# teleport

Source: https://startwithidentity.com/vendors/pam/teleport/
Last updated: 2026-08-01
License: content by Start with Identity. Cite the source URL.

---

## Overview

Teleport provides identity-native access to servers, Kubernetes, databases, and applications using short-lived certificates instead of static credentials. Founded in 2015 with strong open-source roots, it reframes [PAM](https://startwithidentity.com/guides/fundamentals/what-is-pam/) for engineers: rather than vaulting and handing out passwords, it issues certificates tied to an SSO identity that expire automatically, so there are no standing secrets to steal.

Teleport extended that model to AI agents with [Beams](https://startwithidentity.com/blog/2026-03-19-teleport-launches-beams-trusted-agent-runtimes/), announced 19 March 2026 with an MVP on 30 April. Each agent runs in an isolated Firecracker microVM with its own identity, reaching infrastructure and inference services without secrets and under the same audit trail. It governs agents you run on your own infrastructure, not SaaS assistants or third-party MCP servers.

## What it is good at

Certificate-based access is the core, and it is a genuinely modern model: every connection is authenticated, authorized, and recorded against a real identity, with no shared keys or bastion sprawl. Kubernetes and cloud support are excellent, the audit trail is rich, and the developer experience is a clear strength, which is why platform engineers favor it. The open-source core lets teams adopt and evaluate it fully before paying, and self-hosting gives control over the access plane.

## Where it falls short

Teleport is access-and-identity native rather than a traditional vault, so password-centric legacy use cases (managing many static Windows admin credentials, classic vault workflows) are a weaker fit. Federation breadth and the support ecosystem trail the largest incumbents, and pricing for the enterprise tier is quote-based. Teams whose privileged estate is mostly legacy on-premises Windows will find a classic PAM suite more aligned.

## Pricing

Open-source community edition plus paid enterprise and cloud tiers. Because self-hosting is viable, model the cost against per-seat commercial PAM with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Best for, and who should look elsewhere

Choose Teleport when identity-native, certificate-based access for engineers and modern infrastructure is the goal. For the proxy-broker alternative, see [Teleport vs StrongDM](https://startwithidentity.com/compare/teleport-vs-strongdm/); for the HashiCorp-stack approach, see [HashiCorp Boundary](https://startwithidentity.com/vendors/pam/hashicorp-boundary/); for credential-vaulting-first enterprise PAM, see [CyberArk vs BeyondTrust](https://startwithidentity.com/compare/cyberark-vs-beyondtrust/).

## Bottom line

A leading identity-native access platform for modern infrastructure, loved by platform engineers, and less suited to legacy password-vaulting scenarios.