Why is RDP over the public internet unsafe?

RDP (Remote Desktop Protocol) over the public internet has been the number one ransomware initial access vector for the past six years. The reasons: RDP uses a single authentication factor by default (username + password), port 3389 is scanned continuously by threat actor infrastructure, legacy RDP versions have had exploitable vulnerabilities (BlueKeep, DejaBlue), and shared credentials between Windows accounts mean one compromised credential grants desktop access. Exposing TCP 3389 to the internet is not a misconfiguration to be fixed later — it is an immediate, high-probability compromise risk.

What is the difference between secure remote desktop and ZTNA?

Secure remote desktop provides a user with an interactive graphical session to a remote machine. ZTNA provides network-level access to services and resources. They overlap when the resource being accessed is a Windows or Linux desktop. A ZTNA product that supports remote desktop (like QuickZTNA Workforce) combines both: the ZTNA layer gates access based on identity and device posture, and the remote desktop capability provides the interactive session. ZTNA without remote desktop can grant network access but requires a separate client for the graphical session.

What is WebRTC remote desktop and how does it work?

WebRTC (Web Real-Time Communication) is a browser standard that supports peer-to-peer and server-relayed audio/video streams and data channels. Remote desktop over WebRTC delivers the screen capture and input events through a browser, eliminating the need for a dedicated RDP client. The user opens a browser tab, authenticates, and sees the remote desktop rendered as a WebRTC stream. Modern WebRTC remote desktop (Apache Guacamole, QuickZTNA) supports file transfer, clipboard synchronisation, and session recording within the browser session.

Can remote desktop be HIPAA compliant?

Yes, when implemented with the right controls. HIPAA requires: encrypted transmission (AES-256 or equivalent), access controls identifying individual users (no shared accounts), audit logging of access sessions, automatic session timeout after inactivity, and for covered entities — a BAA with the solution provider. Remote desktop solutions that meet these requirements include those with ZTNA identity gating, per-session logging, and encrypted transmission. HIPAA does not certify specific products; covered entities are responsible for implementing and documenting the technical safeguards.

How should I handle clipboard and file transfer in secure remote desktop?

Clipboard and file transfer over remote desktop are a significant data exfiltration vector — an attacker with clipboard access can extract sensitive data from the remote system without any visible file operation. Compliance-grade remote desktop should provide per-role clipboard policies (allow, deny, log-only), file transfer direction control (block upload, allow download or vice versa), and file transfer logging with file name and size. DLP integration that scans clipboard or file transfer content for sensitive data patterns is available in some enterprise solutions.

What is jump host vs ZTNA remote desktop?

A jump host (bastion) is a server that sits on the private network; users SSH or RDP into the jump host, then connect onward to target systems. It is a castle-and-moat model: the jump host is the single point of external access. ZTNA remote desktop has no jump host; users authenticate directly against the ZTNA gateway, identity and posture are verified, and the session is established to the target machine. ZTNA reduces attack surface by eliminating the jump host as a lateral movement pivot. If the jump host is compromised, an attacker has inside-network access to all connected systems; with ZTNA, no such pivot point exists.

Comparison 18 min read · 4,100 words

Top 10 Secure Remote Desktop Solutions in 2026

RDP exposure is the leading ransomware initial access vector. Compare 10 secure remote desktop solutions on security model, performance, and zero-trust integration.

By QuickZTNA Engineering · Security team

May 13, 2026

SOC 2 Type II FIPS 203 GDPR

Table of contents

TL;DR

Every ransomware incident report from 2020 through 2025 lists RDP over the internet in the top three initial access vectors. Secure remote desktop is not optional — raw RDP exposure on the public internet is a near-certain path to compromise. This list compares the ten most important options in 2026, from the VPN-less ZTNA approach to browser-based WebRTC alternatives. Spoiler: any solution that leaves port 3389 open to the internet is not on this list.

Why legacy remote desktop fails

RDP (direct internet exposure). Port 3389 open to the internet means automated scanners find the endpoint within minutes of provisioning. Password-spraying attacks run continuously at scale. No MFA by default. Enterprise Windows deployments with domain admin credentials create maximum blast radius when compromised.

VPN + RDP. An improvement but still vulnerable to VPN credential compromise (no device posture checks, no per-resource authorisation), and VPN + RDP stacks two latency layers. The VPN provides network access; RDP provides the session. Both need to be maintained, patched, and monitored separately.

RDP Gateway (Microsoft). The Microsoft RDP Gateway provides HTTPS-wrapped RDP with SSO integration. Significantly better than direct RDP exposure. Lacks modern zero-trust features: no device posture, no JIT access, no session recording built in.

The correct 2026 architecture: ZTNA gates access, device posture is verified, identity is confirmed via SSO, and the remote desktop session is delivered over an encrypted tunnel with session recording active.

1. Microsoft Remote Desktop + Azure Virtual Desktop

Category. Microsoft-native virtual desktop infrastructure (VDI).

How it works. Azure Virtual Desktop (AVD) provides Windows 10/11 and Windows Server desktops delivered as VMs in Azure. Users connect through the AVD web client or the Remote Desktop client. Authentication is via Azure AD (Entra ID) with MFA. AVD reverse proxy architecture means VMs do not require inbound internet connectivity — connections are outbound from the VM to the Azure control plane.

Security model. No inbound connections required on VM. Azure AD authentication with Conditional Access policies (MFA, device compliance, location). Microsoft Defender for Cloud monitors the VM fleet. Session recording available via Azure Monitor.

Strengths.

Reverse proxy architecture eliminates inbound RDP exposure. The VM makes an outbound HTTPS connection to Azure, not the other way.
Full Conditional Access policy integration — device compliance (Intune), MFA, and location checks applied during authentication.
Persistent or non-persistent desktops for different security profiles (non-persistent desktops reset at logoff, preventing data persistence).
Seamless Office 365 and Microsoft 365 Apps integration.

Limitations. Azure-only. Capital cost of VM compute. Admin complexity of managing the AVD host pool and image lifecycle.

Best fit. Microsoft-centric organisations requiring persistent or pooled desktops at scale, especially for regulated industries requiring Windows 10/11 managed desktops.

2. Citrix Virtual Apps and Desktops

Category. Enterprise VDI and application virtualisation.

How it works. Citrix delivers virtual desktops and individual applications through the Citrix Virtual Apps and Desktops service. The Citrix Gateway (formerly NetScaler) terminates external connections and enforces authentication. ICA (Independent Computing Architecture) protocol is used rather than RDP, optimised for latency and bandwidth efficiency on poor connections.

Security model. SmartAccess and SmartControl policies restrict what users can do within delivered sessions — clipboard, file transfer, print, USB mapping can be controlled per policy. Session recording via Citrix Session Recording.

Strengths.

Best protocol optimisation for high-latency or throttled connections (overseas users, thin networks).
Application virtualisation — individual apps rather than full desktops, reducing the attack surface of the delivered session.
Mature session recording, DLP integrations, and HSM support for high-security deployments.
Citrix Analytics Security uses ML to detect anomalous session behaviour.

Limitations. Significant cost and complexity. Citrix remains an on-premises or cloud-hosted infrastructure deployment with associated operational overhead. Declining market share as cloud-native alternatives have matured.

Best fit. Large enterprise with existing Citrix investments; regulated industries requiring strict data residency and granular session controls.

3. Apache Guacamole

Category. Open-source browser-based remote desktop gateway.

How it works. Apache Guacamole is a clientless remote desktop gateway. Users access a web application in a browser; Guacamole translates browser interactions to RDP, VNC, or SSH sessions to target machines. No client software required on the user’s device. Authentication is via username/password, TOTP, LDAP, SAML, or OIDC.

Security model. Target systems are on a private network; only Guacamole has direct access. Users connect to Guacamole, not to target machines. Session recording to database or file storage.

Strengths. Open-source, self-hosted. Zero client-side software. Works on any device with a browser — tablets, Chromebooks, thin clients. Session recording built in. SAML/OIDC integration enables SSO.

Limitations. Performance is limited by browser rendering. Does not support all RDP features (some multimedia pass-through and 3D acceleration is lost through the browser layer). Self-hosted operational overhead.

Best fit. Organisations wanting open-source, clientless remote desktop for controlled internal access. Good for privileged access consoles.

4. BeyondTrust Remote Support

Category. Commercial PAM-integrated remote desktop and support tool.

How it works. BeyondTrust Remote Support provides session-based remote access that can be initiated jump-client (agent on target machine) or representative-driven (attended support). Integration with BeyondTrust PRA for credential injection and session recording.

Security model. All sessions proxied through BeyondTrust, never direct RDP. Session recording and keystroke logging. Credential injection — if used with PRA vault, the connecting user never sees the target machine password. MFA at session initiation.

Strengths. Best for IT support scenarios where the same platform handles both privileged access and end-user support. Session recordings linked to the support ticket or change request.

Limitations. Commercial pricing. Oriented toward IT support workflow; less focused on developer-oriented infrastructure access.

Best fit. IT operations teams handling a mix of end-user remote support and server privileged access.

5. Cloudflare Access + Browser Isolation

Category. ZTNA + browser-based remote access (Cloudflare One).

How it works. Cloudflare Access provides ZTNA-gated access to internal applications. Cloudflare Browser Isolation renders remote application sessions in Cloudflare’s cloud browser and streams the pixel output to the user’s browser — no data touches the user’s device. For remote desktop, Cloudflare supports RDP and SSH access through the WARP client or browser, gated by identity and Zero Trust policies.

Security model. Zero Trust access policies (identity provider, device posture via Cloudflare Gateway). RDP never exposed to the internet. Browser isolation can ensure no data leaves the Cloudflare rendering environment.

Strengths. Browser isolation is unique — it renders the session in Cloudflare’s cloud, not the user’s device. Clipboard exfiltration, local file download, and screen capture by malware on the user’s device are all prevented. Excellent for BYOD high-security scenarios.

Limitations. Browser-rendered remote desktop adds latency. Not suitable for graphics-intensive workloads. Requires WARP client or Cloudflare Tunnel deployment on target networks.

Best fit. Organisations using Cloudflare One as their ZTNA platform; BYOD scenarios requiring strong data-exfiltration prevention.

6. Tailscale + tart/RDP

Category. Open-source WireGuard mesh VPN with self-managed remote desktop.

How it works. Tailscale creates a WireGuard mesh network between all enrolled devices. Remote desktop is handled by a separate client (Windows Remote Desktop client over the Tailscale network, macOS Screen Sharing, or VNC). Tailscale provides the secure tunnel; remote desktop is native protocol over that tunnel.

Security model. WireGuard encryption for all traffic. MFA at Tailscale authentication. ACLs control which network identities can reach which machines. No session recording built in.

Strengths. Excellent developer experience. Fast WireGuard tunnel. Zero infrastructure - no gateway servers. Free tier for small teams.

Limitations. Not a complete remote desktop platform — Tailscale provides the tunnel, session recording and policy enforcement require separate tooling. No built-in JIT access or session recording. Compliance use cases require adding Tailscale + session recorder.

Best fit. Small engineering teams wanting secure zero-configuration remote access without compliance overhead. Not for regulated industries without additional tooling.

7. Splashtop Enterprise

Category. Commercial managed remote desktop (cloud-managed jump client).

How it works. Splashtop deploys a jump agent on target machines. Connections route through Splashtop’s gateway — targets do not require inbound ports. Authentication via SSO/SAML, MFA, and device approval. Session recording and transfer logs available in the Enterprise tier.

Security model. No inbound ports on target machines. SSO + MFA. TLS encryption. Device authentication (pre-approved devices only). Session recording in Enterprise tier.

Strengths. Very easy deployment. Good performance. Competitive pricing vs Citrix and competitor enterprise tools. Good balance of security features and operational simplicity.

Limitations. SaaS dependency on Splashtop infrastructure. Less deep posture checking and policy control than ZTNA-native solutions.

Best fit. SMB to mid-market organisations wanting a managed, low-maintenance remote desktop solution.

8. Devolutions RDM + Password Vaulting

Category. Remote Desktop Manager with credential vaulting and team access control.

How it works. Devolutions Remote Desktop Manager is a connection management tool that stores RDP, SSH, VNC, and other connections with credentials vaulted and shared via access permissions. Connections can be set up to inject credentials from the RDM vault — the connecting user does not see the password. Sessions can be logged.

Strengths. Best connection management tooling for teams with large numbers of servers. Strong credential vaulting for teams. On-premises server option.

Limitations. RDM manages and organises connections; it does not provide network-level gating. Target machines must still be reachable by network from the user. Not a replacement for ZTNA or a gateway-based solution.

Best fit. Sysadmin teams managing many servers wanting organised connection management with credential injection.

9. Xrdp + Jump Server + Teleport

Category. Open-source Linux remote desktop via ZTNA-gated Teleport session.

How it works. Teleport’s Desktop Access provides browser-based RDP sessions to Windows machines and graphical access to Linux desktops via an xrdp integration. Users authenticate through Teleport’s SSO integration and access Windows/Linux desktops through the Teleport web UI. Sessions are recorded. No direct RDP or VNC port exposure required.

Security model. No direct RDP exposure. Teleport certificate-based access. Session recording and keystroke logging. RBAC-scoped access per desktop.

Strengths. Full session recording for graphical desktop sessions is genuinely rare in the open-source space. Teleport Desktop Access is one of very few tools that records the full screen video of Windows desktop sessions.

Limitations. Requires Teleport deployment. Windows desktops require Teleport’s Windows Desktop Service running as an intermediary.

Best fit. Teleport-deployed organisations that also need secure, recorded access to Windows and Linux desktops.

10. QuickZTNA Remote Desktop (Workforce tier)

Category. ZTNA-native WebRTC remote desktop with session recording.

How it works. QuickZTNA Workforce includes a WebRTC-based remote desktop feature for Windows and Linux machines enrolled in the QuickZTNA network. Users access a managed machine through the QuickZTNA admin portal or web interface. The ZTNA layer verifies identity, device posture, and access policy before establishing the WebRTC session. Sessions are recorded to the immutable audit log.

Security model.

Target machines do not require inbound ports. QuickZTNA uses relay infrastructure when direct WebRTC connection is unavailable.
Device posture of the connecting device is verified via the QuickZTNA agent before session establishment — unmanaged devices denied.
JIT access integration: remote desktop to production servers can require approval, recorded session attached to approval request.
Clipboard and file transfer policies configurable per machine or group.
Session recording stored with cryptographic hash in tamper-evident storage.

Strengths.

No client software required on the user’s device for browser-based access. The WebRTC session renders in any modern browser.
Consolidated with ZTNA: one admin console for network access policy and desktop session management.
Session recordings linked to ZTNA access events — compliance reports include both the network access record and the session recording.
Posture-gated desktop access: a developer with an unmanaged or non-compliant device cannot start a remote desktop session to a production server.

Limitations. WebRTC graphical performance is good for administrative tasks; not optimal for graphics-intensive workloads (3D modelling, video editing).

Best fit. Organisations using QuickZTNA Workforce who want remote desktop integrated with their ZTNA identity and posture model, without deploying a separate VDI or remote desktop platform.

Comparison

Tool	No-inbound-port	MFA	Session recording	Device posture	JIT access	Browser-based
Azure Virtual Desktop	✅	✅ Entra ID	Partial	✅ Intune	Via PIM	✅
Citrix CVAD	✅ Gateway	✅	✅	✅	Via workflow	✅
Apache Guacamole	✅	✅ TOTP/SAML	✅	❌	❌ native	✅
BeyondTrust RS	✅	✅	✅	Partial	Via PRA	✅
Cloudflare Access	✅	✅	Via BI	✅ WARP	✅	✅
Tailscale + RDP	✅ tunnel	✅	❌ native	Partial	❌	❌
Splashtop Enterprise	✅	✅	✅	Partial	❌	✅
Devolutions RDM	❌ (network req.)	✅	Basic	❌	❌	❌
Teleport Desktop	✅	✅	✅ Full	Partial	✅	✅
QuickZTNA RD	✅	✅ ZTNA	✅	✅ Full posture	✅	✅

Try QuickZTNA Remote Desktop

QuickZTNA Workforce includes WebRTC-based remote desktop with posture gating, session recording, and JIT access integration. No VDI infrastructure, no inbound ports. Contact sales for a Workforce demo.

Frequently asked questions

Why is RDP over the public internet unsafe?: RDP (Remote Desktop Protocol) over the public internet has been the number one ransomware initial access vector for the past six years. The reasons: RDP uses a single authentication factor by default (username + password), port 3389 is scanned continuously by threat actor infrastructure, legacy RDP versions have had exploitable vulnerabilities (BlueKeep, DejaBlue), and shared credentials between Windows accounts mean one compromised credential grants desktop access. Exposing TCP 3389 to the internet is not a misconfiguration to be fixed later — it is an immediate, high-probability compromise risk.
What is the difference between secure remote desktop and ZTNA?: Secure remote desktop provides a user with an interactive graphical session to a remote machine. ZTNA provides network-level access to services and resources. They overlap when the resource being accessed is a Windows or Linux desktop. A ZTNA product that supports remote desktop (like QuickZTNA Workforce) combines both: the ZTNA layer gates access based on identity and device posture, and the remote desktop capability provides the interactive session. ZTNA without remote desktop can grant network access but requires a separate client for the graphical session.
What is WebRTC remote desktop and how does it work?: WebRTC (Web Real-Time Communication) is a browser standard that supports peer-to-peer and server-relayed audio/video streams and data channels. Remote desktop over WebRTC delivers the screen capture and input events through a browser, eliminating the need for a dedicated RDP client. The user opens a browser tab, authenticates, and sees the remote desktop rendered as a WebRTC stream. Modern WebRTC remote desktop (Apache Guacamole, QuickZTNA) supports file transfer, clipboard synchronisation, and session recording within the browser session.
Can remote desktop be HIPAA compliant?: Yes, when implemented with the right controls. HIPAA requires: encrypted transmission (AES-256 or equivalent), access controls identifying individual users (no shared accounts), audit logging of access sessions, automatic session timeout after inactivity, and for covered entities — a BAA with the solution provider. Remote desktop solutions that meet these requirements include those with ZTNA identity gating, per-session logging, and encrypted transmission. HIPAA does not certify specific products; covered entities are responsible for implementing and documenting the technical safeguards.
How should I handle clipboard and file transfer in secure remote desktop?: Clipboard and file transfer over remote desktop are a significant data exfiltration vector — an attacker with clipboard access can extract sensitive data from the remote system without any visible file operation. Compliance-grade remote desktop should provide per-role clipboard policies (allow, deny, log-only), file transfer direction control (block upload, allow download or vice versa), and file transfer logging with file name and size. DLP integration that scans clipboard or file transfer content for sensitive data patterns is available in some enterprise solutions.
What is jump host vs ZTNA remote desktop?: A jump host (bastion) is a server that sits on the private network; users SSH or RDP into the jump host, then connect onward to target systems. It is a castle-and-moat model: the jump host is the single point of external access. ZTNA remote desktop has no jump host; users authenticate directly against the ZTNA gateway, identity and posture are verified, and the session is established to the target machine. ZTNA reduces attack surface by eliminating the jump host as a lateral movement pivot. If the jump host is compromised, an attacker has inside-network access to all connected systems; with ZTNA, no such pivot point exists.

QuickZTNA Engineering Security team

#remote-desktop #rdp #remote-access #zero-trust #ztna

Share X / Twitter LinkedIn

TL;DR

Why legacy remote desktop fails

1. Microsoft Remote Desktop + Azure Virtual Desktop

2. Citrix Virtual Apps and Desktops

3. Apache Guacamole

4. BeyondTrust Remote Support

5. Cloudflare Access + Browser Isolation

6. Tailscale + tart/RDP

7. Splashtop Enterprise

8. Devolutions RDM + Password Vaulting

9. Xrdp + Jump Server + Teleport

10. QuickZTNA Remote Desktop (Workforce tier)

Comparison

Related reading

Try QuickZTNA Remote Desktop

Frequently asked questions