Twingate retires the VPN.SSHepherd retires the listener.
Twingate is a straightforward way to replace a VPN: users reach individual resources, never the whole network. SSHepherd is built for the servers behind those resources, with their ports closed. Here is how the two compare.
They agree on morethan most comparisons admit.
Twingate is a zero trust network access product built to replace VPNs with least-privilege access to resources. Before the differences, the common ground.
Twingate Connectors need no inbound rules, only outbound internet access. The SSHepherd agent also dials out.
Twingate says Connectors never let users join the private network. SSHepherd connects an identity to one service on one host.
Twingate grants access per resource. SSHepherd grants access per host and service by role.
Side by side,line by line.
Taken from each vendor's own documentation, checked . Numbers link to the source. The edge on each row says which product its documentation favours, and it goes to Twingate where Twingate is stronger.
| Capability | SSHepherd® | Twingate |
|---|---|---|
| Listening on the protected serverEdge: SSHepherd | Nothing listeningNone. sshd, RDP and TCP/IP application services can be switched off, so nothing on the server waits for an inbound connection. 1 | Still listeningResources keep listening on their private ports; the Connector resolves and reaches them on the remote network. Twingate recommends firewalls between services on the same network. 23 |
| A scan from inside your networkEdge: SSHepherd | Nothing to findNo open, listening ports, even while an SSHepherd session is active. 14 | Reachable insideTwingate does not change whether the resource listens, so it stays reachable on the internal network unless separately firewalled. 3 |
| What accepts connectionsEven | Your own C3 serverYour SSHepherd C3 server, which you host on Kubernetes (on-premise or cloud). The agent and the user's Control App both connect out to it over TLS. 15 | Twingate's serviceTwingate's service; Connectors you deploy make outbound connections only. 67 |
| Session recordingEdge: SSHepherd | SSH and RDPSSH and RDP sessions are recorded, with live view and replay. 8 | SSH only, early accessSSH only, with Privileged Access for SSH, which records sessions to your own infrastructure. In early access and free for up to five resources. 9 |
| Ending a live sessionEdge: SSHepherd | ImmediateYes. An administrator watching a live session can terminate it immediately. 8 | Within about 5 minutesBlocking a device or disabling a user is enforced on active connections within about five minutes. Revoking access removes SSH access instantly with Privileged Access for SSH. 109 |
| What it coversEdge: Twingate | SSH, RDP, TCP appsSSH, RDP and TCP/IP applications, on Windows and Linux hosts. 5 | Any TCP/UDP resourceAny TCP or UDP protocol, and ICMP, to the resources you define. 2 |
- Clear strength
- With conditions
- Not documented, or still exposed
- No winner
Off the internet is good.Off entirely is better.
Twingate keeps the server off the public internet. SSHepherd also takes the service off the network the server sits on, which is where an attacker who has already got in starts looking.
Different jobs.Sometimes both.
Choose Twingate if
- Your main goal is retiring the company VPN quickly, for many users and many kinds of resource.
- You want simple per-resource access for the whole workforce, managed from the cloud.
Choose SSHepherd® if
- You need RDP and SSH sessions recorded today, with a live view and an immediate terminate.
- You want the services on the server switched off, so an attacker already inside the network finds nothing to scan.
- You want the control plane hosted on your own infrastructure.
They fit together well: Twingate for workforce access to resources, SSHepherd for administrative access to the servers, with their ports closed.
Common questions.
Does Twingate need open inbound ports?
No. Twingate Connectors need no inbound rules, only outbound internet access. The resources behind them keep listening on their private ports inside your network.
Does Twingate record sessions?
For SSH, through Privileged Access for SSH, which is in early access and free for up to five resources. Twingate does not document RDP session recording.
How quickly can Twingate cut someone off?
Twingate documents that device blocks and user disables are enforced on active connections within about five minutes, and that revoking access removes SSH access instantly under Privileged Access for SSH.
Where does SSHepherd run?
You host the SSHepherd C3 server on Kubernetes, on-premise or in the cloud. Agents on your Windows and Linux servers and the user's Control App both connect out to it.
Sources
- Full Armor: SSHepherd FAQ
- Twingate Docs: Resources
- Twingate Docs: Firewalls and Twingate
- Full Armor: Make your network traffic invisible to hackers
- Full Armor: System requirements
- Twingate Docs: Connector deployment
- Twingate Docs: Understanding Connectors
- Full Armor: Monitoring sessions
- Twingate Docs: Privileged Access for SSH
- Twingate Docs: How sessions work
- US Patent 11,153,340 B1: Elimination of listen ports on a publicly accessible computer
Checked against each vendor's public documentation on 6 October 2026. Products change: if anything here is out of date, email [email protected] and we will correct it. This page compares documented capabilities, not price or performance. Twingate and Twingate are trademarks of their owner; Auris is not affiliated with Twingate. SSHepherd® is developed by Full Armor Corporation and distributed in Southeast Asia by Auris.
More comparisons: SSHepherd vs Zscaler ZPA · SSHepherd vs Cloudflare · SSHepherd vs Teleport
See it onyour own servers.
Already running Twingate? Tell us what you protect with it and which servers your administrators reach. We will show where SSHepherd fits alongside it, and reply within one business day.