Pangolin

What is Pangolin?

Pangolin is a zero trust access platform that provides identity-aware access to applications and infrastructure. It is positioned as “better than your existing VPN,” using identity and device security checks to allow access to specific resources.

The platform installs on user devices to create direct WireGuard® tunnels to remote environments across on-prem, cloud, and edge. Access decisions are designed to be enforced using identity and context-aware rules.

Key Features

• Identity-aware access to applications and infrastructure: Users access only what they’re allowed to reach, based on their identity rather than network location alone.
• Device and user security checks at each step: Pangolin evaluates identity and device security during access to help mitigate risk while maintaining a smooth user experience.
• Direct WireGuard® tunnels from user devices: Pangolin “installs on user devices” and establishes direct encrypted tunnels to remote environments.
• Works behind any firewall via an installed connector: Users can connect through a connector deployment that can sit behind existing network boundaries.
• Central management of app-level access rules: The platform supports enforcing identity and context-aware rules for specific applications.

How to Use Pangolin

1. Deploy Pangolin components so that a connector is available behind your firewall and user devices can run Pangolin.
2. Connect users with their existing identity so access decisions can be identity-aware.
3. Define access rules for specific applications using identity and context-aware policy.
4. Allow users to access remote environments through WireGuard® tunnels, with identity and device security checks performed along the way.

Use Cases

• Grant controlled access to self-hosted applications: Allow users to reach specific internal applications with identity- and context-aware rules rather than broad network access.
• Secure remote access across on-prem, cloud, and edge: Use the same WireGuard® tunnel approach to reach resources located in different environments.
• Replace or supplement VPN-style workflows: Provide a path to “better VPN” style access by focusing on application-level permissions and centrally managed access policies.
• Reduce operational overhead when managing node-by-node ACLs: Address environments where managing ACLs on every node is operationally difficult by managing app-level access centrally.
• IT and security rollouts that require faster deployment: Use a deployment model designed to be “easy to deploy” without relying on long professional services engagements (as described in the provided testimonial excerpt).

FAQ

• Is Pangolin a VPN? Pangolin is described as “a better VPN” and uses WireGuard® tunnels from user devices to remote environments, but it is also explicitly positioned as a zero trust access platform focused on identity-aware, application-level access.

• What does “connector behind any firewall” mean? The site states that Pangolin uses an “easy to deploy connector behind any firewall,” indicating you can place the connector within your existing network perimeter so users can connect through it.

• Where can users access from (device types)? The platform lists support for macOS, iOS, Windows, Linux, and Android, implying users can run Pangolin on those device platforms.

• How does Pangolin decide whether a user can access an application? It checks user identity and device security at every step and enforces identity and context aware rules for access to specific applications.

• Is Pangolin self-hosted or cloud-based? The site mentions cloud and self-hosted options, but no further deployment details are provided in the excerpt.

Alternatives

• Tailscale (mesh VPN for identity-aware access): An adjacent approach to secure connectivity using WireGuard-based techniques, typically focused on device-to-device access and identity integration.
• Zscaler (secure access / ZTNA-style platforms): A different category of zero trust access/security gateway that often centers on web/app access policies at the network edge rather than on an on-device tunnel model.
• Other VPNs with identity integrations: Traditional VPN products combined with identity providers can provide secure remote access, but may be more focused on network access than application-level, identity- and context-aware policies.
• General-purpose zero trust access gateways: Alternatives in the zero trust access space generally aim to control resource access using identity and policy, with differences in where enforcement occurs (client vs. gateway) and how access policies are managed.