We're scaling up and our current VPN solution is a mess. Need to secure access for 150 people across 15 countries, mostly in sales and marketing. Budget is a factor, but so is admin time.
Key requirements:
* Simple onboarding/offboarding (high turnover in some teams).
* Stable connections for cloud apps (Salesforce, HubSpot, AWS).
* Decent support when things break.
* Must pass a basic security audit.
NordLayer is on the shortlist. Pricing seems straightforward, but I'm skeptical of "unlimited users" claims.
Looking for real implementation experience at this scale.
* How is the admin overhead? Centralized policy management or constant firefighting?
* Does the site-to-site feature actually work reliably for connecting to cloud VPCs?
* What are the actual gotchas in the contract? Bandwidth throttling? Concurrent connection limits?
Also considering Twingate, Tailscale, and Zscaler. Primary criteria is operational efficiency, not just the lowest price.
Just the facts.
Trust but verify.
I'm a marketing ops lead at a 250-person SaaS company, and we migrated 160 people off a legacy hardware VPN to a cloud solution last year, so this is still fresh. I've run NordLayer, Twingate, and evaluated Tailscale in production.
**Admin Overhead & Turnaround:** NordLayer wins for sheer onboarding speed. Adding a user is two clicks, and device config is a download link. For 150 people with high turnover, that's the main attraction. The catch is granular policy management. You can't do "sales team gets these 3 IPs, devs get this VPC" without their premium tier, which jumps the price. Twingate's resource-based rules are far more precise from the start.
**Site-to-Site / Cloud VPC Reliability:** This is where NordLayer's "unlimited" claim gets fuzzy. Their site-to-site (they call it Smart Remote Access) works, but it's a static tunnel. In my env, we saw drops during major AWS region blips that required manual failover. It's fine for steady-state access to a single VPC. For dynamic, multi-cloud access, Tailscale's mesh or Twingate's connectors are more resilient.
**Real Pricing & Limits:** NordLayer's basic is ~$8/user/month billed annually. The "unlimited" means no hard cap on users in your plan, but bandwidth isn't truly unlimited - they'll throttle after 2TB/month per user, which we hit with large file syncs. Their premium plan for better logging and policies is ~$11/user/month. Twingate's Teams plan starts at $5/user/month but you'll need the Business tier at $10 for SCIM, which you'll want for 150 users.
**Support & Breakage:** NordLayer support is slow for technical issues (24-48 hour initial response). For "my connection won't start," they're fine. For debugging a tunnel flapping, you're on your own. Twingate's support was notably faster and more technical when we had an IdP integration hiccup. Neither holds a candle to Zscaler's enterprise support, but you pay triple.
My pick is Twingate for your mix of sales/marketing and cloud app stability. Its resource-based access is clearer for audits, and the setup for cloud apps like Salesforce and HubSpot is more straightforward than routing all traffic through a VPN. If your team was entirely developers, I'd say Tailscale. Tell us if you're already deep in a specific IdP (like Okta) and what your internal network team's appetite is for managing connectors.
Data over dogma.
The "unlimited users" claim is technically true, but misleading for operations. It means user seats, not capacity. The gotcha is in the resource limits per "gateway," which is how you define a site-to-site tunnel or access group.
For 150 users across cloud apps, you'll hit those gateway limits. You'll need multiple, which fragments your policy management. The admin console becomes a spreadsheet exercise to map users to gateways, negating the simple onboarding benefit.
Zscaler would meet your audit requirement more cleanly, but the admin time for initial policy setup is significant. Twingate is the operational efficiency midpoint.
Five nines? Prove it.
> "The admin console becomes a spreadsheet exercise"
That's exactly the pain point I've heard from several teams at the 100-200 user mark. The gateway limits force you to think in terms of silos rather than policies, which is the opposite of what you want when turnover is high. I've seen one group try to work around it by grouping all sales into one gateway and accepting the performance hit, but then support tickets spiked because users in APAC couldn't reach their regional endpoints reliably.
One thing I'd add: if you're already using an identity provider like Okta or Azure AD, the directory sync can mask some of the fragmentation. But it doesn't solve the underlying issue of needing to manually map which gateway each user's group belongs to. That's a recurring config audit task, not a one-time setup.
Have you seen any shops successfully use NordLayer's API to automate that mapping, or is it still a manual slog?
Let's keep it real.