shieldpath

Everything between a user and a private resource

ShieldPath covers the access path end to end: where resources live, who may reach them, from which device, for how long, and what happened afterwards.

Set up in three steps

  1. 01

    Run a connector

    Start the connector container on a host inside each private network: an AWS VPC, an Azure VNet, a Google Cloud VPC or an office LAN. It registers itself with an outbound connection.

  2. 02

    Connect your identity provider

    Add Okta, Microsoft Entra ID, Google Workspace or JumpCloud as the sign-in source. Users and groups sync over SCIM, so you do not maintain a second user list.

  3. 03

    Write access policies

    Map groups to resources and ports, add device requirements, then send the client install link. Users sign in once and reach only what their policy allows.

Access control

A policy links an IdP group to resources and ports, with conditions. Conditions include a compliant device, MFA within the last 12 hours, or a time window for contractors.

  • Resources by hostname, IP, CIDR range or wildcard domain
  • Port and protocol restrictions per resource (TCP, UDP, ICMP)
  • Re-authentication intervals per policy
  • Owner, admin and read-only auditor console roles
Illustrative product interface

Just-in-time access

Sensitive resources do not need standing access. A user requests access from the client with a reason and a duration, a named approver accepts it in the console or by email, and access ends on its own when the window closes. Available on Business and Enterprise.

Illustrative product interface

Device security and visibility

Posture checks run on every connection, not only at sign-in. Denied attempts show the exact reason, so a user with an outdated OS knows what to fix before they open a ticket.

  • Disk encryption, OS version, screen lock and firewall state
  • EDR and MDM signals from CrowdStrike, SentinelOne, Microsoft Intune, Jamf and Kandji
  • Per-connection log: user, device, resource, port, decision
  • CSV export, plus SIEM streaming on Business
Illustrative product interface

Integrations and platforms

Identity providers
Okta, Microsoft Entra ID, Google Workspace, JumpCloud. SAML or OIDC sign-in, SCIM 2.0 provisioning.
Device signals
CrowdStrike Falcon, SentinelOne, Microsoft Intune, Jamf, Kandji.
Connector hosts
Docker, Linux (Debian, Ubuntu, RHEL), AWS, Azure, Google Cloud, on-premise servers.
Client apps
macOS, Windows, Linux, iOS, Android and ChromeOS. Silent install via MDM for managed fleets.
Tunnel
WireGuard-based, 443/udp with TCP fallback, split tunneling by default, private DNS for internal hostnames.
Log export
CSV download from the console; JSON event streaming to your SIEM or object storage on Business.

See it on your own network.

Start a 14-day trial with one connector and one policy. No card required.

Start a trial Compare plans