#20 in Identity & Access ManagementUpdated 2026-08

Defguard

by Defguard · Self-hosted WireGuard VPN with connection-level MFA and identity management

41 — BenchRank score out of 100

Homepage
Pricing page

Visit website See full Identity & Access Management ranking

Overview

Defguard is a self-hosted WireGuard VPN and identity platform written in Rust. It enforces multi-factor authentication at the VPN connection itself, using internal SSO (TOTP, email or mobile biometrics) or external providers such as Google, Microsoft EntraID, Okta and JumpCloud. A single control plane manages firewall ACLs, gateways and desktop and mobile clients.

Best for: Teams self-hosting a WireGuard VPN that needs connection-level MFA and SSO, LDAP or AD integration.
Pricing: No figures are published: the Open Source plan is free, Business is free up to 10 users and one location with pricing given only via a price calculator or licence request, and Enterprise is custom pricing through sales.
Runs on: iOSAndroidSelf-hosted

Strengths and trade-offs

Strengths

MFA enforced on each WireGuard connection, not just at login
Self-hosted, so keys and metadata stay on your own hardware
Open source, with public audits and daily CVE/SBOM reports
Firewall ACLs by SSO user and group across multiple gateways

Trade-offs

Business tier is free only up to 10 users and one VPN location
No prices published; Business needs a licence request, Enterprise a quote
External SSO, ACLs, LDAP/AD sync and SIEM streaming are paid tiers only
Device posture checks and attestation are listed as coming in 2.1 and 2.2

How this score is made up

Each dimension is scored out of 100 and combined into the headline score using fixed weights.

MCP support: 0 out of 100
API quality: 10 out of 100
Documentation: 80 out of 100
Agent friendliness: 83 out of 100
Pricing transparency: 20 out of 100
Changelog: 55 out of 100
Marketing site structure: 75 out of 100
Operational trust: 45 out of 100

Measured, but not part of the score

Useful to know, but not a mark for or against the product — so these do not affect the ranking.

Openness: 55 out of 100
Maintenance: 65 out of 100

This doesn’t look right — report a problem with Defguard’s score

Alternatives in Identity & Access Management

Ranked 1
75.9 — BenchRank score out of 100
Ory
Ory · API-first identity and access management, self-hosted or managed
Best for: Engineering teams wanting API-first identity and access management they can self-host or buy as SaaS
Ranked 2
73.8 — BenchRank score out of 100
Logto
Logto · Open-source auth infrastructure with SSO, RBAC and multi-tenancy
Best for: Developers adding auth, enterprise SSO and multi-tenancy to SaaS or AI apps without building it
Ranked 3
73.1 — BenchRank score out of 100
Hexclave
Hexclave · Open-source auth, payments, email and analytics building blocks
Best for: Startups wanting auth, payments, emails and analytics as one open-source, self-hostable platform.