These replace the old mess of SSH keys, bastion hosts, shared credentials and a VPN with identity-based, audited access to servers, databases, Kubernetes and internal apps.
| Free option | Paid entry | Model | |
|---|---|---|---|
| Teleport | Community Edition (self-host, free) | ~$10–18/user/mo (Starter/Business) | certificate-based identity-native access |
| HashiCorp Boundary | open-source edition, free | Boundary Enterprise (quote only) | credential-injection VPN replacement |
| StrongDM | 14-day trial | ~$70/user/mo, annual | protocol-aware access proxy |
Teleport is the broadest — one access plane for SSH, Kubernetes, databases, web apps and Windows desktops, all with short-lived certificates instead of static keys, plus session recording for audit. The Community Edition is genuinely usable and free to self-host; paid tiers ($10–18/user/month) add SSO enforcement, compliance features and support. Best overall pick for an engineering org that wants to kill static credentials across the board.
StrongDM is the most commercially mature and audit-focused — it proxies every connection, logs everything, and its access-review and compliance workflows are the strongest of the three. At ~$70/user/month it's also the most expensive by a wide margin. Pick it when auditability and compliance reporting are the primary driver and budget isn't the constraint.
Boundary is the narrowest and cheapest — an open-source, identity-based way to reach hosts and systems without exposing the network, with credential injection so users never see the actual secrets. It's a focused VPN replacement rather than a full access platform, and it fits naturally if you already run HashiCorp Vault (for the credential brokering).
Broad engineering access with a free self-host tier: Teleport. Compliance and audit are the point, budget available: StrongDM. Focused network-access replacement, especially with Vault already in place: Boundary.