Security
Elisity Connect: A VPN Client Where the Hard Part Is the Operating System
Prepared by Jishnu M
Photograph by Jared Brashier on Unsplash
Most software fails in ways the user can shrug at. A page loads slowly, a button is in the wrong place, a report takes a moment. Security software does not have that latitude. A VPN client either carries every packet or it silently leaks the ones it missed, and the second failure looks exactly like success from the outside.
We built Elisity Connect, the VPN client for Elisity's platform, for both macOS and Windows.
The Challenge
The protocol is the easy part. What makes this category difficult is that a VPN client is not really a networking application — it is a piece of privileged system software that has to earn its place inside two operating systems with entirely different ideas about what that means.
It runs with privilege, which changes everything. Creating a virtual interface, altering routing tables and capturing traffic are not things an ordinary application may do. The code that does them runs at a level where a defect is not a crash but a security problem, and where the operating system vendor is actively narrowing what is permitted with each release.
The two platforms are not two implementations of one design. macOS and Windows differ in how virtual interfaces are created, how privileged components are packaged, signed and loaded, how they are permitted to persist, and what a user must approve before any of it will run at all. Sharing the protocol logic across both is straightforward. Sharing the part that touches the system is not, and pretending otherwise produces something that works properly on one platform and approximately on the other.
The failure mode is silence. A tunnel that drops without the traffic stopping is the worst outcome in this product category — the user believes they are protected, and nothing on screen says otherwise. Everything about how the client behaves when it loses its footing has to be decided deliberately rather than inherited from whatever the network stack happens to do.
The environment is hostile by accident. Corporate laptops are already carrying endpoint protection, other VPNs, filtering agents and device management, several of which want the same hooks into the network stack. A client that only works on a clean machine does not work.
What We Built
Elisity Connect: the client through which a user's device reaches Elisity's platform, on macOS and on Windows.
A shared core, and two honest platform layers. Protocol handling, state management, configuration and the connection lifecycle are common. Everything that touches the operating system — the virtual interface, routing, privileged execution, installation and update — is written natively for each platform, because the abstraction that would have unified them is exactly where the bugs would have lived.
Privileged components built to each platform's rules. Each operating system has its own model for what privileged software must look like: how it is signed, how it is packaged, what it may do, and what the user has to approve. Both were built to their own model rather than to a compromise between them.
Deliberate behaviour on failure. What happens when a tunnel drops, when the network changes underneath it, when a laptop wakes from sleep on a different Wi-Fi network — these are the moments that decide whether a VPN client is trustworthy, and each was designed rather than discovered.
An interface that stays out of the way. The right amount of attention for a VPN client is almost none: connected or not, and an honest answer when something is wrong. Anything more is asking a user to supervise infrastructure.
The Approach
Treat privileged code as a smaller problem than it wants to be. The amount of software running with elevated rights was kept as small as we could make it. That is more work than putting the logic where it is convenient, and it is the difference between a defect being a bug and a defect being a vulnerability.
Never fail open, and never fail quietly. In this category the safe direction is to stop carrying traffic and say so, rather than to keep going and hope. That is a product decision as much as an engineering one and it has to be made explicitly.
Test on machines that are already a mess. Clean virtual machines prove almost nothing here. What matters is the laptop that already has three other agents installed, has been through two operating system upgrades, and is on a network that does something unusual.
Follow the platforms, because they move. Both Apple and Microsoft keep changing what privileged software may do and how it must be built. A client of this kind is not finished when it ships; staying current with those rules is a permanent part of owning it.
The Result
Elisity raised a $37M Series B. We built the client their customers install.
The reason this engagement is worth describing is not the protocol — it is that a security company chose an outside team for the code that runs with privilege on their customers' machines. That is a narrow thing to be trusted with, and it is a different claim from having built an application.
The same discipline runs through how we approach security and data boundaries, and it belongs to our wider product engineering practice. If you have a product where the hard part is the operating system rather than the feature list, tell us what you are building.
Have a system that needs to do this?
500+ systems shipped since 2011, and we still maintain most of them. Tell us what you are trying to move.
