Hey everyone! 👋 Long-time lurker, first-time poster in this specific subforum. I've been absolutely *living* in the world of secure access for the last six months as my company (we're fully remote, about 150 of us scattered to the winds) finally decided to get serious about replacing our jumble of VPNs, shared credentials, and crossed fingers.
I've been tasked with leading the evaluation, and let me tell you, the rabbit hole goes deep. We have data analysts (like me, hi!), devs, sales, and support all needing different things. I've spun up trials, made spreadsheets you wouldn't believe, and pestered more sales engineers than I can count.
So, I wanted to compare notes! What's working for your distributed teams? I'm especially curious about the day-to-day workflow fit for a sub-200 user company where you might not have a giant dedicated security team.
Here’s what I’ve been weighing heavily:
* **The "Zero Trust" in practice:** It's easy to say, but how clunky is it for non-tech users? Does it truly feel transparent for accessing the BI tools, the database replicas, and the internal web apps? Or do people get hit with prompts and auth requests every five minutes?
* **The data governance angle:** I care a lot about audit trails. Can I easily pull a report to see *who* accessed *which* internal tool and *when*? Bonus points if it plays nice with our existing log aggregators.
* **The admin overhead:** We're a small IT team. Setting up SCIM provisioning, managing device posture checks, and defining access policies—how much of a lift is it really post-implementation? I'm terrified of building a beautiful, secure castle that requires constant manual upkeep.
* **The "niche feature" tangents:** I know I get obsessed with these, but things like:
* Can it handle short-lived credentials for our ETL scripts that pull from internal sources?
* How granular can access get? Is it just "this group gets this app," or can I get down to "this user can run SELECT queries on this schema but can't touch the billing table"?
* Does it have any native integration with tools like Tableau Server or Metabase to streamline access?
We've been looking hard at the usual suspects (Zscaler, Twingate, Tailscale, Cloudflare Zero Trust) and, of course, the solution this forum is named for. The pricing models are all over the map—per user, per monthly active user, with commit discounts. It's a lot to sort through.
I'd love to hear your real-world experiences, especially if you've gone through a migration. What were the hidden pitfalls? What made your users actually happy? What admin feature do you now wonder how you lived without?
—Jake
Spreadsheets > opinions
DevOps lead at a 120-person fintech startup, all remote. We've been running Tailscale in production for about two years for access to AWS VPCs, Kubernetes, and internal tooling (Grafana, Superset, Postgres).
* **Forget per-user pricing:** At your scale, you want a device-based model. Tailscale is free for up to 3 users/20 devices, then it's $10/device/month billed annually. For 150 users with maybe 180 devices (phone+computer), you're looking at ~$1,800/month, flat. No surprises. Competitors like Zscaler or Cloudflare Zero Trust tie you to per-user seat licenses starting at $7-10/user/month, which seems lower until you realize you pay for every human regardless of how many devices they have.
* **Integration effort is near zero:** You install the client and it uses your existing identity provider (Google Workspace, Okta, etc.) for auth. The biggest lift was configuring ACLs in a single `tailscale.yaml` file. We had initial access for a pilot group in under 45 minutes. A traditional VPN appliance would have taken a week of network engineering.
* **The non-tech user experience is silent:** Once installed, there's no "connect to VPN" step. Applications just work. The only prompts are a standard SSO login every 30 days (configurable) or when accessing a resource from a new device. Our data analysts never ask for help, which is the highest praise.
* **It breaks when you need deep packet inspection:** It's a mesh VPN, not a proxy. If you need to scan all HTTP traffic for threats at the edge, this isn't the tool. It's for *access*, not inline inspection. We use a separate WAF/IDS for our public endpoints, which is the correct separation anyway.
I'd push you toward Tailscale. The use case it nails is transparent, no-fuss access to networked resources for a fully remote team. If you need to make the decision dirty, tell us: 1) whether you have a compliance requirement to proxy/log all web traffic, and 2) if your "internal web apps" are all cloud SaaS or if some are legacy on-prem junk that needs TCP forwarding.
Your fancy demo doesn't scale.
That's a really solid, practical breakdown of the pricing model. You're spot on about the device vs. user cost comparison being critical at this scale. It flips the script on the initial sticker price.
One thing I'd add from moderating these discussions is that the silent, "just works" experience for non-tech users can be a double-edged sword. It's fantastic for adoption, but it sometimes means they have zero mental model for *when* they're on the secure network. We've seen a few threads where that leads to confusion about accessing local vs. company resources, especially when they're traveling or on home networks. A tiny bit of user education up front saves a lot of "why can't I print" tickets later.
How has your team handled that onboarding or communication piece?
Quality over quantity.
That's such a great point about the user's mental model, or lack thereof. We ran into the same thing with our sales team. They loved that the VPN was always-on and silent, but then got confused about accessing customer demo portals vs. our internal CRM.
Our fix was a simple, one-slide visual in the onboarding deck with a green "you're secure" shield icon that shows in their system tray. We just tell them, "If the shield is green, you can access the sales dashboards and customer data. If it's not, you can't." Reduced those support tickets by a ton. It's less about technical training and more about creating a single, clear signal.