Twingate provides Zero Trust Network Access (ZTNA) for organisations that want to replace their VPN with access granted per resource. Users, services and AI agents reach only the private networks, databases and applications their policies allow, instead of joining a whole network through a central tunnel.
The problem it solves is the broad trust a VPN creates. Once connected, a VPN user can often reach far more than their job needs, and a stolen login gives an attacker the same reach. Twingate narrows access to the specific resource each identity is allowed to use.
At A Glance
| Vendor | Twingate |
|---|---|
| Category | Zero Trust Network Access |
| Identities covered | Users, devices, services and AI agents |
| Deployment | Connectors behind the customer firewall, outbound connections only |
| Customers | Blend, Modern Health, H2O.ai, Zappi, Kooapps |
| Founded | 2019 |
| Market classification | Network Security |
What Twingate Does
Traditional VPNs put a remote user on the network and leave the rest to firewalls. Twingate takes the opposite approach: each request is tied to an identity and checked against least privilege policy at the resource, whether that is an office network, a cloud VPC, a database or an internal application. The product line sums this up as “Security, Performance, Simplicity. Pick Three.” Access and internet security share one client and one admin model, so a single policy decides what each person or agent can reach.
Products
Zero Trust Network Access
The core product gives remote and hybrid teams direct, per resource connections to office networks, cloud VPCs and other private resources, with no central tunnel to bottleneck traffic. Policies route by IP or DNS and can be scoped down to protocol and port.
- Just in time access requests and auto lock
- Device controls that require specific security settings before access is granted
- Auditable session recording for each user
Internet Security
Internet Security protects users when they browse outside private resources. It filters DNS and content, blocks threat feeds, cryptojacking and typosquatting domains, applies Google Safe Browsing lists, and turns DNS logs into network intelligence for security teams.
Identity Firewall
Identity Firewall moves enforcement to the resource itself, so every database and application checks who is asking before it answers. This suits organisations that need least privilege inside the network as well as at its edge.
Zero Trust As Code
Platform and DevOps teams can deploy and change their whole Twingate configuration through Terraform, Pulumi or the Twingate API, keeping access policy in version control alongside the infrastructure it protects.
How It Works
Twingate is built from four components that together ensure only authenticated users reach resources. It uses its own encrypted proxy architecture rather than WireGuard.
| Component | What it does |
|---|---|
| Controller | The central coordination component. It is the only component that never handles data traffic. |
| Client | Runs on the user’s device and acts as a combined authentication and authorisation proxy, opening a certificate-pinned TLS tunnel to the right Connector. |
| Connector | Sits behind the firewall of a private network and keeps outbound connections to at least one Relay, so no inbound port has to be opened. |
| Relay | A registration point for Connectors and a meeting point for Clients. Twingate tries a peer to peer connection first and uses the Relay as a fallback; no data-carrying connection is terminated at the Relay. |
Identities And Systems Covered
| Users | Workforce users synchronised from identity providers, with user and group policies |
|---|---|
| Devices | Device posture checked through endpoint and device management tools |
| Services and AI agents | Non-human callers that receive access on the same terms as users |
| Resources | Office networks, cloud VPCs, databases and applications |
| Cloud platforms | AWS, Azure and Google Cloud |
Integrations
| Area | Integrations |
|---|---|
| Identity providers | Entra ID, Okta, Google Workspace, OneLogin, Keycloak, JumpCloud |
| Device verification | CrowdStrike, SentinelOne, Microsoft Intune, Kandji, Iru, Jamf, 1Password, Hexnode |
| Access workflows | Slack, Opal, ConductorOne |
| Monitoring and response | Amazon S3, Datadog, PagerDuty |
Company Background
| Founded | 2019, to address secure remote access |
|---|---|
| Headquarters | Redwood City, California, United States, with a remote first model and distributed teams worldwide |
| Investors | Green Bay Ventures among its backers |
Note: This overview is compiled from Twingate’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.