Fyde vs VPN

	Fyde	VPN

	Native support for trusted devices	No native support for trusted devices

	Generates and stores device certificate on hardware keystore	Relies only on user credentials for infrastructure access

	Sends a CSR to Management Console to register device and establish trust	Depends on 3rd-party tools like MDM to establish a native version of trusted devices

	Validates every access request against current security and compliance policy	Requires enrollment to corporate MDM to determine trusted devices

	Deploys conditional and contextual trust	Static trust architecture

	Certificate management is built-in for both device and infrastructure components	Certificate management is difficult and requires 3rd-party tools

	Fyde	VPN

	Access resources not the entire network. Direct trusted users to the information they need, whether in a VPC, data center or on-premises without increasing risk	VPN clients can act as patient zero on your network, increasing the potential attack surface exponentially. A compromised VPN client, residing on a VLAN with complete network access, can launch attacks on other clients on the same VLAN, ultimately exposing every routable VM/workload

	Connect to multiple infrastructure sites without switching access profiles	Requires user to switch between VPN configurations to access multi-site environments

	Confirm or deny access based on user role and device attributes: RBAC+ABAC. Example: User A in Group B with Device C that complies with policy D can access resource	Implements network segmentation, a painful and error-prone approach that requires 3rd party or custom tools. Limits ability to access dynamic, modern resources like Kubernetes workloads

	Fyde	VPN

	Continuously monitors device and logs network metadata at the device level (network DVR)	Lacks visibility into device security status before starting active VPN session

	Enforces policy that requires searching for a comprehensive IOC (indicators of compromise) list in network history before granting access	Cannot integrate with a local security agent as part of an access policy

	Conducts retrospective search for IOC	Provides only single point in time access to device security state. Any change to the device security state is not reflected in the active session.

	Detects if the device has ever exchanged information with a phishing site: e.g. mycompany.oktaa.com

	Detects if the device has ever generated APT x C&C traffic

	Fyde	VPN

	Role-based access control enhanced with attribute-based access control	Role-based access control (RBAC) only. Access tokens can be permanent or long-lived, creating additional risk as VPNs do not natively support re-auths and step-up auths

	Rich attribute support: Permissions: verify user/resource Device: type, model, OS, end-of-life Jailbreak Authentication: configured touch/face ID & passcode Wi-Fi SSID and location	Minimal contextual, actionable information about location, network, and device

	Fyde	VPN

	Built-in defense for intermittent connectivity	Sustained disconnects force application layer timeouts

	Consistent session stability unaffected by change in source IP	Frustrating, painful experience for users, especially mobile workers such as utility field workers, insurance adjusters, law enforcement

	Local proxy on device side and access proxy on infrastructure side can maintain session during dropped connections	Time wasted on repetitive VPN reconnects and app reloads, costing organization valuable employee productivity

	Fyde	VPN

	Intercepts and blocks Internet-borne threats on the device with patent-pending technology	Requires integration with a costly point solution like Bluecoat, Websense, or Zscaler, to address threats in real-time

	Preserves corporate network bandwidth and speed	Lacks capability to provide protection from Internet-borne threats due to split-tunnel configuration

	Eliminates latency that can negatively impact user experience	Adds significant congestion to corporate network; degrades bandwidth utilization

	Protects employee privacy, increasing adoption	Creates significant latency for users and increases battery consumption

	Evaluates security state and posture of trusted devices in real-time. First-of-its-kind continuously updated content-filtering to identify new threats	Generates employee privacy concerns that may slow adoption

	Fyde	VPN

	Delivers a built-in policy remediation agent that operates directly on the edge	Requires additional point solution to offer any form of NAC functionality

	Works everywhere, on the corporate network or on the go

	Provides autonomy to users to solve their own access issues. Fyde offers a step-by-step guide to fix issues and regain access. For example: If access is denied to Gitlab due to FileVault being disabled, Fyde will share the steps to enable disk encryption

Fyde

Native support for trusted devices

Generates and stores device certificate on hardware keystore

Sends a CSR to Management Console to register device and establish trust

Validates every access request against current security and compliance policy

Deploys conditional and contextual trust

Certificate management is built-in for both device and infrastructure components

VPN

No native support for trusted devices

Relies only on user credentials for infrastructure access

Depends on 3rd-party tools like MDM to establish a native version of trusted devices

Requires enrollment to corporate MDM to determine trusted devices

Static trust architecture

Certificate management is difficult and requires 3rd-party tools

Fyde

Access resources not the entire network. Direct trusted users to the information they need, whether in a VPC, data center or on-premises without increasing risk

Connect to multiple infrastructure sites without switching access profiles

Confirm or deny access based on user role and device attributes: RBAC+ABAC. Example: User A in Group B with Device C that complies with policy D can access resource

VPN

VPN clients can act as patient zero on your network, increasing the potential attack surface exponentially. A compromised VPN client, residing on a VLAN with complete network access, can launch attacks on other clients on the same VLAN, ultimately exposing every routable VM/workload

Requires user to switch between VPN configurations to access multi-site environments

Implements network segmentation, a painful and error-prone approach that requires 3rd party or custom tools. Limits ability to access dynamic, modern resources like Kubernetes workloads

Fyde

Continuously monitors device and logs network metadata at the device level (network DVR)

Enforces policy that requires searching for a comprehensive IOC (indicators of compromise) list in network history before granting access

Conducts retrospective search for IOC

Detects if the device has ever exchanged information with a phishing site: e.g. mycompany.oktaa.com

Detects if the device has ever generated APT x C&C traffic

VPN

Lacks visibility into device security status before starting active VPN session

Cannot integrate with a local security agent as part of an access policy

Provides only single point in time access to device security state. Any change to the device security state is not reflected in the active session

Fyde

Role-based access control enhanced with attribute-based access control

Rich attribute support:

Permissions: verify user/resource
Device: type, model, OS, end-of-life
Jailbreak
Authentication: configured touch/face ID & passcode
Wi-Fi SSID and location

VPN

Role-based access control (RBAC) only. Access tokens can be permanent or long-lived, creating additional risk as VPNs do not natively support re-auths and step-up auths

Minimal contextual, actionable information about location, network, and device

Fyde

Built-in defense for intermittent connectivity

Consistent session stability unaffected by change in source IP

Local proxy on device side and access proxy on infrastructure side can maintain session during dropped connections

VPN

Sustained disconnects force application-layer timeouts

Frustrating, painful experience for users, especially mobile workers such as utility field workers, insurance adjusters, law enforcement

Time wasted on repetitive VPN reconnects and app reloads, costing organization valuable employee productivity

Fyde

Intercepts and blocks Internet-borne threats on the device with patent-pending technology

Preserves corporate network bandwidth and speed

Eliminates latency that can negatively impact user experience

Protects employee privacy, increasing adoption

Assesses security state and posture of trusted devices in real-time. First-of-its-kind continuously updated content-filtering to identify new threats

VPN

Requires integration with a costly point solution like Bluecoat, Websense, or Zscaler, to address threats in real-time

Lacks capability to provide protection from Internet-borne threats due to split-tunnel configuration

Adds significant congestion to corporate network; degrades bandwidth utilization

Creates significant latency for users and increases battery consumption

Generates employee privacy concerns that may slow adoption

Fyde

Delivers a built-in policy remediation agent that operates directly on the edge

Works everywhere, on the corporate network or on the go

Provides autonomy to users to solve their own access issues. Fyde offers a step-by-step guide to fix issues and regain access. For example: If access is denied to Gitlab due to Filevault being disabled, Fyde will share the steps to enable disk encryption

VPN

Requires additional point solution to offer any form of NAC functionality