Security Infrastructure Engineer

Tailscale Aperture targets shadow AI with new controls for IT teams. Bradley C Jun 16 2026 - 6:15 am PT Today, Tailscale has announced new capabilities for Aperture, its AI access and control platform, designed to provide IT teams with a common and stable layer for managing AI across evolving models, tools, and data sources. The shadow AI problem. AI tools are already being used inside most companies, whether the IT department officially supports them or not. The problem is that this usage is often invisible, siloed, and extremely difficult to secure. Employees often use free personal accounts, different teams adopt different tools with credit card payments, and agents are beginning to act within systems originally built and designed for people. According to recent research mentioned by Tailscale, over 64% of activity on personal and free AI accounts is for work. This creates a blind spot for IT teams who cannot see, govern, or recover that data. Other research found that companies typically have nearly 70 generative AI tools running across their systems, with 90% lacking proper licensing and/or approval. Discover more 9to5Mac Daily Podcast AI providers are heavily incentivized to bundle models, chat interfaces, and execution environments into closed stacks. While those bundles can make the initial rollout for organizations easier, they introduce vendor lock-in, tying you to a single vendor. How Aperture aims to fix this. Aperture aims to give organizations an easier way to manage AI without locking them into a single vendor. It makes approved AI tools easier to use and provides agents with controlled environments in which to work. Just as importantly, it keeps the AI stack modular. * Chat interface: This gives employees a browser-based way to use approved AI models. The interface supports switching between configured LLM providers as well * Universal data connectors: These help AI tools reach internal tools, documents, and operational data without forcing every single team to build its own integration. * Identity preserved across systems: Because Aperture integrates cleanly with Tailscale, user identity is preserved, and permissions are carried through the entire agent lifecycle. * Sandbox support: Available in private alpha, this provides AI agents with controlled environments in which they can operate without directly acting on a user's local laptop or an unmanaged system. Aperture is designed to work with API keys from major LLM providers, including OpenAI, Anthropic, Google Gemini, and Amazon Bedrock. The interface and universal data connectors are available today in public alpha for organizations currently using Aperture. 9to5Mac's take. The AI stack is not going to settle down any time soon. News by the week changes your approach. The best model, interface, and data connection will keep changing rapidly. Companies should not have to rebuild their AI setup every time one of those pieces changes, or they want to mix in a new vendor. Aperture aims to provide IT departments with a stable layer for identity, access, and control, so they can keep changing tools without losing track of who is doing what in the corporate environment. Moving AI agents into a secure sandbox instead of letting them run wild on a corporate Mac is exactly the kind of control IT needs right now. FTC: We use income earning auto affiliate links. More.

Fixing Headlamp OIDC login with Tailscale and tsidp. Headlamp is a Kubernetes dashboard I use to get a quick view of what is happening in my clusters. It is lightweight, extensible, and supports OIDC. And configuring it to play nicely with OIDC and RBAC is a real, shall gopher-daily say, education in Kubernetes. I ran Headlamp as a cluster app and plugged it into Tailscale's tsidp, a tailnet-aware OIDC server. It promised a very clean setup: Tailscale would be the path to the app, the DNS, the HTTPS layer, and the identity provider. Everything looked good until I actually tried to log in. Alas, dear reader, as is often the case in Kubernetes-land, it was time for a small side quest. Headlamp was up. Tailscale ingress was up. I could access Headlamp via https://headlamp-clustername.funny-name.ts.net. Everything was automatically configured using Tailscale's Kubernetes Operator. I could even load the login page. But when I authenticated, I kept getting bounced straight back out again during the login flow. What follows is a tale of woe learning and discovery about how some of the pieces of the Kubernetes jigsaw fit together. Because of the OIDC configuration I had supplied, Headlamp knew how to trust my Tailscale identity, but the Kubernetes API server did not. Headlamp and Kubernetes were disagreeing about who I was. And once I understood that, the rest of the fix was fairly straightforward. The problem in this chain is that "logging in" to Kubernetes is not a single step. There are several components that must all agree with each other to let you in. If one of these components can't match up your identity somehow, the whole login flow falls apart. That's what was happening here. In my case, Headlamp was configured to use Tailscale as its OIDC provider, and that part was working. But when I tried to log in, Headlamp failed opaquely, without a useful error. Headlamp sent me to my tsidp identity server, and returned a token successfully. So far, so good. But Headlamp is only the front end. It is not the thing that decides whether I am allowed to interact with cluster APIs to read Pods, inspect Deployments, and so on. In this case, that job is entrusted to the Kubernetes API server. Side note: I did look at using the Tailscale Kubernetes API proxy specifically for Headlamp, but it was ultimately more awkward than it was helpful. gopher-daily is still using the API proxy for cluster access elsewhere; for Headlamp, that approach requires pulling in a separate kubeconfig, internal DNS, and egress proxying. In the end, I opted to stick with the tsidp-based OIDC route: * Headlamp remains a normal cluster app * tsidp handles logins * Kubernetes API server is configured to trust the same issuer This ultimately meant the cluster's role-based access control (RBAC) could work the normal Kubernetes way. Once the API server trusted the same OIDC issuer as Headlamp, my Tailscale identity flowed cleanly through to Kubernetes permissions, and Headlamp worked again. Understanding why that fixed the problem, however, was perhaps harder than applying the fix itself. There are really five trust relationships at work here. First, the browser trusts the Tailscale-served HTTPS endpoint for Headlamp. gopher-daily has all seen the "this website is dangerous" HTTPS warnings on self-signed or expired certs, right? Tailscale serve does away with them. Second, Headlamp trusts tsidp as its OIDC provider. That is what allows it to redirect the user for login, and later accept the returned token as meaningful. Third, tsidp trusts Headlamp as an OIDC client. That means the configured client ID, secret, and callback URL must all be valid from the identity provider's point of view. Fourth, the Kubernetes API server trusts tsidp as the issuer of the token. This is the critical part that was missing in my setup. Until that was configured, Kubernetes had no reason to accept the token Headlamp was presenting. Fifth, Kubernetes RBAC trusts the token claims enough to map them into a subject. In my case, that meant using email as the username and tags as groups, then applying the appropriate bindings. As noted, the kube-apiserver is the critical missing link in its chain of trust. Therefore gopher-daily need to provide it the information it needs to trust its tsidp OIDC issuer. apiServer: extraArgs: oidc-issuer-url: https://idp.funny-name.ts.net oidc-client-id: abc123abc123abc123abc123 oidc-username-claim: email oidc-groups-claim: tags | Setting | What it does | | oidc-issuer-url | Which OIDC issuer to trust | | oidc-client-id | Which audience the token must be for | | oidc-username-claim | Treats the email claim as the Kubernetes username | | oidc-groups-claim | Treats the tags claim as Kubernetes groups | And with this token configured, Headlamp could now successfully hand the API server a token issued by tsidp, but that was not enough on its own. The API server needed to know which issuer to trust, which client ID the token was meant for, and which claims inside that token represented the username and groups. Until that was configured, the token was just an opaque blob of JSON and cryptography that Kubernetes had no reason to accept. Once I taught the API server to trust tsidp and map the email and tags claims correctly, the token stopped being an untrusted bearer token and started becoming a real Kubernetes identity. I was now able to login using nothing but my Tailscale identity. In other words, no kubeconfigs, no usernames, no passwords. My Tailscale identity flows all the way through to Kubernetes RBAC. If you don't think that's cool, then, well, what are you doing reading this post? OK, gopher-daily can log in but gopher-daily is not done yet. Now Kubernetes knows who I am, but it still doesn't know what I'm allowed to do. Authentication tells Kubernetes who I am, RBAC tells Kubernetes what I am allowed to do. Because I had configured oidc-username-claim to use email, Kubernetes saw my Tailscale identity as [email protected]. From there, the fix required creating a ClusterRoleBinding for that user and mapping it to a role. In my case, I used cluster-admin. Given this is only a homelab scenario, I was happy enough with that trade-off. In a shared cluster, I would almost certainly be more restrictive. apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: oidc-cluster-admin roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: [email protected] This was the final piece of the puzzle. Headlamp could now log me in, the Kubernetes API server could verify who I was, and RBAC could map that identity to permissions that actually let me use the dashboard. What I like about this setup is that the same identity flows all the way through it. * I use Tailscale to reach Headlamp * I use Tailscale to sign into Headlamp * Headlamp presents that Tailscale-issued token to Kubernetes * Kubernetes trusts that token * RBAC turns that identity into permissions Tailscale is not just acting as a VPN here. It is the network path, the DNS, the HTTPS implementation, and the identity provider. Once the Kubernetes API server was configured to trust the same issuer as Headlamp, the whole thing clicked into place. That is what made this feel so clean in the end. I was not juggling kubeconfigs, service accounts, static tokens, or another auth stack. I was just using my Tailscale identity all the way through to Kubernetes RBAC. With my side quest complete, and many dangerous foes vanquished along the way, it was finally time to get back to the main quest and see what fresh nonsense Kubernetes had waiting for me. Alex Kretzschmar

2026 Twingate competitors and alternatives. Anastasiya Novikava In 2026, Twingate alternatives include NordLayer, Check Point Harmony SASE, Tailscale, Zscaler Zero Trust Exchange, and Palo Alto Prisma Access. All these products offer secure access to private apps, cloud resources, and internal networks. But they differ in how many network security features they include beyond remote access, as well as in deployment model and access control depth. For an organization, the best fit usually depends on whether it needs a simple solution for a small team or broad granular policy controls for a large environment. Disclaimer: This article is based on publicly available user feedback gathered on April 13, 2026, from platforms including Gartner Peer Insights(TM), G2, and vendor websites. Its methodology prioritized the most recent user reviews available on these platforms. For Gartner, NordLayer reviewed the 5 newest reviews if available. For G2, NordLayer analyzed the 10 newest reviews for each product as of April 13, 2026. Both positive and negative reviews were included to reflect a balanced view, though the number of relevant reviews varied by vendor. As competitor offerings and user sentiment may evolve, NordLayer does not guarantee the accuracy or completeness of this information and recommends verifying details directly with each provider. Twingate overview. Twingate presents itself as a zero-trust network access platform. Its mission is to replace broad VPN-style connectivity with application-level access control, identity checks, and device-aware policies, while keeping resources invisible by default. In short, the platform is built for remote access to an organization's internal tools, applications, and servers. Most mentioned Twingate product strengths. * Granular access-control lists (ACLs) and detailed permissions for zero trust. * Broad auditing features that simplify troubleshooting and provide visibility. * Identity provider integration with multi-factor authentication (MFA) and group management. * Terraform support. * Alias feature to manage overlapping IP schemes across multiple networks. Most mentioned overall Twingate benefits. * Reliable, with rare outages and fast connections. * Easy setup for admins and users. * Easy onboarding (positive app feedback across all OSes). * User-friendly interface. * Strong split- and full-tunnel options. * Supports SOC 2 and HIPAA compliance efforts. Drawbacks of Twingate. * Insufficient logs: no advanced search or filtering for incident investigation. * Problematic mobile device management (MDM) deployment. Difficult setup on NinjaRMM, Intune, and Jamf. * DNS features feel underdeveloped to some users. * Update disruptions. Client updates sometimes require reinstalls. * Meaningful support requires higher-tier plans. * Limited support for the Asia-Pacific region (users must triage issues outside business hours). Disclaimer: This review is based on third-party user reviews from Gartner Peer Insights(TM) and G2, accessed on April 13, 2026. NordLayer is not responsible for the accuracy or completeness of competitor information, which may change over time. Now, let's look at Twingate alternatives. 1. NordLayer. NordLayer overview. NordLayer is a network security platform that provides secure remote access, Zero Trust Network Access (ZTNA), and access control capabilities, along with threat prevention and device posture controls. It is part of the Nord Security ecosystem, which can be extended with threat intelligence and password management solutions. NordLayer offers a practical way to deploy remote access policies without on-premise hardware. It provides teams with secure access to servers, internal tools, and SaaS apps. Most mentioned NordLayer product strengths. Some of the strengths users mention most are: * Zero Trust Network Access (ZTNA) with MFA, Device Posture Monitoring, and Dedicated IP. * Centralized management. * Full security stack, which includes a Cloud Firewall, Secure Web Gateway for safe internet access, Threat Protection, and network segmentation features. * Wide server range with plenty of country options and easy Dedicated IP setup. Most mentioned overall NordLayer benefits. Users often highlight these benefits: * Ease of use, with an intuitive interface and simplified onboarding for both technical and non-technical employees. * Quick, low-effort deployment that requires no hardware and almost no ongoing maintenance. * 24/7 customer service and extensive setup documentation. * Stable performance with fast connections, even when many users are connected. * Compliance and integration support, with features that help meet standards like ISO 27001 and SOC 2 Type II, plus smooth identity provider integration (e.g., Okta, Google). What makes NordLayer stand out? According to NordLayer's website, the platform offers robust Zero Trust Network Access (ZTNA) features as well as traditional VPN functionality. These technologies complement each other. Key solutions: * NordLynx - a high-speed VPN protocol available for all plans. * Threat Protection blocks malicious sites, stopping known threats before they reach users. * Device Posture Security prevents users from accessing the network through non-compliant devices. * Download Protection detects and removes malware, ransomware, and other threats. Drawbacks of NordLayer. Users noted these limitations: * Limited advanced configuration for custom networking rules and split tunneling. * Team admins sometimes lack settings and cannot reset MFA. * Costs feel high for small teams. * Slow or dropped connections on unstable networks or Linux. NordLayer reviews. NordLayer receives strong positive feedback as a ZTNA provider. Users appreciate its network security features combined with usability. NordLayer is rated: * 4.6 out of 5 on Gartner Peer Insights(TM) * 4.3 out of 5 on G2 NordLayer pricing. NordLayer's plans start at 5 users and, according to its pricing page, include: * Up to 1 Gbps server performance, * 40+ shared gateway locations, * Session Duration Control, MFA, Always On VPN, and SSO across tiers. * Web Protection (phishing prevention, malicious site blocking) * Download Protection to catch malware * VPN protocol variety, with NordLynx included on all plans Higher plans add broader remote access solutions and control options, such as: * Virtual Private Gateways and Dedicated IPs * IP Allowlisting * Cloud Firewall * Device Posture Monitoring (visibility into which devices connect to the company network and whether they meet compliance standards) * Device Posture Security (automatic access denial for users with non-compliant devices) * Site-to-Site and Cloud LAN * Custom DNS for network-wide access rules Exact feature availability depends on the tier. Disclaimer: This information is based on NordLayer's website and third-party user reviews from Gartner Peer Insights(TM) and G2, accessed on April 13, 2026. NordLayer aims to provide accurate and up-to-date information but is not responsible for any inaccuracies from third-party sources. Take your network security to the next level - protect your organization with NordLayer now! 2. Check Point Harmony SASE. Overview of Check Point Harmony SASE. Check Point positions Harmony SASE as a cloud-based SASE platform that provides secure access for remote users and branch offices through zero trust, SaaS security, SD-WAN, and a global private backbone, all managed from a central console. The product is aimed at organizations that want one platform for remote access, policy enforcement, and broader security operations. Most mentioned Harmony SASE product strengths. * ZTNA-driven secure access with identity-based controls and SWG features. * Centralized management. * CASB-style SaaS security that detects shadow IT and misconfigurations. * Device posture checks. * Global Private Backbone that makes remote connections feel local. * Strong traffic visibility for monitoring and enforcing network security policies. Most mentioned overall Harmony SASE benefits. * Intuitive interface with a simple dashboard. * Strong security with minimal complexity. * Once configured, consistent performance with noticeable latency reduction. * High scalability with granular security for remote and branch users. * Full-mesh global connectivity across branches and cloud environments. Drawbacks of Harmony SASE. * High pricing for medium-sized businesses. * Complex initial setup. * Parts of the interface lack intuitiveness, and troubleshooting often requires support. * Some SASE capabilities feel less mature than competitors. * Limited reporting customization: dashboards lack detail. * Connectivity lags at peak times. * Rigid policy and logging customization; false positives can block legitimate traffic. * Slow support response times. * Drilling into user logs requires too many steps. Disclaimer: This review is based on third-party user reviews from Gartner Peer Insights(TM) and G2, accessed on April 13, 2026. NordLayer is not responsible for the accuracy or completeness of competitor information, which may change over time.