Best Software-Defined Perimeter (SDP) Software - Page 3

Trustgrid

The Trustgrid platform uniquely addresses the needs of SaaS application providers who rely on remote systems. By combining an SD-WAN 2.0, edge computing, and zero trust remote access into a single platform Trustgrid allows software providers to manage and support distributed application environments from the cloud to the edge. With the Trustgrid platform you can: • Build cloud to on-premise networks at scale • Manage and support 100s of networks from a single pane of glass • Control on-premise apps and appliances as if they were in the cloud • Provide your support teams secure access to edge application environments

Average Rating: 4.8/5.0

Total Reviews: 2

Vidder

Verizon further enhanced its best-in-class Software Defined Perimeter (SDP) security service by acquiring PrecisionAccess solution from Vidder. Verizon's SDP service creates a network boundary that provides trusted and unified access control for users and devices. Access control is across internal networks, clouds, and external users, enhancing security by continually ensuring that only trusted devices used by entitled users can ever see and access trusted applications.

Average Rating: 5.0/5.0

Total Reviews: 1

Waverley Labs SDP

Waverley Labs then worked closely with CSA and DHS to develop the industry’s first Open Source reference implementation for version 1 specification for DDoS.

Average Rating: 5.0/5.0

Total Reviews: 1

21tunnel

21tunnel is an open-source tunneling service built for AI coding agents. It gives assistants like Claude Code, Cursor, and Devin scoped, short-lived credentials to open secure public URLs to localhost, with one-click cascade revoke — instead of handing the agent a full-access API token. It also works as a complete ngrok alternative: HTTP, TCP, SSH and gRPC tunnels from a single Rust binary, sticky subdomains, custom domains on the free tier, edge auth via Google sign-in, a live request inspector, and teams with RBAC and audit logs. The full stack self-hosts under MIT and Apache-2.0.

Big Network

Big Network helps Internet Service Providers (ISPs), Managed Service Providers (MSPs), and Data Center Operators deploy next-generation Cloud Networks that run across any mix of internet connections enabling resilient connectivity, Static IP Addresses Anywhere, and Cloud Connectivity with lightning-fast deployment, cloud-based configurability, and unparalleled troubleshooting.

Average Rating: 5.0/5.0

Total Reviews: 1

BlackRidge Transport Access Control (TAC)

BlackRidge TAC uses a highly scalable, non-interactive authentication protocol that does not rely on signatures, sandboxing, or deep packet inspection.

BlastWave

BlastShield's Zero Trust protection is uniquely differentiated for OT networks because it addresses the inherent challenges of these environments beyond traditional IT-centric approaches. Unlike IT networks, OT environments often feature legacy systems, unpatchable devices, and real-time operational constraints. BlastShield's zero trust model acknowledges these complexities by prioritizing identity and context over traditional perimeter-based security. It's granular, identity-driven access controls extend to individual OT devices and protocols, ensuring that only authorized users and processes can access critical assets, regardless of their location within the network. This is crucial in OT, where lateral movement from compromised devices can have catastrophic consequences. Furthermore, BlastShield understands the sensitivity of OT protocols, providing policy enforcement without disrupting operations. Its ability to integrate with existing OT systems and adapt to their unique communication patterns sets it apart. By combining robust authentication, continuous authorization, and contextual awareness, BlastShield delivers a tailored zero trust solution that protects OT networks from internal and external threats, ensuring operational safety and resilience. This approach moves beyond simple access control and into understanding how OT networks function and the risks they face.

ColorTokens Xtended ZeroTrust Security Platform

Secure your workloads, users and critical assets from zero-day and advanced persistent threats in minutes

Average Rating: 4.0/5.0

Total Reviews: 2

DxOdyssey

DxOdyssey is a Software-Defined Perimeter (SDP) network security solution built on patented technology that is a critical component to achieving a Zero Trust architecture. DxOdyssey enables highly available application-specific micro-tunnels across any mix of locations and platforms. Users access their tunnels via a local port, making the device and the resource invisible to the network. With no open ports and application-level access rather than network-level access, the lateral attack surface is nearly eliminated to protect businesses and data from malicious intruders. This dynamic software solution is extremely lightweight and can be installed and configured on any Windows or Linux machine in just seconds. DxOdyssey extends SDP capabilities to edge computing with DxOdyssey for IoT, enabling secure, private bi-directional communication between edge devices, the cloud, and on-premises or remote sites – all without VPNs, SD-WANs, or open ports. DxOdyssey unlocks these key benefits: ✔️ Enable secure, private access between edge devices, the datacenter, and cloud ✔️ Eliminate any network attack surface without complexities of VPNs, SD-WANs, or open ports ✔️ Create a Zero Trust network architecture while achieving the highest ROI ✔️ Achieve complete data privacy with its intelligent matchmaking service ✔️ Built-in failover and easy 3rd party integrations ✔️ Up to a 40% increase in network throughput from traditional methods DH2i is a software provider with over 10 years of experience, helping customers around the world enhance their network security capabilities with DxOdyssey.

Average Rating: 4.5/5.0

Total Reviews: 1

enforza Firewall & Secure NAT Gateway

Enforza — cloud-managed firewall and secure NAT gateway Enforza is a cloud-managed firewall and secure NAT gateway that gives cloud, platform and security teams the same L3/L4/L7 egress control and secure NAT as the cloud-native services — at a flat, per-firewall price with no per-GB data-processing tax. For teams watching their AWS or Azure bill, that works out up to 60–80% cheaper than AWS Network Firewall, Azure Firewall, Google Cloud NGFW and cloud-native NAT gateways, because the price doesn't move with your traffic. It's not new. Enforza has been doing this for around three years, runs on the AWS Marketplace, and operates as a transparent AWS Gateway Load Balancer (GWLB) inspection appliance — a capability only a short list of enterprise NGFW vendors otherwise offer. Why teams switch Every cloud-native firewall meters you per GB of data processed — a tax that grows with every byte — usually on top of a per-hour endpoint fee that is duplicated for each Availability Zone. On AWS, a typical 2-AZ deployment runs two firewall endpoints (roughly $577/month before a single byte is inspected), then adds a per-GB charge on every byte after that. Enforza is a drop-in replacement: one appliance, flat per-firewall pricing, no per-hour endpoint fee, no per-GB charge. Because the price is fixed, the savings widen as your egress grows. (Honest note: Enforza replaces the firewall/NAT appliance and the per-GB tax. Your cloud provider's own infrastructure charges — compute hours, bandwidth — still apply. The 60–80% figure is directional; use the savings calculator on enforza.io for your own numbers.) Two ways to run it — your team's choice GitOps / GitHub Pipeline Integration. Manage firewall policy as code through a GitHub pipeline, with pull-request review, guardrail checks and an audit trail on every change. Policy-as-code for teams who already live in their pipeline. Cloud Controller console. Drive the same firewall by hand from a managed web console — define rules, manage your fleet, and see policy across clouds and regions from one place. Same firewall NVA underneath, same engine, same capabilities. The operating model is your decision, and you can run both across a fleet. Core capabilities Firewall (L3/L4/L7). SNI- and FQDN-based application filtering, plus network and VM objects, applied to egress, ingress and east-west (VPC-to-VPC, lateral) traffic — so movement between workloads is governed, not just the outbound path. No TLS decryption and no key custody, ever. Egress / SNI filtering. Control exactly which destinations your workloads can reach by hostname, with AWS IP-range and Azure Service-Tag imports kept current automatically. Secure NAT gateway. Managed outbound NAT without the cloud-native NAT gateway's per-GB processing charge — a direct answer to the Azure default-outbound-access retirement and to AWS NAT gateway cost reviews. GWLB inspection appliance. Run Enforza transparently behind an AWS Gateway Load Balancer for centralised, scalable traffic inspection — the architecture teams otherwise reach a mega-NGFW for. Consistent multi-cloud policy. One platform across AWS and Azure (GCP secondary): apply the same security policy across multiple clouds, regions and accounts, instead of re-learning each provider's native firewall. Compliance and governance. Advise-or-enforce guardrails check firewall-rule changes against 25 framework packs and over 200 controls, so policy stays compliant on every change rather than at audit time. High-performance engine. Enforza's own engine classifies and applies a verdict to each flow in microseconds, built on standard Linux network primitives. Your network, your data Enforza deploys as a network virtual appliance (NVA) inside your own cloud network — your VMs, your account, your routing. Traffic logs go to your own SIEM; they don't flow through Enforza's cloud. You keep ownership and control of your data, with no internet-exposed management plane to patch and defend yourself. Who it's for Cloud, platform, network and security engineers, SRE/DevOps leads and cloud architects — the people who own the egress policy and the cloud network bill. It fits teams running real workloads in AWS and/or Azure with enough egress and NAT traffic that the per-GB tax actually hurts: scale-ups, mid-market, cost-conscious enterprise teams, and MSP/MSSP fleets running firewalls for multiple clients. How Enforza compares vs AWS Network Firewall / Azure Firewall / Google Cloud NGFW: the same core L3/L4/L7 control and secure NAT, without the per-GB data-processing tax or per-AZ endpoint fees. You replace the metered firewall, keep the control, and deploy in your own network. vs enterprise NGFWs (Palo Alto, Fortinet, Check Point): the focused inspection and egress capability most cloud teams actually use — including GWLB inspection — at flat per-firewall pricing, without the bloat or vCPU-metered licensing of a full NGFW suite. vs DIY / open-source (pfSense, OPNsense, fck-nat): the same escape from per-GB NAT charges, but managed — HA, one console for the whole fleet, no SSH-into-boxes, no internet-exposed management plane, no DIY patching. Getting started Start on the free tier, run a 14-day trial of the full feature set, deploy one-click from the AWS Marketplace, or book a demo for fleet, MSP and enterprise rollouts. Flat per-firewall pricing, with volume pricing that lowers the per-firewall rate as your fleet grows. Enforza — the same control, run your way, without the per-GB tax.

Fidelis Halo

CloudPassage is a security and compliance automation platform designed to provide instant visibility and continuous protection for servers in any combination of data centers, private clouds and public clouds.

Average Rating: 4.8/5.0

Total Reviews: 3

iQuila

Outpost24 External Attack Surface Management

Sweepatic is a cybersecurity start-up operating on a global scale making our customers cyber resilient.

RBridge

SAIFE Connect

SAIFE Connect eliminates the concepts of a traditional network perimeter and trusted users and devices. Instead, creating on-demand, zero trust network micro-perimeters for each connected device based on attributes such as user identity, device identity, location, date, time and device posture.