Arbiter

Arbiter is a cloud-hosted network access-control service for deciding which wired and wireless devices may join a network and what they can do afterward. It suits SMEs and the MSPs or MSSPs managing them, especially where endpoint-agent-free discovery, identity-based access, and continuity during an internet outage matter. Its tiered endpoint pricing makes the right plan largely a question of whether you need visibility only or active enforcement at a particular scale.

Overview

Arbiter automatically discovers connecting devices and builds an inventory, classifying equipment by type and vendor without installing agents on endpoints. That gives administrators a practical view of what is appearing on the network, but the low-cost Asset Discovery plan stops at profiling and inventory; it cannot enforce access rules. Enforcement starts with the access-control tiers.

The service combines certificate-based EAP-TLS and 802.1X authentication with MAC authentication bypass for headless equipment. This is a useful mix for organizations that need strong identity checks for managed clients while still admitting devices such as printers or other systems that cannot perform a full 802.1X exchange.

Key features

Resilient authentication

Arbiter’s on-premises Edge appliance connects back to the cloud over RadSec and caches decisions locally. During a WAN outage it can continue authenticating devices, reducing the risk that an internet interruption becomes a site-wide access failure. RadSec can use mutual TLS for RADIUS traffic, adding protection to the authentication path.

Compliance and operations

The live Microsoft Intune integration reads device-compliance status and can move non-compliant devices into a remediation VLAN. That makes the product more useful for teams already governing Windows endpoints through Intune than for organizations without a comparable device-management process. Event forwarding covers Microsoft Sentinel, Elastic, TLS syslog, Splunk HEC, and generic HTTPS webhooks, so security teams can route access activity into existing monitoring workflows.

Arbiter says customer data is encrypted at rest with AES-256 on EU-hosted infrastructure. It records access-layer metadata rather than network payloads, a narrower data-collection approach for organizations concerned about inspection scope. The company describes the service as GDPR-native and aligned with NIS2 and DORA control objectives, with SOC 2 Type II in progress.

Pricing

A 60-day free trial is available, and the model is freemium. The plans below are billed monthly after the trial where stated; endpoint counts are the key capacity limit on the enforcement tiers.

Asset Discovery is inexpensive, but it is a monitoring purchase rather than a prevention tool. Essential is the entry point for quarantine and admission decisions; moving up buys endpoint headroom rather than a separately described feature set. Organizations above 1,500 endpoints will need to confirm capacity and commercial terms with Arbiter. Support is directed through [email protected].

Platforms

Arbiter is delivered as a web service with a hybrid deployment model. Wired and wireless access control, 802.1X, and the on-premises Edge appliance cover environments that need local network enforcement alongside cloud management.

Who it's for

SMEs can use Essential for a bounded network where 100 endpoints is sufficient, while Professional and Enterprise fit larger estates or MSP/MSSP portfolios. The Intune and SIEM integrations favor teams with established Microsoft compliance and security-monitoring workflows. Choose Asset Discovery when cataloging unknown devices is the immediate goal and enforcement can wait; do not choose it if unauthorized access must be blocked now.

Pros and cons

Pros

• Agent-free discovery classifies devices by type and vendor, giving administrators inventory without endpoint deployment.
• Edge caching preserves local authentication through a WAN outage, an important safeguard for connected offices.
• Intune quarantine and broad SIEM forwarding connect access decisions to remediation and security operations.
• EU hosting, AES-256 at rest, optional mutual-TLS RadSec, and payload-free metadata collection support privacy-conscious deployments.

Cons

• The €29 plan cannot enforce access, so prevention requires a substantial jump to the €149 Essential tier.
• Each enforcement plan has a fixed endpoint allowance, with the largest published tier capped at 1,500 devices.
• SOC 2 Type II is still in progress, which may matter to buyers requiring a completed attestation.

Alternatives

PacketFence is the stronger choice when you want a GPL v2+ self-hosted edition with unlimited devices, full source code, and broad platform support.

NACVIEW suits organizations seeking a lifetime free tier limited to 20 simultaneously authorized endpoints.

Arista NG Firewall is an option for basic security and connectivity through a free web-based plan with limited capabilities.

SecureW2 Cloud NAC is a paid alternative priced through a quote process and supports major desktop and mobile platforms.

EasyNAC is worth considering for a hardware or virtual appliance with perpetual or subscription licensing and concurrent-device billing.

NACIO is another paid choice with macOS, Windows, and self-hosted deployment options.

Auconet BICS is a paid, self-hosted or API-oriented alternative sold through an information request.

Cloudi-Fi Cloud NAC is a paid web service with pricing supplied by quote.

For a broader comparison, see Network Access Control Software.

Verdict

Arbiter is a good fit for SMEs and their service providers that want cloud-managed NAC, agent-free discovery, Intune-aware quarantine, and authentication that can survive a WAN outage. Choose it when those operational connections justify the monthly endpoint tiers; look elsewhere if you need open-source self-hosting, a lifetime free allowance, or capacity beyond the published 1,500-endpoint Enterprise plan.