor-authentication-mfa-2fa/external-sso-based-mfa (checked 2026-11-05) - [S18] Logs, audit trail & incident response — found from sitemap: https://docs.defguard.net/features/activity-log/activity-log-streaming (checked 2026-11-05) - [S19] Logs, audit trail & incident response — found from sitemap: https://docs.defguard.net/features/activity-log/activity-log-streaming/activity-log-integrations (checked 2026-11-05) - [S20] Deployment, API & administration — found from sitemap: https://docs.defguard.net/deployment-strategies/terraform (checked 2026-11-05) - [S21] Deployment, API & administration — found from sitemap: https://docs.defguard.net/deployment-strategies/standalone-package-based-installation (checked 2026-11-05) - [S22] Architecture, reliability & security assurance — found from sitemap: https://docs.defguard.net/in-depth/architecture/security-concepts (checked 2026-11-05) - [S23] Architecture, reliability & security assurance — found from sitemap: https://defguard.net/pentesting/ (checked 2026-11-05) --- Cite as: whats-best.ai, "Defguard — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/defguard Corrections: https://whats-best.ai/correct/1594?target=page