Compare · SSHepherd®
They all connect out.SSHepherd also switches off.
Zscaler ZPA, Cloudflare Zero Trust, Teleport and Twingate each keep servers off the public internet with outbound connectors. SSHepherd does that too, then lets you turn the service on the server off. Here is how each comparison plays out, from the vendors' own documentation.
Connector-based ZTNA
UserVendor's brokerConnectorService still listening
No inbound internet ports, but the service waits on the internal network.SSHepherd®
AdminYour C3 serverAgent dials outService switched off
Nothing on the server answers a scan, from outside or inside.Comparisons
Four products.Four honest comparisons.
- SSHepherd® vsZscaler Private Access (ZPA)ZPA keeps the app off the internet. SSHepherd switches its port off.Read the comparison
- SSHepherd® vsCloudflare Zero TrustCloudflare Tunnel shuts the firewall. SSHepherd shuts the port.Read the comparison
- SSHepherd® vsTeleportBoth connect out. Only one lets you switch RDP off.Read the comparison
- SSHepherd® vsTwingateTwingate retires the VPN. SSHepherd retires the listener.Read the comparison
How we compare
Their documentation.Not our opinion of it.
Sourced from the vendor
Every statement about another product links to that vendor's own documentation, so you can check it in one click.
Dated: 6 October 2026
These products change quickly. Each page shows when it was checked, and we re-check every quarter.
No scorecards
We show where products agree as well as where they differ, and say when the other product is the better fit.
Book a demo
See it onyour own servers.
Tell us what you run today and which servers your administrators reach. We will show where SSHepherd fits, and reply within one business day.