HashiCorp Boundary

Identity-aware session broker for infrastructure access without distributing credentials

As of 31 August 2026, HashiCorp Boundary is free to use. Gives engineers a session to a host or database based on their identity provider group, without them ever holding an SSH key or a database password. Softwr lists it under Cybersecurity. HashiCorp Boundary is made by HashiCorp, an IBM company, available on Linux, macOS, Windows, Web.

Visit siteVisit HashiCorp Boundary

Overview

What HashiCorp Boundary does

Boundary sits between users and infrastructure. Instead of putting an engineer on a VPN and letting them reach whatever the network allows, Boundary authenticates them against an identity provider, checks which targets their groups grant, and brokers a session to exactly that host, database or Kubernetes cluster. Paired with Vault it injects credentials just in time, so the engineer never sees a password, and the credential is revoked when the session ends. Every session is recorded in an audit log, and Enterprise adds full session recording with playback. The distinguishing thing is dynamic host catalogues. Boundary can discover targets from AWS, Azure and GCP tags rather than from a static list, so an autoscaling group that replaces every instance nightly does not require anyone to update an access list. That is the practical difference against a bastion host: bastions require someone to keep an inventory current, and in an ephemeral estate nobody does. Buyers are platform and security teams that already run Vault and Terraform and want the third piece under the same operating model. The trade-off is organisational. IBM completed its acquisition of HashiCorp in February 2025, Boundary Enterprise is now sold through IBM Passport Advantage, and IBM has already sunsetted HCP Vault Secrets, so a buyer should ask directly about Boundary's long-term place in the portfolio rather than assume it. The community edition is open source under MPL 2.0 and remains a genuine option.

What people use it for

A platform team replacing shared SSH keys and a bastion host so that leavers lose access the moment they are removed from the identity provider
Granting contractors time-boxed database access without ever issuing them a credential they could keep
An estate where autoscaling replaces hosts continuously and a static access list is always out of date
Producing session recordings as evidence for an audit that requires proof of who touched production and what they ran

Where it falls short

Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about HashiCorp Boundary.

HashiCorp was acquired by IBM in February 2025 and Enterprise licensing now runs through IBM Passport Advantage; IBM has already retired HCP Vault Secrets, so Boundary's roadmap depends on IBM portfolio decisions rather than HashiCorp's own product strategy.
Enterprise pricing is not published anywhere, and the features most organisations actually need for compliance, notably session recording, are Enterprise only, so the free community edition is rarely the version you end up buying.
It solves access to infrastructure, not to applications; browser-based internal tools, SaaS admin consoles and APIs need a separate control, so Boundary is one component of a zero-trust programme rather than the whole thing.
Running it yourself means operating controllers, worker nodes and a Postgres database in a highly available configuration, and if that control plane is down nobody can reach production, which makes it a new critical dependency.
It is materially easier to adopt if you already run Vault and Terraform; teams without that ecosystem face a steeper learning curve than a device-based mesh product like Tailscale, for a similar access outcome.

Cross-shopped

What people choose instead of HashiCorp Boundary

Each pairing was judged by two reviewers asking whether a buyer would genuinely weigh the two against each other. The ones that failed were deleted rather than published.

HashiCorp Boundaryvs
Tailscale
Tailscale: If you want identity-based network access with far less infrastructure to operate and no separate control plane to keep highly available
HashiCorp Boundaryvs
HashiCorp Vault
HashiCorp Vault: If your actual problem is secrets storage and rotation rather than brokering interactive sessions
HashiCorp Boundaryvs
Okta
Okta: If you need the identity layer itself; Boundary consumes it rather than replacing it

Pricing

What HashiCorp Boundary costs

Taken from the vendor's own pricing page. Prices move, so check before you buy.

Boundary Community Edition

Free

MPL 2.0 open source
Self-hosted controllers and workers
Identity-based target access
Vault credential brokering
No session recording, no support contract

Boundary Enterprise

On request

Session recording and playback
Multi-hop and transparent sessions
Multi-tenancy via scopes
Licensed through IBM Passport Advantage
Pricing not published

Capabilities

Features

Identity-based access
Targets granted by identity provider group membership rather than by network reachability
Just-in-time credentials
Vault integration injects short-lived credentials the user never sees
Dynamic host catalogues
Discovers targets from AWS, Azure and GCP tags so ephemeral infrastructure stays in scope
Session recording
Full recording and playback of SSH and RDP sessions on Enterprise
Transparent sessions
Client connects to the real hostname and Boundary intercepts, removing the need to change tooling
Multi-hop workers
Reach private networks without inbound firewall rules by chaining worker nodes outbound
Audit logging
Every authentication and session start recorded for compliance evidence
Terraform provider
Targets, roles and host sets managed as code alongside the rest of your infrastructure

Answered, with sources

Questions people ask

Each answer names the page it came from, so you can check it rather than take our word for it.

Is Boundary open source?

The community edition is, under MPL 2.0. Boundary Enterprise is commercial and is now sold through IBM Passport Advantage.

Does it replace a VPN?

For infrastructure access, largely yes. It grants a session to a specific target rather than putting the user on a network, but it does not cover browser-based internal applications.

What does Boundary Enterprise cost?

HashiCorp does not publish Boundary pricing. It is quoted, and since the IBM acquisition it is transacted on IBM licensing paper.

Do I need Vault to use it?

No, but the just-in-time credential brokering that makes Boundary worthwhile depends on Vault or an equivalent secrets store.

Keep looking

Where to go from HashiCorp Boundary

Best Cybersecurity software for

Compare HashiCorp Boundary with

Other Cybersecurity software

BeyondTrust
Privileged access management, endpoint privilege management and secure remote access
Pricing on request11 researched notes
Teleport
Certificate-based access to servers, Kubernetes, databases and apps, replacing shared credentials and VPNs
Pricing on request13 researched notes
Delinea
Privileged access management from the merged Thycotic and Centrify
Pricing on request11 researched notes
Infisical
Security infrastructure for developers and AI agents
Free, then $20/mo10 researched notes
1Password
The world's most-loved password manager
From $2.99/mo10 researched notes
LastPass
Simplify online life with LastPass password manager
Free plan12 researched notes
authentik
Open-source identity provider with flexible authentication flows
Free plan9 researched notes
Logto
Open-source identity and authentication infrastructure for apps and APIs
Free, then $24/mo8 researched notes
Ory
Open-source identity, authentication, and permissions infrastructure
Free, then $64/mo8 researched notes
Saviynt
Cloud identity governance with privileged access in the same platform
Pricing on request11 researched notes
Beyond Identity
Phishing-resistant passwordless authentication with device trust enforced at every login
Pricing on request11 researched notes
One Identity
Quest-owned identity governance, PAM and Active Directory management
Pricing on request11 researched notes
Keygen
Open, source-available software licensing API
Free plan9 researched notes
KnowBe4
World's largest security awareness training platform
From $1/mo13 researched notes
Legit Security
AI-native ASPM platform securing AI-generated code before deployment
Pricing on request12 researched notes
LogRhythm SIEM
AI-powered SIEM platform for modern security operations
8 researched notes
Metasploit
The world's most used penetration testing framework
Free plan11 researched notes
MetricStream
Enterprise GRC suite for large regulated organisations, with implementation costs that exceed the licence
Pricing on request12 researched notes

Softwr does not host reviews and shows no star rating for HashiCorp Boundary, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.

Best Cybersecurity software alternatives

View all Cybersecurity software