Tailscale, the Toronto-based corporate VPN company, acquired Border0, a Vancouver startup that sells privileged access management (PAM) software, on March 17, 2026. It was Tailscale's first acquisition. Terms were not disclosed.
Border0's seven-person team joined Tailscale, BetaKit reported. Founder and chief executive Andree Toonk became Tailscale's director of engineering, working on the company's privileged access features.
Border0 said its product would keep running as before, with no immediate changes or migrations for customers, and that it would be folded more deeply into Tailscale over time.
What Border0 built
Border0 controls how engineers reach sensitive systems such as servers, Kubernetes clusters and databases. Its software covers SSH, Kubernetes, databases, web applications and remote desktop access, and adds session recording and visibility into the commands and queries people run. The aim is to replace a mix of VPNs, bastion hosts and shared static credentials.
Pennarun described Border0 as the application connectivity and authorization layer that sits on top of a network. For example, many companies let staff reach production databases through shared logins, which hides which person was actually connected. Border0 ties each connection to a real identity from a provider the company already uses, such as Google, Microsoft, GitHub or Okta, instead of shared passwords or connection strings.
Toonk wrote that the company started with a simple goal of making infrastructure access secure without making it painful. Border0 did not disclose its funding or name its investors in the announcement.
Before the deal, Border0 had already built a version of its product on Tailscale's software. Tailscale CEO Avery Pennarun wrote that he met Toonk at the RSA Conference in San Francisco in 2025, where Toonk showed an access system built on WireGuard. Pennarun suggested building it on Tailscale's tsnet library, and when the two met again at AWS re:Invent in November, Toonk showed a version fully integrated with Tailscale.
“When we started Border0, the goal was simple: make infrastructure access secure without making it painful.”
Why Tailscale is buying
Tailscale connects devices and servers into private networks. A spokesperson, Will Moore, told BetaKit the company already had basic PAM-style capabilities and that the deal would help it build a more complete offering faster. Border0 adds the application layer on top of Tailscale's connectivity: who gets access, when, and what happens during a session.
Pennarun wrote that this kind of access control is hard to add after the fact and hard to do well without making a product painful to use. Tailscale said Border0 can already run on customers' existing Tailscale networks, identities and policies, and that it plans to build a more native PAM product over time.
AI agents are part of the case. BetaKit reported that Tailscale's customer base had grown quickly since 2024 partly because companies use it to control how AI agents reach corporate data. Pennarun told Bloomberg that Border0's technology is meant to limit autonomous agents to the data they need and nothing more, The Logic reported.
Tailscale's growth
Tailscale was founded in 2019 by former Google engineers. It raised a $160 million Series C in April 2025 and planned to grow from about 250 to 400 employees over the following year, according to BetaKit. It said it would open a larger engineering office in Vancouver, where the Border0 team is based, and had not ruled out further acquisitions.
Pennarun said tens of thousands of customers already use Tailscale.
Pennarun had previously said Tailscale was considering an eventual stock market listing and could raise another funding round in the not-so-distant future, The Logic reported. He credited the AI boom with driving the company's growth.
What happened next
Tailscale moved quickly to sell the combined product. In June 2026 it began offering a free trial of Border0 alongside Tailscale, and in August 2026 it announced a beta of Tailscale PAM, which it said used the Border0 integration to give credential-free, identity-based access to critical infrastructure, with session logs and recordings and browser-based access for contractors and other outside users.
During the beta, administrators manage Border0 connectors, services, access policies and audit logs from the Tailscale admin console. Toonk said in March that the product fit between the two companies was obvious.
