Where your traffic is judged decides everything else.
Anywhere else, private access, web filtering and agent visibility are three vendors and three consoles that disagree about who a person is. Here is how the usual options compare.
Four ways to answer the same question.
Everything in the last column is included rather than sold as a module: one platform, one console, one price.
| Capability | Legacy VPN | Mesh tools | SASE suites | Fowlguard |
|---|---|---|---|---|
| Where traffic is judged | At the gateway | Nowhere | Vendor's data centre | On the device |
| Zero-trust access | No | Yes | Yes | Yes |
| Web filtering | Bolt-on | No | Yes | Built in |
| AI and agent visibility | No | No | Partial | Built in |
| Time to first rule | Days | Minutes | Weeks+ | Minutes |
| Access that expires on its own | No | No | Add-on | Built in |
| Rules added by approval, not by hand | No | No | Partial | Built in |
What each one is good at, and where it stops.
Puts the device on the network
Judges traffic: at the gateway.
A VPN puts a device on the network and trusts it from then on. Whatever that laptop can see, an attacker holding it can see too.
What it costs you: a compromised laptop reaches the whole estate, and web filtering is a separate bolt-on.
Connect devices, then stop
Judges traffic: nowhere.
Mesh tools connect devices well. They have no web filtering, no agent inventory, no block page and no audit trail.
What it costs you: the first compliance question costs you a second product, and a third to reconcile the two.
Send traffic to be judged
Judges traffic: in the vendor's data centre.
Every request goes to somebody else's data centre to be judged and back again.
What it costs you: latency on every packet, a dependency that fails when theirs does, and a third party watching where your staff go.
Decided on the device, before the connection opens.
There is no proxy in the middle, because there is no middle. The rules are already on the device, so if our service is unreachable, filtering carries on and so does the internet.