MFA and privileged access for every login your IdP can't see.
Bring your users from Active Directory or Entra ID, then add MFA to Windows, Linux, databases, network gear and apps — plus just-in-time access and recorded sessions for Linux servers.
Verify every login. Decide every request. Control every session.
One platform does all three, on the systems you already run.
MFA on every login
Every login waits for the user to approve it on the MFA app they already have, whichever identity source they come from.
j.doe → srv-fin-01 · held · approved · signed in
See MFAThe right check for every request
Allow, ask for MFA, or block based on who is asking, from where, and to which system. For domain logons, start in audit mode and enforce when ready.
admin · from VPN subnet → dc01 · MFA required
See access policyEvery admin SSH session recorded
Admin SSH sessions go through the gateway, password logins that skip it are refused, and every session is recorded.
j.doe → prod-web-02 · recorded · 3m 12s
See PAMOne control plane for every privileged login.
Your identity source and MFA app go in. AuthNull verifies, decides and controls. A small component at each system enforces it, and every decision is logged.
Click a system to trace its path
- One place for every policyRules for Windows, Linux, databases, network and apps, managed side by side.
- No standing Linux accessSSH accounts and sudo granted just in time, then removed.
- Nothing on workstationsComponents sit on DCs, a gateway and database hosts only.
- Every decision loggedAudit logs for every path; SSH gateway events stream to your SIEM.
Approve every login from your phone.
Every login AuthNull holds lands on the user's phone as one clear request, approved or denied in a tap.
- Context on every requestWho is signing in, from where, to which system, and how long is left to answer.
- One app for every pathThe same approval for Windows and SSH logins, VPN, databases, apps and the AuthNull console.
- Or keep the app you haveAlready on Duo or Okta Verify? AuthNull sends the push there instead.
Works on SaaS and self-hosted. How push MFA works
One platform across the systems you already run.
Users come from Active Directory or Entra ID. AuthNull protects every system they sign in to.
- SystemWindowsComponentDC Sensor · agentCoversDomain logons · Kerberos · NTLMJobsVerify · DecideProtect Windows
- SystemLinux & SSHComponentSSH gatewayCoversSSH · sudoJobsVerify · Decide · ControlProtect Linux & SSH
- SystemDatabasesComponentDB agentCoversPostgreSQL · MySQLJobsVerify · DecideProtect databases
- SystemNetworkComponentRADIUS BridgeCoversRADIUS · VPN · firewallsJobsVerify · DecideProtect your network
- SystemApplicationsComponentOIDC · SAML IdPCoversSSO · MFA APIJobsVerify · DecideSee it in a demo
Live without locking anyone out.
Roll out one path at a time, starting with domain logons in audit mode.
- Step 01: Install
Add the component for each path
DC Sensor for Windows domain logons, SSH gateway for Linux, DB agent for databases, RADIUS Bridge for the network.
DC Sensor · SSH gateway · DB agent · RADIUS Bridge
- Step 02: Audit
Watch before you enforce
Windows domain logons start in audit mode, so you see who would be challenged without blocking anyone.
- Step 03: Enforce
Turn it on when you’re ready
Switch a policy to enforce. Every decision is logged from day one.
A platform, not another layer.
Most teams stitch together an MFA tool and a PAM tool. AuthNull does both jobs in one platform.
Vaultless PAM vs full PAM
They do: MFA, access policy and just-in-time access on AD logins.
AuthNull adds: recorded admin sessions and a password vault in the same product.
Where they’re stronger: identity threat detection and cloud identity.
ComparePer-seat vs flat pricing
They do: MFA for apps, endpoints and AD, priced per user.
AuthNull adds: PAM in the same product: recorded sessions, just-in-time access and a password vault. It works with Duo, so you keep your app.
Where they’re stronger: the authenticator and device trust.
ComparePAM without the programme
They do: enterprise PAM, sold per module (now part of Palo Alto Networks).
AuthNull adds: recorded sessions, just-in-time access and vaulting, with MFA on AD, VPN and database logins in the same product.
Where they’re stronger: Windows privilege elevation and application secrets.
| Capability | AuthNull | Silverfort | Duo | CyberArk |
|---|---|---|---|---|
| MFA on AD logins | ✓ | ✓ | ✓Advantage & Premier | Separate product |
| Access policy | ✓ | ✓ | ✓ | ✓ |
| Session recording | ✓SSH | Not offered | Not offered | ✓ |
| Just-in-time access | ✓Linux | ✓Enterprise tier | Not offered | ✓ |
| Password vault & rotation | ✓ | Not offered (vaultless) | Not offered | ✓ |
Coverage based on public product information, October 2026. Some features vary by plan.
Self-hosted or SaaS. Flat pricing. A free month to try it.
Everything stays on your infrastructure.
Works with the MFA you already use: AuthNull Authenticator, Duo, Okta, TOTP or passkeys. Database MFA is available on SaaS. See supported factors
Book a demo
- You send the formTwo minutes: who you are and what you want to protect.
- We reply within a dayAn engineer emails you to pick a time.
- A live 20-minute demoShown against your setup, with time for questions.