Teleport in 2026: Zero Trust Done Right — If You Can Afford It

It's 2:47 AM. Your on-call engineer is staring at a production PostgreSQL alert, VPN connected, but she has no idea which of the 40 servers in the private subnet actually hosts the primary database. The shared root credential was rotated last week. Her SSH key was revoked when she moved teams three months ago — or so you hope.

This is the exact nightmare Teleport was built to eliminate. Instead of long-lived SSH keys, permissive VPNs, and password spreadsheets, Teleport issues short-lived certificates for every access request. Each one is tied to your identity provider, scoped down to a specific resource, and recorded from the first keystroke to the last frame of the session screen capture.

I've spent the last two months testing Teleport across four real-world environments: a 12-node bare-metal cluster, three Kubernetes clusters with mixed namespaces, a fleet of AWS RDS instances, and a handful of internal web apps. This review covers what's changed in the platform through Q3 2026, where the pricing hurts, and — critically — whether your organization actually needs it.

What Teleport Actually Does

Teleport is not a VPN. That's the first mental model to discard. It's an access plane — a control layer that sits between your users and every type of infrastructure resource: SSH servers, Kubernetes clusters, databases, web applications, and even CI/CD workloads.

The core architecture is simple: a Teleport Auth Service validates identity, a Proxy routes connections, and lightweight Agents run on your infrastructure. When a user authenticates via SSO (Okta, Azure AD, Google Workspace, GitHub, etc.), they receive a short-lived certificate — typically valid for 1 to 12 hours, depending on your policy. That certificate carries embedded role labels that determine precisely what the user can reach.

Let me walk through the flagship features as if I were giving you the demo I wish I'd had.

SSH Access Without Key Management

The headline feature. You install the Teleport agent on your Linux servers, and SSH keys become an artifact of the past. Users authenticate once, get their ephemeral cert, and connect via tsh ssh user@server or through the Teleport Connect desktop app.

What impressed me in practice: tsh handles everything — cert renewal, session tracking, and even SCP/SFTP transfers. If a contractor's access needs to die at 5 PM on Friday, their cert simply expires. No key rotation. No "did anyone revoke Dave's key?" panic.

The session recording captures both input and output as video, with searchable transcript text. For compliance audits, this is a godsend. You can scrub through an incident session frame-by-frame to see exactly what command caused the disk to fill up.

Kubernetes Access That Doesn't Suck

This is where Teleport wins over most competitors. Your engineers get cluster access through their existing identity — no more shared kubeconfig files floating around in Slack channels.

tsh kube login gives you a temporary kubeconfig scoped to your role. If your role says you can only touch the staging namespace in cluster-prod, that's all you see. kubectl get pods won't even list other namespaces.

The 2026 version adds per-pod session recording for kubectl exec — a feature that was sorely missing in earlier releases. Actually, let me be honest: this was painful to set up on existing clusters. The agent installation requires reasonable cluster-admin permissions initially, and mapping SSO groups to Kubernetes RBAC roles took my test team a full afternoon. But once configured, it just works. No more cert rotation scripts, no 400-line kubeconfigs.

Database Access with Short-Lived Credentials

Teleport's Database Access serves as a proxy between your users and everything from PostgreSQL and MySQL to MongoDB and Redis. The database itself never sees a static password — Teleport generates credentials on the fly.

For AWS RDS and Aurora, the agent can hook into IAM authentication, which means your database starts rejecting password-based logins entirely. If your security team wants "no human ever holds a database password," this is the shortest path to that outcome.

One important caveat: for self-hosted databases, you still need to run the Teleport agent either on the database host or as a sidecar nearby. There's no magic wire protocol interception that works from across the network. Plan your agent deployment before you commit.

Web and Application Access

The less-glamorous sibling. You can publish internal web apps — Grafana dashboards, Jenkins, internal tools — behind Teleport's proxy. Users authenticate via SSO, get a short-lived browser session, and never learn the app's real IP address.

I tested this with a self-hosted Grafana instance. Setup took about 20 minutes. The experience was fine, but honestly, this is the most replaceable feature. If your org is already on Cloudflare Access or a good identity-aware proxy, there's little here you're missing.

Trusted Clusters and Machine ID

Two features that matter more than most buyers realize:

Trusted Clusters let you link two separate Teleport clusters. This is huge for MSPs or parent companies with subsidiaries. One team can grant another team access to specific resources without duplicating identity infrastructure. Access reviews cross the link automatically.

Machine ID extends the same short-lived certificate model to non-human workloads. CI/CD pipelines, cron jobs, and Terraform runs can fetch credentials on demand instead of holding long-lived API keys. This is becoming increasingly important as security scanners like "no hardcoded secrets" become standard CI gate checks.

Pricing Breakdown

Here's where Teleport gets spicy. The pricing story shifted notably through 2025 and into 2026.

Teleport now has three tiers plus a free edition. As of Q3 2026, the published pricing structure looks like this:

A few pricing realities that aren't obvious from the website:

The Community Edition bait-and-switch. It's genuinely free, but the 20-user cap and the SSO exclusion make it a demo tool more than a production platform for most orgs. If you have 25 employees and want SSO, you're paying for 25 Pro licenses. There's no "just the admin" workaround.

Cloud vs. self-hosted. Teleport Cloud (their managed SaaS) comes at a premium of roughly 20-25% over self-hosted Enterprise pricing. For a 20-person team, that's the difference between approximately $6,000 and $7,500 per year. The convenience is real — no agent upgrades, no HA cluster maintenance — but it's worth negotiating if your compliance scope allows self-hosting.

Session storage overages. This caught me off guard. Pro and Enterprise include audit log retention (14 days on Pro, longer on Enterprise), but session recordings are charged by storage consumed. If your team records every SSH session at high fidelity, a heavy month can push you 2-3x over your baseline. There's no published rate card for overage; it's handled per-contract. Ask your sales rep for the per-GB rate before you sign, not after.

Feature gating on Pro. RDP access to Windows machines requires the $24/user/month service add-on. So does access to certain third-party integrations. Budget for this if you have any Windows infrastructure in scope.

What Works Well

The audit trail is genuinely readable. Most access tools generate logs that require a security analyst to interpret. Teleport's audit output connects identity to action to session recording in a way that non-technical auditors understand. During a mock SOC 2 review, our external consultant said it was the cleanest access evidence she'd seen from a self-managed tool.

Certificate revocation is instant and surgical. Revoke one user's access and they're dead in the water within seconds — even mid-session. You don't need to push anything to agents or wait for a cache TTL. This sounds basic, but after years of managing OpenVPN kill-switch scripts, I deeply appreciate it.

Session recording quality is excellent. The transcript can be searched, which turned incident response from "watch a 4-hour video" into "grep for rm -rf and jump to that timestamp." The screen capture is smooth even on resource-constrained servers — overhead measured around 2-3% CPU on our test nodes.

tsh is a pleasure in daily use. I'll admit to being skeptical of a new CLI tool. But the ergonomics are right: tsh ls lists available resources, tsh ssh connects, tsh kube login gets you into a cluster. Tab-completion works, and the tool correctly handles the common case of needing to hop between dev and prod contexts dozens of times a day.

The Trusted Cluster model stands out. For MSPs or multi-tenant setups, this is the feature that punches above competitors. You can grant a client's team access to isolated resources in your infrastructure without giving them any visibility into your internal access topology.

What Needs Improvement

Onboarding is deceptively complex. The first hour feels like you're configuring any modern dev tool. Then you hit the teleport.yaml service config, and the YAML rabbit hole opens. Roles, traits, presets, RBAC matrices — the terminology overlaps with concepts you know from other tools but maps just slightly differently. Plan for a two-day enablement period for the admin who owns the setup. The vendor's documentation has improved, but it errs toward reference material over progressive tutorials.

Community Edition feels punitive. I understand why SSO is gated to paid tiers — that's where the vendor makes money. But the 20-user cap is awkward. Teams between 15 and 30 users are forced to decide between a franken-setup of two Teleport clusters or paying for licenses they don't need. A 25-user Pro contract is $3,600/year; it's worth it, but the pricing cliff is frustrating.

Database access agent placement requirement. For self-hosted databases, the agent must live on or near the database host. If your PostgreSQL servers are air-gapped or in a tightly locked VPC, the agent becomes a compliance discussion in itself. The AWS RDS integration helps, but the operator still manages a deployment footprint they didn't have before.

UI/administration split feels dated. The web UI handles day-to-day work: viewing sessions, approving access requests, checking activity. But serious administration — role definitions, cluster configuration, agent management — is CLI-only. For a product selling "modern zero trust," there's something ironic about teleport configure being the only friendly path to a basic role setup. It's exactly the kind of modal bias that was acceptable in 2022 but feels behind the curve in 2026.

Session storage cost at scale. I mentioned the overage risk, but let me emphasize it. At 50 users with active recording, you can easily generate 50-80 GB of session footage per month. On Enterprise, that storage is billed at a significant premium over raw object-storage rates. This is a cost that scales faster than your user count — worth a real capacity plan before rollout.

Who Should (and Shouldn't) Use This

Great fit:

• DevOps/platform teams of 10+ engineers managing Kubernetes clusters and databases. The day-to-day efficiency gains alone justify the price, even before the security posture improvement.
• Compliance-bound organizations (SOC 2, ISO 27001, FedRAMP) that need credible evidence of least-privilege access. Teleport's audit trail is among the strongest in the category.
• MSPs and multi-tenant SaaS vendors — Trusted Clusters solve the cross-org access problem cleanly.
• Teams dealing with contractor churn — short-lived certs and instant revocation make offboarding trivial.

Poor fit:

• Small teams (under 10 people) managing a handful of static servers. You're paying for a Swiss Army knife when a simple SSH bastion plus good IAM hygiene would do. Look at plain sshd with certificate auth or even Tailscale if you only need basic network-level control.
• Cloud-only teams locked into a single cloud provider. If everything lives in AWS and your team already uses IAM roles, AWS Systems Manager Session Manager plus IAM policies might cover 80% of your needs with zero new infrastructure. Teleport becomes more attractive when you're multicloud or hybrid.
• Organizations without any security/compliance pressure. If nobody is asking about audit logs and you never onboard or offboard external users, the operational overhead will outweigh the benefits.

3-Year Total Cost of Ownership: A Realistic Model

Let's compute what Teleport actually costs a 25-person engineering team over three years. I built this model using Pro pricing with Teleport Cloud, plus realistic induction costs.

Key observations:

• Licensing is only ~43% of your first-year cost. The implementation and migration overhead is real, and teams underestimate it.
• Enterprise pricing would roughly double the license line items (using the midpoint of $30/user/month), pushing the 3-year total to around $37,000-40,000 — assuming the compliance features actually matter to your auditors.
• If you self-host instead of using Teleport Cloud, subtract roughly 20-25% from the subscription line but add 1-2 hours per week of maintenance overhead. At $150/hour loaded cost, that's $7,800-15,600/year — which most teams spend to get the managed option anyway.

Verdict & Editorial Takeaway

Teleport is the most comprehensive zero-trust access platform I've tested, and the gap between it and the alternatives (Bastion, Boundary, Tailscale, plain SSM) widened further with the 2026 releases. The Kubernetes access alone is worth the price for any team running production clusters with multiple namespaces and roles. The audit trail, session recording, and instant revocation capabilities genuinely change how you approach access governance.

But it is not a casual purchase. The learning curve, the Community Edition limitations, and the storage cost surprises mean your first year will cost nearly double what the sticker price suggests. Buy it when you're already committed to evolving security posture — not as a first step, and not as a way to avoid cleaning up your existing SSH key mess.

My rating: 4.2 out of 5. Loses points for the pricing complexity and the admin-tier learning curve, but the core product earns every bit of its reputation.

---

FAQ

Is Teleport open source?

Partially. The core (formerly Teleport OSS) is open source under the Apache 2.0 license, and the Community Edition is free for up to 20 users. But the advanced features — SSO, access requests, compliance reporting, Trusted Clusters at scale — live in the closed-source Pro and Enterprise tiers. If "open source" matters to your procurement process, know exactly which features you can use in the OSS build before buying.

Does Teleport replace a VPN entirely?

For infrastructure access, yes. If your goal is SSH, Kubernetes, databases, and internal web apps, Teleport replaces a traditional VPN and a bastion host. What it does not replace: general internet routing, site-to-site networking, or access to non-HTTP internal services that don't integrate with the proxy. Some teams keep a VPN narrow for those edge cases.

What's the real difference between Teleport Cloud and self-hosted?

Teleport Cloud is their managed SaaS — you install agents, they manage the Auth Service, Proxy, and cluster availability. Self-hosted gives you full control and is cheaper but introduces upgrade duties and high-availability design work. For teams under ~50 people I'd strongly suggest Cloud; the operational burden of self-hosting is rarely worth the 20% savings. For regulated industries, the data-residency requirements may tip you toward self-hosted anyway.

Can it handle database access without running an agent on the database?

For AWS RDS/Aurora, yes — Teleport can use discovery-based deployment with IAM authentication, so the agent runs in a separate managed location rather than directly on the DB host. For self-hosted databases, no. You need the agent on the host or as a nearby sidecar. This is a common point of confusion, so check it early in your pilot if your databases are internal.

What if we're already paying for Okta or Azure AD?

Good — that's exactly the right starting point. Teleport integrates with both through SAML 2.0. Your user directory, MFA policies, and group memberships carry into Teleport's role assignments. A typical pattern: map the Okta group k8s-prod-admins to a Teleport role with the same name, and enforce MFA at the Okta level with an access request flow for prod changes. The SSO integration is mature and reliable, far better than what you'd get rolling SCIM yourself.

---

Pricing and feature details reflect publicly available information for Q3 2026. Testing was performed on Teleport v16.x (self-hosted Community and Enterprise trial, plus Cloud Pro). Your mileage may vary based on your specific infrastructure complexity.