Tailscale vs Cloudflare Zero Trust for UK Businesses

Tailscale and Cloudflare Zero Trust solve the same problem in opposite ways. Tailscale builds an encrypted WireGuard mesh directly between your devices: your laptop talks to the office server peer to peer, at whatever speed the line supports, and on a healthy connection Tailscale's own infrastructure never carries your data. Cloudflare routes everything through its global edge, which is exactly what makes its identity checks, traffic filtering and clientless browser access possible, and it means even two machines in the same office reach each other via a Cloudflare data centre. If the things you protect live on site (storage, build servers, dev infrastructure), Tailscale is usually the better fit. If you are gating web apps for a mixed workforce and third parties, or you need to inspect and filter traffic, Cloudflare usually wins. Plenty of teams run both.

A note on where we stand before the detail: we run Tailscale internally at Stabilise and deploy it for client fleets, so that half of this comparison is first-hand. We have not deployed Cloudflare Zero Trust for a client. That half is built on Cloudflare's documentation, its published post-mortems, and the accounts of teams who have written honestly about running it. No vendor relationship either way.

If you want the primer on why zero trust access beats a traditional VPN at all, we covered that in Traditional VPNs vs Tailscale and Twingate. This post assumes you are past that question and choosing between the two most talked-about answers.

What Tailscale is and how it works

Tailscale is a mesh VPN built on WireGuard. Install the client on every device you care about, sign in with the identity provider you already use (Google Workspace, Microsoft 365, Okta and others), and every device gets a stable private IP on your own private network, called a tailnet.

The clever part is what Tailscale's servers do not do. The coordination server exchanges public keys and access policies, and that is all. Private keys never leave your devices, and traffic flows directly between machines wherever NAT traversal succeeds, which Tailscale says is well over 90% of connections. Direct means fast: in Tailscale's own benchmarks, tuned connections exceed 10 Gbit/s between capable machines. Your office NAS, reached from home, performs at whatever speed the slower of the two internet connections allows, with no shared concentrator in the middle.

When a direct path fails (symmetric NAT, hostile hotel Wi-Fi, some CGNAT setups), traffic falls back to Tailscale's DERP relay servers. The connection keeps working and stays end-to-end encrypted, but throughput drops sharply. That fallback behaviour is the honest asterisk on every Tailscale speed claim, and it matters when you are sizing expectations for remote file work.

Access control lives in a policy file you can code-review. Rules like "engineering can SSH to production, marketing cannot see it at all" are enforced on each device. Tailscale also runs on the storage itself: there is an official package in Synology's Package Center, plus QNAP support, so a NAS can join the tailnet without any port forwarding.

What Cloudflare Zero Trust is (and how WARP, Access, Gateway and Tunnel fit together)

Cloudflare's offer is harder to describe because it is four products wearing one badge, and the names have shifted. In February 2026 Cloudflare renamed the WARP client to the Cloudflare One Client, so you will see both names in its documentation for a while yet.

The client (WARP) runs on each device and sends its traffic to Cloudflare's edge. The same app powers the free consumer 1.1.1.1 service; enrolled in a company's Zero Trust organisation, it starts enforcing policy and reporting device health.

Access is the identity gate. Put an internal web app behind Access and every request must pass your rules first: who the user is, which identity provider group they belong to, what state their device is in. It speaks SAML and OIDC, and GitHub works as an identity provider, which dev teams tend to like.

Gateway is the filter. Because traffic transits Cloudflare, it can block malicious domains, enforce acceptable-use policies, and (with a Cloudflare certificate installed on every device) decrypt and inspect TLS traffic for data loss prevention.

Tunnel connects your infrastructure. A small daemon called cloudflared runs next to your app or on your network and makes outbound-only connections to Cloudflare, so nothing needs a public IP or an open inbound port. One practical warning from Cloudflare's own docs: create the Access policy before you publish the tunnel route, or your internal service is briefly reachable by anyone.

Notice what all four have in common: everything transits Cloudflare. There is no peer-to-peer path. Even Cloudflare's device-to-device feature relays through its network, so two Macs sitting on the same studio LAN, talking via Cloudflare, round-trip through the nearest data centre. That is the architectural fork this whole comparison hangs on.

We took a longer, single-product look at the client in our Cloudflare WARP analysis, recently updated for the rename and the 2025-26 reliability record.

Why businesses are moving off traditional VPNs

The short version: the perimeter appliance became the way in.

Between 2024 and 2026, every major VPN appliance vendor shipped at least one critical flaw that attackers exploited in the wild. Ivanti Connect Secure was exploited at scale twice, with the NCSC confirming active exploitation against UK networks. Palo Alto's GlobalProtect took a maximum-severity flaw in 2024 and another exploited bug in 2026 that Qilin ransomware affiliates used for initial access. Check Point gateways leaked password hashes.

Akira ransomware walked through SonicWall firewalls that were fully patched with MFA enabled. Fortinet's SSO bypass in December 2025 was being exploited within days; we wrote up what UK businesses should do about it at the time.

Verizon's 2025 Data Breach Investigations Report put a number on the trend: among breaches that began with a vulnerability exploit, the share involving VPNs and edge devices grew almost eightfold in a year, from 3% to 22%. These boxes sit on the public internet, hold credentials for everything behind them, and get patched slowly.

Both tools in this comparison remove that box. There is no listening appliance to scan, access is per resource rather than per network, and a stolen credential meets a device check instead of a flat LAN. The NCSC's zero trust guidance is blunt about the destination: assume the network is hostile and verify every request. Its device security guidance goes further, noting there would be little benefit in a VPN once you have fully adopted zero trust networking.

Gating access on device health, not just passwords

The feature that separates both of these tools from a legacy VPN is posture checking: access decisions that consider the state of the machine, not just the person typing.

The signals are the ones an auditor would ask about. Is disk encryption on? Is the OS current? Is the security agent running? Is this a company-managed device at all? A personal laptop with the right password gets a different answer from a managed, encrypted, patched MacBook, which is the entire point.

In Cloudflare, the client checks things like disk encryption, OS version and firewall state natively, and posture can also come from your security stack: CrowdStrike, SentinelOne, Intune and others plug in as posture sources. An Access rule can then say "finance app: finance group, managed device, encryption on."

In Tailscale, posture conditions attach to the access policy, and the richer signals come from integrations with the tools already managing your fleet: Jamf, Iru (formerly Kandji), CrowdStrike, SentinelOne and Intune among them. Posture integrations require its Standard tier or above.

For UK businesses this is not an abstract nicety. The Cyber Essentials v3.3 changes that took effect in April 2026 made missing MFA and missed 14-day high-risk patching into automatic failures. Posture-gated access will not patch your Macs for you, but it turns "are our devices compliant" from a quarterly spreadsheet exercise into a condition enforced at the moment of access, with logs to show for it. That is exactly the evidence security questionnaires and CE assessors ask to see.

Remote access to on-site storage: where the architectures diverge

Here is the question the homelab blogs and vendor pages all skip: what happens when the thing you need to reach is a storage box in your own office, and the files are big?

Tailscale's answer is structural. Put Tailscale on the NAS (the Synology package is official) or on a machine in front of it, and remote access is a direct WireGuard connection. A photographer pulling a shoot from the studio RAID gets the upload speed of the studio line. In the office, devices talk over the LAN as they always did. The caveat is the relay fallback: a client stuck behind hostile NAT drops to DERP speeds, so a team member on tethered CGNAT mobile broadband will feel it.

Cloudflare's answer is a proxy. SMB file sharing over the private network route works, and Cloudflare documents it, along with the caveats: private IP ranges are excluded from the client by default (an easy setup miss), and SMB is latency-sensitive, so every chatty protocol round trip travels to the nearest Cloudflare data centre and back. Cloudflare's proxied HTTP hostnames also enforce a 100MB upload cap, which rules out Tunnel public hostnames as a general file-drop endpoint; the private-network path avoids that limit but still hairpins through the edge.

For a dev house, the same fork shows up as infrastructure access. Tailscale gives you SSH to build servers and databases over direct connections, ephemeral CI runners that join the tailnet and vanish, and a Kubernetes operator. Cloudflare counters with browser-rendered SSH and RDP that need no client at all, which is genuinely useful for giving a contractor scoped access to one box for one week.

For a studio, the calculus is starker. A proxy-based edit workflow (cut on lightweight proxies, conform against full-resolution media at the end) survives either tool. The ingest and conform steps, where the terabytes move, want the direct path. If remote edit is the goal, the strongest pattern we have seen is a remote-desktop tool like Parsec or Jump Desktop running over Tailscale: pixels travel, media never leaves the building. Our creative remote access piece covers that workstation-first approach, and our Synology guide for Mac businesses covers the storage end.

The flip side: if your "on-site data" is really a web app, an internal wiki, a Grafana dashboard, something viewed rather than transferred, Cloudflare's model costs you almost nothing in practice and buys you clientless access for people you would never enrol in your mesh.

Deploying each on a managed Mac fleet

Both deploy cleanly through MDM, and we covered the general pattern in the Tailscale and Twingate piece. The comparison-specific details are the ones that bite.

Tailscale on macOS ships two client variants (App Store and standalone) with different preference domains, and Jamf-ready configuration schemas for both. Pick one variant fleet-wide and stay on it. Keep the client current: Tailscale publishes security bulletins at a steady clip, including a January 2026 fix for a root-level flaw in the standalone macOS variant's helper service, and a 2025 advisory that MDM-supplied auth keys had been logged, worth knowing if you scripted enrolment with a shared key.

Cloudflare on macOS deploys as a signed package with a managed preferences payload, and supports a no-MDM config file for scripted installs. The trap is downstream: if you turn on Gateway's TLS inspection, anything that pins its certificates breaks until you add explicit do-not-inspect exemptions. Cloudflare's own deployment guide for Iru (Kandji) calls this out, because the MDM agent's certificate pinning is incompatible with inspection. Cloudflare's docs concede the general point plainly: it is never possible to inspect absolutely all traffic, something will always break.

Do not run both clients on one Mac by default. They compete for the network extension layer and each other's control traffic; making them coexist takes deliberate split-tunnel exclusions. It is solvable, and documented by people who have done it, but it belongs in your deployment design, not in a user's Tuesday afternoon.

Running both: a common pattern, with caveats

The cleanest articulation we found of the hybrid pattern comes from an engineering write-up that runs both: Cloudflare as the perimeter for human traffic, Tailscale as the fabric for machine traffic. Public-facing and browser-based things sit behind Access; servers, agents and storage talk over the tailnet and never touch a public edge.

It works, and it maps to what each tool is best at. The friction shows up in three predictable places: both clients want to own DNS on the device, both wired to the same identity provider can encode subtly different policies for the same person, and advertised subnet ranges can collide. Decide which tool owns which layer up front and the pattern is stable.

Trade-offs, side by side

Two rows deserve expansion.

Reliability. Cloudflare's 18 November 2025 outage took Access authentication down for hours along with a fifth of the web; its February 2026 incident broke dedicated egress for six hours. Cloudflare publishes unusually candid post-mortems, which counts for something, but concentration is the price of its model. Tailscale's control plane has had incidents too; the architectural difference is that established WireGuard sessions keep flowing when it does, and only new logins and key rotations stall.

Cost shape. Cloudflare's free tier covers 50 users, which is remarkable and embarrasses Tailscale's small free plan. Past free, both charge per user per month in dollars, and the expensive Cloudflare capabilities (DLP, browser isolation, egress IPs) live in enterprise contracts. Check both pricing pages before you plan a budget; both change more often than blog posts get updated.

A decision framework for startups, dev houses and studios

Choose Tailscale when the crown jewels are machines. On-site storage, build infrastructure, databases, render boxes, staging environments. Engineering-led startups fit here almost by default, and it is what we run ourselves and deploy for clients.

Choose Cloudflare Zero Trust when the crown jewels are apps and the audience is mixed. Internal web tools for a broad workforce, contractor and client access without installing anything, staging sites for reviewers, plus filtering and DLP obligations a regulator or enterprise customer imposes. The 50-user free tier makes it a very cheap experiment.

Studios with on-site media: Tailscale for the data path, and consider remote workstations over it rather than remote file transfer. Use Cloudflare, if at all, for the browser-shaped things around the edges: review portals, internal dashboards, the booking wiki.

Genuinely both: common, sensible, and worth doing deliberately. Cloudflare for humans reaching apps, Tailscale for machines reaching machines. Decide who owns DNS before you start.

Whichever way you lean, the same rule applies that we give every client about zero trust: the tool is the easy part. The value is in the policy (who can reach what, from which devices, in what state) and in wiring it to the identity provider and MDM you already run. That design work is where we spend our time, on Tailscale tailnets and on the identity stack underneath, and it is the part worth getting right first.