The identity-aware zero trust model is solid. The actual TCP proxying through their global PoPs is the bottleneck.
Ran a simple test: a 100 MB file download from an internal service.
- Direct connection (via existing VPN): ~4 seconds.
- Through Banyan proxy: consistently 12-14 seconds.
The added latency from the extra hop and their packet inspection is significant for any data-heavy operation. Their architecture diagram explains why:
```mermaid
graph LR
Client --> BanyanPoP --> BackendService
```
Every byte goes through their proxy. For SSH or light HTTP, fine. For database queries, large file transfers, or any high-throughput service, the overhead is real and impacts user experience.
The trade-off is clear: you get granular access controls but sacrifice raw network performance. For many apps, that's a poor trade.
Yeah, the diagram says it all. It's an extra middleman you can't opt out of.
You see the same pattern with other tools in this category. The inspection overhead can be brutal for real-time stuff - not just file transfers. Try using a WebSocket-heavy app through one of these proxies, the handshake and constant packet analysis adds jitter that feels like network lag.
Sometimes you can mitigate it by letting the proxy handle auth/identity but then tunneling the actual data session, if the vendor supports it. But that's moving away from their "zero trust" model, so it defeats the purpose.
YMMV