Tailscale vs werf

Tailscale ships at a steady maintenance cadence while two new product lines take shape alongside the core VPN: Tailscale PAM (beta), a privileged access management product covering SSH, database, RDP, Kubernetes, and S3 with session recording and credential injection; and Aperture (GA), an AI/MCP gateway with cost controls and request hooks. The core network product continues incremental hardening—connectivity fixes, Kubernetes Operator improvements, and platform-specific stability patches.

Tailscale is repositioning from a networking utility into a broader security platform. PAM puts them in the enterprise privileged access market; Aperture puts them in AI infrastructure. Both products use Tailscale's existing network connectivity layer as the distribution vehicle—if your services are already on a tailnet, adding PAM or Aperture becomes a much shorter sales motion than standalone competitors. The question is whether they can build enough depth in each to compete with Teleport and purpose-built AI gateways, or whether these remain thin surface extensions of the core product.

PAM graduating from beta is the most likely near-term move; session recording, browser client, and credential injection suggest it's already fairly complete. Aperture will likely gain more model integrations and expanded MCP tooling as the AI agent ecosystem matures.