Forcepoint ZTNA vs Pomerium

Forcepoint ZTNA provides controlled access to private applications from managed and unmanaged devices, including personal devices and contractor access. Its agentless and agent-based options let users reach internal applications without requiring a VPN service on their device. Administrators can base access policies on user or group, device type or operating system, management status, and location. Agent-based access supports private web applications and non-web protocols, including TCP applications through SmartEdge Agent. The product can proxy private-app traffic and apply inline data loss prevention controls intended to help prevent data leakage and malicious uploads or downloads. Forcepoint cites more than 190 predefined DLP policies and malware scanning for private web apps. Deployment requires a connector in the network hosting internal apps. Agent-based use requires SmartEdge Agent 1.6.1 or newer, and end-user machines must run Windows 10 or newer. Forcepoint says its AWS-based platform provides 99.99% service uptime with no planned downtime. The paid product has pricing on request and no free plan.

Pomerium is an open-source identity-aware proxy for controlling access to internal applications, servers, services, and workloads without requiring VPN client software. It checks identity, device state, and request context before granting access, and authenticates through identity providers that support OpenID Connect. Listed access scenarios include HTTP, MCP, SSH, gRPC, TCP, and UDP; supported app protocols also include HTTPS, HTTP/2, HTTP/3, and WebSocket. Pomerium removes its authentication cookies before forwarding requests upstream, and sensitive databroker data is encrypted at rest. Downstream TLS has a minimum of TLS 1.2. Deployment options include Linux and macOS binaries, packages, Docker images, source builds, and desktop clients for Windows, macOS, and Linux. The free Personal plan lists 10 users, 10 routes, five policies, and two service accounts. Business costs $7.00 per month, billed annually, and lists limits of 1,000 users, 100 routes, 100 policies, and 20 service accounts. A free trial is also listed.