Same foundation — all built on WireGuard or a WireGuard-derived protocol. That's not a knock on any of them, it's the honest starting point. The question is what happens once the tunnel's up.
Where we're genuinely the same: Tailscale and Twingate build on the same WireGuard-based idea — mesh or brokered point-to-point tunnels — genuinely similar to Threatmatic's own connectivity layer. NordLayer is closer to a traditional VPN gateway product using a WireGuard-derived protocol (NordLynx) than a true mesh. Either way, none of the three inspect payloads, defend the gateway from a volumetric attack, or give you an org-wide enforcement posture — that's the actual gap.
Every row below is a capability that lives above the tunnel — the part these tools deliberately stay out of, and the part Threatmatic was built around.
A tunnel gets your packets there. It doesn’t ask what’s in them.
A device on any of these tools can still exfiltrate data, beacon to C2, or talk to shadow AI endpoints — the tunnel just carries it faithfully. π actually looks at what's moving, endpoint and edge, with the same classifier both places.
Real, shipped: 12+ categories, live in production.
None of these products defend their own entry point from a volumetric flood — that's outside what a connectivity tool sets out to do. EdgeGuard does — SYN cookies and rate limiting at the edge, before traffic reaches anything else.
Real, shipped: Kernel-level, sub-200ms, live on gateways.
ACLs and access policies answer “who can reach what.” They don't answer “what's our org-wide stance,” or give you a real accounting of every change for an auditor. TrustZero and the Ledger do both.
Real, shipped: One-toggle posture + full audit history.
Methodology: the Threatmatic column reflects our own shipped, verifiable capabilities as of this page’s publish date. The other columns reflect each vendor’s own publicly documented product scope — each is a genuinely good product at what it sets out to do; the argument here is scope, not quality.
See what’s actually moving across your mesh, not just that it arrived.
Start a live test