Operational Overhead Efficiency

Evidence and data. Forrester research states, “IT networking sparks a visceral reaction of disdain, with many leaders hoping to ignore it or hide from its painful complexity.”³ Interviewees highlighted this complexity: Their organizations required a combination of IT, engineering, and infrastructure teams to build, integrate, and monitor their networking solutions. Specific tasks included provisioning devices, configuring authentication and authorization rules, troubleshooting end-user questions, and preparing compliance reports. Tailscale enabled the interviewees’ organizations to reduce the time dedicated to these activities with its intuitive user interface and automated user management via identity integration. Additionally, Tailscale reduced provisioning infrastructure complexity by simplifying the organizations’ architectures and enabling them to retire various networking components.

• The CISO at a software organization shared three examples of time savings:

  • IT support tickets. “I would estimate 10 tickets per month of users who had issues connecting to [our prior VPN]. They didn’t understand where to log on. That has more or less gone away with Tailscale.”
  • User management. “The benefit with Tailscale for IT is the identity management integration. From [IT’s] perspective, they can better control the user groups directly. Whereas before, they had to log in to a different tool to add users and send out an endpoint for them to connect to first.”
  • Compliance prep. The interviewee estimated saving a few hours on compliance audit preparation as a result of Tailscale’s integration with their organization’s identity management solution.

• The infosec architect at the software organization said: “The value for IT is that it is not something we think about. It’s something we set up, and it tends to work. We’ve had five total Tailscale tickets in the last six months at the company, and to be honest, I was surprised it was that high because you never hear about it.”

• The VP of software at a logistics organization spoke about IT and engineering team efficiencies:

  • IT efficiency. “I can definitely imagine that if we had scaled up the [homegrown] approach, we would have spent significantly more time on the overhead of managing authentication rules and access credentials. A top estimate for me would be 50% of the time that we would otherwise use provisioning users and certificates is gone by virtue of using Tailscale.”
  • Engineering efficiency. “It significantly reduced the amount of administration time that’s involved in maintaining and updating the VPN infrastructure. There were VPN servers that needed to be commissioned and certificates issued. We initially had half an FTE managing remote access, and now basically have the same setup despite having an organization that is 50 times the size.”

• The technology fellow at a retail organization said: “[For our application infrastructure], there’s less to provision. We don’t have to use Kubernetes HTTP gateways, so it cut time. We don’t have to use Kubernetes ingresses or services, so it cuts out a ton of YAML.”

Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:

• The composite dedicated three FTEs to managing remote access in the prior environment. Activities included provisioning managed resources for end-user devices, IoT devices, and application infrastructure where it had a mix of prior solutions and homegrown capabilities. With Tailscale, this team gains 60% efficiency with its tasks.

• The average fully burdened annual salary for a technical resource is $140,000.

• Only 50% of the recaptured work is spent on productive activities.

Risks. This benefit may vary among organizations depending on:

• The size and complexity of devices in an organization’s managed environment.

• Associated salaries for technical resources.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $282,000.

Simplified Network Architecture

Evidence and data. Beyond operational overhead labor savings, interviewees explained that investing in Tailscale enabled their organizations to retire prior VPN and remote access infrastructure — and in some cases, to sunset infrastructure components previously necessary to run their provisioned architecture.

• The CISO at a software organization said: “We were able to sunset multiple solutions like our [VPN] and [remote access solution]. We were paying for users to have access to three VPNs because depending on what they’re doing there, they may need to disconnect and reconnect to a different one.” They estimated saving approximately $120,000 for the VPN and between $60,000 and $75,000 for the remote access solution.

• The technology fellow at a retail organization explained: “On the new platform, we got rid of some components — there’s no more load balancers to manage the ingress into the cluster, no more armor policies to manage the security of those particular load balancers, and we don’t need the NAT components to egress because it just goes through Tailscale. We’re able to cut all that stuff out. Now applications are deployed to Kubernetes and then our mesh takes over from there. This is a major cost savings from our perspective.”
  The interviewee continued: “If you look at the ability to connect a workload from one cluster to another cluster, using the load balancer, armor policies, and NAT, as compared to the way we’re doing it with Tailscale, the cost is [now] approximately 80% less from an egress networking perspective. I don’t know that we’ve realized all 80%, as there will be variance in how teams are processing and doing network egress. But we’re definitely seeing double-digit savings because of the costs we avoid.”

Modeling and assumptions. Forrester assumes that adopting Tailscale enables the composite to retire networking infrastructure in its prior environment (e.g., VPN solution, remote access solution) for savings worth $550,000. This also assumes all employees had access to the VPN solution and only technical employees had access to the remote access solution.

Risks. This benefit may vary among organizations depending on whether or not they fully retire software or hardware and the associated costs.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.2 million.

End-User Productivity

Evidence and data. Interviewees shared how technical and nontechnical end users faced connectivity issues and developmental roadblocks in their prior networking environments. With Tailscale, connectivity improved by enabling direct connections, and end users recaptured time previously wasted on resolving issues with IT.

• The CISO at a software organization said: “We never really ran [our prior VPN] as an always-on situation, as we had to give employees a specific endpoint to connect to that was unique to us. With Tailscale, it’s not forced always-on, but because we don’t have the split tunnel issue, people are largely leaving it always-on. Tailscale is transparent. When we look at the metrics, it’s pretty stark that most people just leave it on because it doesn’t cause any issues for them. Before, I would say [people spent] between 30 minutes to an hour per month dealing with connectivity issues. That’s more or less gone away. Additionally, users overseas notice the performance improvements from not having to transit their traffic back to the US.”

• The VP of software at a logistics organization said: “It’s a significant enhancement for end users. It’s a day-to-day tool for the engineering team and they never complain about it, which is rare in my experience. I would say the engineering team is easily saving 75% of the issues that they might normally get with remote access and authentication to remote devices.”

• The technology fellow at a retail organization shared three ways their organization’s engineers gained productivity through Tailscale:

  • Easier onboarding. “From an operational perspective, we’re trying to take friction out of the process. For onboarding, the security is built into the platform so developers don’t have to go through the process of getting a client certificate or getting OAuth to client secret and provisioning that, and rotating it, and maintaining it. They just deploy to the platform, they get a Tailscale key automatically, and they’re done.”
  • Improved latency. “Everything is essentially one hop away from everything else, irrespective of the number of VPCs or Kubernetes clusters that are running. This new architecture uses a model where we essentially treat everything like a flat network. We’re able to connect all of these clusters together and eliminate the challenges of VPC networking. We cut down on latency because of the more direct networking capabilities. We’re seeing somewhere in the neighborhood of 40% better latency numbers. That’s been a good operational win.”
  • Less down time for developers. “We use subnet routers as part of the platform for on-prem access. That was a big unlock. It does save a lot of time for the developers if they need to access on-prem resources because instead of waiting for days to get a firewall request approved or security team, they can come back through this preapproved tunnel, as it were.”

Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:

• There are 750 engineers and 2,250 nontechnical employees.

• Each engineer spent 15 hours resolving connectivity and development roadblock issues in the prior environment. This decreases by 50% with Tailscale.

• The average fully burdened hourly rate for a technical resource (engineers, developers, etc.) is $67.

• Each nontechnical employee spent 6 hours resolving connectivity issues in the prior environment. This decreases by 50% with Tailscale.

• The average fully burdened hourly rate for a nontechnical employee is $47.

• Only 50% of all recaptured time is spent on productive activities.

Risks. This benefit may vary among organizations depending on:

• The number of employees, the split between technical and nontechnical employees, and the associated salaries.

• Whether or not employees encountered connectivity issues with their prior networking infrastructure.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $734,000.

Strengthened Security

Evidence and data. Forrester research states, “You must explicitly define trust, continuously review it, and inform it with context for every access session. These pieces of context can be the posture of a device, type of workload, attributes around an identity, and more.”⁴ In line with this principle, interviewees emphasized the importance of implementing strategies that would ensure secure remote access. They explained that through default deny policies, JIT access, identity-centric approaches, and device posture checks, their organizations strengthened security measures across their networking environments.

• The technology fellow at a retail organization shared two examples of where Tailscale provided value:

  • Identity-centric approaches and default deny policies. “There’s a process where application owners can request authentication to another application, the owner of the upstream application can approve that, and then it gets automatically wired into the mesh — so all the authentication is built in through our developer portal. They can stitch in connectivity from other applications. Because it’s default deny, it provides us [with] a reasonably good layer for security that is self-managed by the app teams. Everything gets an identity and a workload identity. Not only are they in charge of their own authentication policies, but from a security perspective, we know exactly who’s talking to what right down to the IP address.”
  • JIT access. “Tailscale provides emergency SSH access that’s provisioned just in time. There’s no standing access, but it’s just-in-time provisioning. There are two network admin approvers that need access to a core router or similar, and they have Tailscale SSH from their laptops directly into that core system.”

• The CISO gave four specific examples of how Tailscale provided more control and visibility for their software organization:

  • Domain name system (DNS) management. “One of the other big areas of value with Tailscale was DNS management, specifically being able to control the DNS servers that are on our laptops. The good news is that we get better insights into potential bad domains that are command and control from a malware standpoint.”
  • Visibility during investigations through logs. “We had a phishing attack against our employees that happened a year and a half ago. [Tailscale] gave us a little bit more visibility. It made it easier for us to check in our identity management system for any weird logins. We were able to narrow down, identify, and cut access in the 45-minute investigation period.”
  • Device posture checks. “We can write Tailscale access control rules. You can say ‘install’ only if the user’s device is up-to-date and has all malware protections enabled. It is a good way to understand that a user has lost access because they are ignoring an update notification.”
  • Not bypassing network rules. “Because Tailscale worked, we were able to remove prior clunky bypass rules. This comes to mind in terms of places where the attack surfaces directly changed.”

• The VP of software at a logistics organization estimated a 70% risk reduction using Tailscale relative to systems deployed without network-level isolation. They elaborated on three areas of impact:

  • End-to-end encryption without public exposure. “We’re able to talk about Zero Trust networking with our customers, as we’re able to completely remove services from the public internet that might previously have been exposed to it through different authentication strategies. The traffic is always guaranteed to be end-to-end encrypted.”
  • Reduced attack surface. “It has reduced the surface area for any attack which might happen within the organization. The compromise of an individual device no longer has access to all of our devices and their ability to request just-in-time access can be revoked.”
  • Offboarding employees. “Generally, it’s a lot easier to offboard individuals because we can just close the account and not have to worry about deprovisioning individual keys ourselves.”

Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:

• The total annual risk exposure of security breaches totals $2,062,000 per year.⁵

• These breaches may originate from external attacks targeting the organization; external attacks targeting remote environments; internal incidents; or attacks or incidents involving the external ecosystem.⁶

• Tailscale can address 30% of these attacks (e.g., traffic interception, exposed services, unauthorized access via strong ACLs, unauthorized VPN access from stolen VPN secrets, insider/lateral movement attacks), equating to $618,600 in annual risk exposure.

• Tailscale reduces the risk of exposure to breach costs from addressable attacks by 70%.

Risks. This benefit may vary among organizations depending on:

• The size and industry of an organization, which can impact the likelihood and associated costs of security breaches.

• An organization’s legacy security capabilities and its level of Tailscale coverage and adoption.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $861,000.

Operational Outage Risk Reduction

Evidence and data. One interviewee explained how their application infrastructure built with Tailscale automatically rotated secrets (a task previously required of development teams), which reduced operational outage risks. They estimated the likelihood of an operational outage to be less than 1%; however, Tailscale reduced the overall impact of such an incident by 80%.

The technology fellow at a retail organization said: “Tailscale reduces the probability that you have a secret slated outage. It reduces the risk of an operational outage due to a bad secret rotation. We have hundreds of thousands of certificates and secrets in the environment. Every time you have to rotate one, there’s a potential for an incident or an outage. We’re trying to reduce this as much as possible. Public certificate lifetimes are getting reduced to 47 days in a couple of years, and that would obviously be problematic if you don’t have good automation in place. The more applications we can get onto the platform [with Tailscale], the fewer things we have to maintain and touch.”

Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:

• The composite has $1 billion in annual revenue and an operating margin of 12%.

• A 1-hour operational outage costs $114,155. This model assumes an operational outage lasts two days, which would cost $5,479,452.

• The likelihood of an incident causing an operational outage is 1%.

• Tailscale reduces the risk of an incident by 80%.

Risks. This benefit may vary among organizations depending on:

• An organization’s annual revenue and operating margin.

• Whether or not an organization is using Tailscale to rotate secrets for authentication automatically.

• The length of an operational outage due to an incident.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $12,000.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Supports business compliance processes. Interviewees explained how Tailscale supported their organizations’ compliance reviews by centralizing user access and permissions from a networking perspective. This improved transparency and communication with auditors. The VP of software at a logistics organization said: “It’s been quite easy for us to use the technology to reduce the amount of information that we have to look at during the process of things like external penetration testing; vulnerability testing; or SOC 2, SOC 1, or ISO 27001 in terms of how business processes work for us. This is a net benefit.”
  The CISO at a software organization said: “We do payment card industry and SOC 2 [compliance] for our businesses and change management of access controls. This includes remote server access for engineers which is tied directly to Tailscale. The fact that changes have to go through this change management approval process in GitHub has provided transparency and automation. That’s been a big one for us. Through our identity management, we know which engineers have access at any given time. Before, it required a lot of pulling screenshots from our tech console and it was a lot less transparent for the auditors.”

• Improves trust and collaboration between IT ops and developers. Interviewees explained that Tailscale made the access levels for certain managed resources more transparent to engineers, reducing friction with IT. The CISO at a software organization said: “One of the benefits we have is transparency around infrastructure as code and automation. It has increased trust between the IT operations teams and developers in terms of access permissions and changes. Previously, this had not been transparent, and trust had been broken in some cases.”

• Offers a strong vendor partnership. Interviewees emphasized the strength of Tailscale’s technical and relationship management teams as their organizations’ use cases continued to evolve in complexity. The technology fellow at a retail organization said: “It’s a solid technical implementation. We really put it through its paces and ticked all the boxes we needed from a technical perspective. Tailscale was willing to help us build and they have been very good partners to work with from an engineering and an account relationship perspective. It’s important for us to have good partners.”

• Supports end customers’ security requirements. Forrester research states, “Zero Trust enables a positive customer experience and employee experience by ensuring access to needed systems and data with little or no friction.” One interviewee emphasized the critical role Zero Trust played when configuring Tailscale onto their customer devices for remote access. The VP of software at a logistics organization said: “There’s a lot of pressure to ensure that there is secure posture in place for any devices, particularly if installed into customer networks. It is quite important for the IT teams at our bigger customers for us to talk about Zero Trust, and how there is no unauthenticated remote access possible, and that all the data coming out of the device is audited as well. When we’re talking to a large multinational organization with strict IT requirements, it helps make those conversations a bit easier.”

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Tailscale and later realize additional uses and business opportunities, including:

• Continuing to expand use cases. Interviewees shared anticipation for expanding Tailscale use across their networking environments.
  The CISO at a software organization said: “We don’t currently use anything with our Kubernetes environment with Tailscale. This is a big thing we talked about during our renewal, as you can now use their tools to remote access into containers. I would love to do more of this. It’s something that’s on our roadmap.”
  The director of IT at a software organization said: “Right now, we are looking at putting all of our SaaS tools behind Tailscale using their new app connector approach. We’re about to start some proof of concepts on that. This is because we want to make better use of their posture checking.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).