XoT compared with a VPN
Access to a network or to a machine
A VPN is an encrypted connection into a network. Both a VPN and XoT encrypt the traffic. The difference is what the user can reach once the connection is open.
The differences point by point
| Property | VPN | XoT Remote Access |
|---|---|---|
| What the user can reach | The network, or the part of it the user has been given access to | The equipment that the authorisation covers |
| Opening in the firewall | Usually needed | Not needed, because traffic goes through XoT Bridge |
| The user can see the network from the inside | Yes | No |
| Restriction to one machine | Through rules that must be maintained | Part of the authorisation |
| Time limit | Through account management | Part of the authorisation |
| Identity check | Usually only when the connection opens | Twice a minute |
| Ending access | Someone must disable the account | The authorisation ends automatically |
| Log per machine | Depends on how logging is set up | Included |
| Login | Password or certificate | Certificate, with no passwords |
Where the difference shows
Three situations
A vendor is attacked
With a VPN, the attacker has a connection into your network. What the attacker can reach depends on how good your firewall rules are.
With XoT, the attacker only reaches the equipment that the vendor had an authorisation for. The attacker cannot reach the rest of the network through XoT.
A service contract ends
With a VPN, someone has to remember to disable the vendor's account. Security reviews often find accounts that nobody has disabled.
With XoT, the authorisation has an end date from the start. It ends without anyone having to do anything.
An auditor asks who has been connected
With a VPN, the answer is in the logs if logging was on and the accounts were personal. You also often have to compare the VPN log with logs from the machines.
With XoT, every connection is linked to a person and a machine from the start. The answer is in a single line of the log.
Fair to the VPN
When a VPN is the better choice
A VPN is designed to give access to a network. If that is what you need, a VPN is the right tool. An employee who works from home and needs to reach many internal systems should have a VPN.
A VPN is also cheaper to get started with if you already have the technology. And most IT technicians are familiar with it.
Our objection concerns one particular case. The user only needs one machine, but the tool gives access to the whole network.
Common questions
Can we keep our VPN and use XoT at the same time?
Yes. For example, you can use a VPN for employees and XoT for vendors and for equipment that should stay hidden.
Does XoT use WireGuard?
Yes. XoT encrypts the traffic with WireGuard, a technology for encrypted connections. But XoT uses the technology in a different way from a VPN.
How long does it take to give a vendor access?
It takes about 20 seconds. You create a rule in XMS, the server where you manage access rules. The rule applies immediately.
What does XoT cost compared with a VPN?
You pay for the XoT-S1 hardware once. You then pay for a licence every year for each machine the Lock protects. The first contract period is three years. Ask us for a price for your site. Also take into account what it costs you today to manage VPN accounts and rules.
Try XoT at your next service visit
Next time a vendor needs to reach a machine, you can give them a Key instead of a VPN account. Then you can compare for yourself.