Check Point

What Is Check Point?

Remote access is easy right up until you have to trust it. Once you’re responsible for connecting employees, contractors, and devices into internal apps (and not just “giving them a VPN”), the messy parts show up fast: identity integration, device posture, split tunneling rules, logging, and keeping traffic policies consistent across locations.

Check Point’s modern answer to that problem is its cloud-delivered remote-access stack under Harmony SASE (formerly Perimeter 81, acquired by Check Point) and related remote-access components. In practice, this sits closer to “SASE / ZTNA for businesses” than a consumer VPN: you deploy an agent, tie it to your identity provider, define access and security policy centrally, and connect users to private resources and/or route internet traffic through security controls.

What’s distinctive (and what many teams care about most) is that Check Point positions this as one platform that can do both user-to-site remote access (agent VPN) and network-to-site connectivity (site connectors/tunnels), using multiple protocols depending on the connection type—rather than bolting a “VPN feature” onto a firewall and calling it done.

Check Point Features and Performance

At the connectivity layer, the real-world story depends on which Check Point product you’re actually using. For the cloud-delivered Harmony SASE agent, Check Point’s own admin documentation says the agent offers WireGuard and OpenVPN, with the default typically set to WireGuard.
For network-to-site connectivity (connecting a site, data center, or network into the SASE fabric), Check Point’s SASE datasheet lists IPsec IKEv1, IPsec IKEv2, WireGuard, and OpenVPN as supported protocols.

From your database (verified), VPNSpotter should treat these as supported:

• WireGuard
• OpenVPN
• IPsec IKEv1
• IPsec IKEv2

Those specs match Check Point’s own SASE datasheet split: user-to-site (agent): WireGuard/OpenVPN and network-to-site: IPsec IKEv1/IKEv2 plus WireGuard/OpenVPN options.

On performance characteristics, Check Point is explicit—at least at the marketing/datasheet level—about trying to avoid the “hairpin everything through the cloud” bottleneck. Their SASE datasheet describes an on-device / hybrid enforcement option where some internet security controls can be enforced in the agent (subject to policy) so traffic can route directly to the internet instead of being backhauled, positioned as a way to preserve user experience.

For private access, Check Point also describes a global private backbone with multiple tier-1 links at points-of-presence (PoPs), reserved bandwidth, and peering agreements—again, a performance claim tied to architecture (how they move traffic), not a promise of a specific speed number.

Policy and access control are central to why businesses pick this category at all. Check Point markets Private Access around granular, zero-trust-style policies and segmentation, and positions it as part of a broader SASE platform (with centralized management via Check Point’s portal).

If you’re comparing this to “classic VPN appliances,” note that Check Point’s own community discussions have historically highlighted protocol differences across product lines. For example, a Check Point community thread (about Quantum/Spark appliances, not SASE) states WireGuard was not supported on Quantum appliances at that time—reinforcing that “Check Point VPN” isn’t one single thing and you need to map features to the product family you’re deploying.

Pricing and Plans

Check Point’s business VPN/SASE pricing is not “one price on a public webpage” in the way consumer VPNs are. In many channels it’s sold via partners/marketplaces, and the same product can appear with different packaging (Internet Access vs Private Access; Essentials/Premium/Complete; per-user plus optional gateways).

What can be stated with confidence from public sources:

• Subscription billing exists, and you can manage billing methods (credit card/PayPal) in the admin portal documentation.
• The Harmony SASE admin guide states a 30-day full refund if you cancel within 30 days of activating your account, and that after cancellation you retain access until the end of the current subscription period.

Exact per-user prices vary by source/channel. For example:

• An AppDirect marketplace listing shows per-user/month pricing for specific editions (for example, Internet Access Essentials and Private Access tiers) with different rates by user count and contract term.
• AWS Marketplace lists Harmony SASE Internet Access in 100-user units with pricing that depends on contract duration and package (and shows substantially higher totals because it’s sold as a 100-user block with package distinctions).

Because marketplace pricing can be channel-specific, and because vendors/partners can negotiate, the safest “No BS” summary is: expect per-user subscription tiers and optional gateway/connector costs in some packages, plus discounts for longer contract terms.

Privacy and Security Assessment

Jurisdiction: Your verified data says jurisdiction is Israel. For privacy assessment, that matters more for consumer VPN threat models than for enterprise remote access, but it’s still relevant: Israeli jurisdiction is not the same thing as “privacy-unfriendly by default,” yet it does mean you’re outside EU-only regimes and inside a country with its own lawful access framework. For some organizations (regulated industries, government contracting, strict data-sovereignty requirements), jurisdiction alone can be a blocker.

Logging and audits: In the sources reviewed here, Check Point publishes extensive documentation about protocols, deployment, and admin controls, but we did not find a clear, unequivocal public statement in the cited sources about a “no-logs” posture comparable to consumer VPNs, nor a specific independent “no-logs audit” claim for Harmony SASE that can be cited cleanly. When a product is designed for businesses, logs are often a feature, not a liability—so you should assume administrative logging and audit logs are part of the product’s value unless your contract and configuration say otherwise. (The Harmony SASE datasheet mentions activity monitoring and audit logs in partner collateral, but the exact retention and contents are something you should verify in your tenant settings and contract.)

Protocol/security posture: For the agent, the official admin docs describe WireGuard and OpenVPN as the VPN protocols available, with WireGuard commonly the default. That’s a modern baseline.
For network-to-site tunnels, the datasheet lists IPsec IKEv1/IKEv2 in addition to WireGuard/OpenVPN options. This matters when you need interoperability with existing routers, SD-WAN, or third-party gateways.

Open-source posture: Nothing in the cited official sources states that the client/agent is open source. If open-source clients are a hard requirement, you should treat this as a likely mismatch unless Check Point provides a verifiable open-source client or reproducible builds statement.

Known incidents: No specific, well-documented public incidents about Harmony SASE “logging failures” or “data leaks” were found in the sources cited here. That doesn’t prove an absence of incidents; it just means we’re not going to invent them.

Strengths and Limitations

Strengths

• Protocol coverage where it counts: WireGuard/OpenVPN for the user agent, plus IPsec IKEv1/IKEv2 for network-to-site connectivity (per Check Point’s SASE datasheet, aligning with your verified specs).
• Clear admin-level control of protocol selection (agent can be set to default or switched, controlled by policy).
• Architecture aimed at user experience, including hybrid/on-device enforcement options described by Check Point for internet access use cases.
• Documented 30-day refund window (cancel within 30 days of activation for a full refund) in official admin documentation.

Limitations

• Not a consumer VPN. If your goal is anonymous browsing, minimal logging, or a “no account admin” setup, this is the wrong category.
• Pricing transparency is channel-dependent. Public prices exist in marketplaces, but you should expect quotes/tiers and potentially add-ons depending on package and contract.
• IPsec is not the agent’s protocol set in the official SASE agent docs; the agent focuses on WireGuard/OpenVPN, so if you require native IKEv2 clients for endpoints specifically, validate fit before committing.

Who Should Use Check Point?

Good fit

1. SMBs to mid-market IT teams that want “business VPN + policy + identity” in one managed platform, and are fine deploying an agent and managing users centrally.
2. Organizations migrating from appliance-centric VPNs that need cloud-managed remote access plus site connectivity using standard protocols (including IPsec IKEv1/IKEv2 for network-to-site).
3. Teams that care about performance architecture, where avoiding unnecessary backhaul and having a global backbone is part of the buying criteria (at least as described by the vendor).

Not a good fit

1. Individuals shopping for a privacy VPN (torrenting, geo-unblocking, “no logs,” anonymous payment). The product’s design goals are enterprise access and policy, not consumer privacy.
2. Teams that require fully open-source clients/agents or want to bring their own open-source client across all endpoints without vendor software.
3. Environments that require endpoint IKEv2/IPsec specifically via the same SASE agent (the agent docs emphasize WireGuard/OpenVPN; IPsec appears on the network-to-site side).