Top 12 MOVEit Alternatives

We reviewed the leading alternatives to MOVEit in the secure file transfer market, based on protocol support, verified product capabilities, and user reviews.

MOVEit alternatives comparison

Ratings are based on Capterra, Gartner, and G2. We listed vendors based on the number of reviews. Our sponsors are at the top with their links.

We gathered the workforce numbers from companies’ LinkedIn pages.

Note: Every tool on this list supports SFTP and FTPS. Support for HTTPS, plain FTP, and B2B protocols such as AS2 varies by vendor.

Progress MOVEit

MOVEit has a long track record in enterprise file transfer, but several factors make it worth comparing against alternatives before committing.

Vendor financial position

Despite the 2025 stock decline, Progress raised its FY2026 guidance to $1.044–$1.052 billion in revenue and $6.15–$6.23 in non-GAAP diluted earnings per share, an increase of more than $50 million in revenue over prior guidance driven by the Domo acquisition, which closed during the third quarter.¹

The underlying business is slowing, however: Q3 FY2026 revenue of $246 million declined 2% year over year, and annual recurring revenue of $873 million grew just 1% in constant currency, against a 15% ARR compound annual growth rate over the prior five years.¹

Security incidents

In 2026, Progress disclosed additional critical vulnerabilities in MOVEit Automation: CVE-2026-4670, an authentication bypass rated CVSS 9.8, and CVE-2026-5174, a privilege-escalation flaw rated CVSS 8.8; both published on April 30, 2026 and chainable to give unauthenticated attackers administrative control.² Progress fixed them in MOVEit Automation 2025.1.5, 2025.0.9, and 2024.1.8, with no in-the-wild exploitation confirmed at disclosure.³

A further flaw, CVE-2026-8650, published July 9, 2026, is a medium-severity (CVSS 4.5) relative path traversal in the Admin Settings module that lets an authenticated administrator read files outside the intended directory.⁴

On October 14, 2026, Progress patched twelve high-severity MOVEit Transfer vulnerabilities, including CVE-2026-89067, an authentication bypass in the Secure Messaging component rated 8.8; CVE-2026-89068, a missing-critical-step authentication flaw rated 8.1; CVE-2026-87093, an incorrect permission assignment rated 8.8; and CVE-2026-89069, a cross-site scripting issue, several of which could allow MFA bypass, with fixes in 2025.1.6 and 2026.0.4.⁵

Pricing

Tiered licensing and add-on modules make costs unpredictable, particularly for smaller organizations.

Product direction

Progress announced Automate MFT in October 2025 as a cloud-native orchestration engine purpose-built for automated, secure file transfer. Features include agent pooling, enterprise access, and endpoint connectors.

Progress states the service is audited for SOC 2 Type 1 and HIPAA and is GDPR-ready. Progress has also added an entry-level Foundation tier for lower-usage deployments alongside its higher usage-based tiers.

Setup complexity

Initial configuration requires more technical expertise than most alternatives.

MOVEit alternatives analyzed

JSCAPE MFT

Cross-platform MFT server for multi-protocol trading-partner exchange. Part of Redwood’s portfolio alongside RunMyJobs.

• Protocols: SFTP, FTP/S, SCP, HTTP/S, AS2, OFTP2, WebDAV, AFTP (proprietary accelerated protocol)
• Deployment: On-premises, cloud, hybrid, MFTaaS; Windows, Linux, Solaris, macOS
• Security: FIPS 140-2 and 140-3 validated encryption, SOC 2 Type 1 and Type 2, ISO 27001, Drummond-certified AS2, SSO
• Automation: Web-based workflow automation with triggers; native integration with Redwood RunMyJobs
• Availability: Load balancing and high availability across servers
• Perimeter: MFT Gateway reverse proxy
• Integrations: AWS S3, Azure Blob Storage, Google Cloud Storage

Stonebranch

The MFT component of Stonebranch’s Universal Automation Center (UAC).

• Protocols: SFTP, FTPS, HTTPS, AS2
• Deployment: On-premises, cloud, SaaS; containerized agents on Kubernetes and OpenShift
• Security: HSM support for key protection, ICAP antivirus scanning with quarantine
• Automation: Completed transfers publish events with file metadata to UAC workflows; file arrival monitoring; multi-step workflow chaining
• Availability: Active-active clustering
• Integrations: Bidirectional ServiceNow CMDB integration; mainframe and cloud connectivity through UAC

Files.com

Cloud-hosted MFT and file-sharing service. The vendor runs all protocol endpoints.

• Protocols: SFTP, FTPS, FTP, SCP, WebDAV, AS2, S3-compatible endpoint, REST API
• Deployment: SaaS only. An on-premises Agent connects outbound to local drives, NFS/SMB/CIFS shares, and SAN storage.
• Security: AES-256 end-to-end, customer-managed keys on Enterprise, PGP/GPG, SAML SSO, SCIM, MFA; SOC 2 Type II, HIPAA BAA, GDPR DPA
• Automation: Visual workflow builder, event and scheduled triggers, webhooks, CLI, SDKs
• Availability: Vendor-managed; files up to 5 TB with resumable transfers
• Integrations: S3, Azure Blob, GCS, SharePoint, Google Drive, Dropbox, Box, OneDrive; data residency in seven regions
• Pricing: Basic $199/month (10 users), Standard $499/month, Enterprise on request

Diplomat MFT by Coviant Software

Self-hosted MFT focused on no-code transfer automation.

• Protocols: SFTP, FTPS, HTTPS, AS2. Automation jobs also cover FTP, HTTP, email, SMB/CIFS, and NFS.
• Deployment: On-premises or customer-owned cloud; Windows, Linux. Runs on Java 25 LTS and Tomcat 11.0.26.
• Security: Built-in OpenPGP, including in-browser PGP encryption of Web Transfer Portal uploads (Professional add-on, included in Enterprise).
  • TOTP for admins and for Web Transfer users per user or group.
  • SSO and LDAP, IP access rules, and Threat Intelligence IP reputation blocking with an override list for verified partners on shared cloud IPs.
  • Configurable SSH key exchange, signature, cipher, HMAC, and compression algorithms, with deprecated options off by default. Checksum integrity checks.
• Automation: No-code jobs with time- and event-based triggers, folder monitoring, Quartz cron expressions, business calendars, conditional routing, checkpoint restart, webhooks, and a REST API.
• AI access: Read-only MCP Server (Enterprise). MCP clients such as Claude, ChatGPT, or Gemini can query configuration, job history, and audit data. Each client authenticates with its own API key bound to an Admin Role. The server has no write operations and no access to file contents.
• Perimeter: Edge Gateway in the DMZ, with no credentials or files stored there and no inbound holes in the internal firewall. Remote Agents serve branch locations.
• Integrations: AWS S3, Azure Blob, Google Cloud, Oracle Cloud, Dropbox, SharePoint.
• Pricing: Standard $335/month, Professional $710/month, Enterprise $1,085/month, billed annually ($3,999 / $8,499 / $12,999). The MCP Server is included in Enterprise.

Cerberus by Redwood

Windows-native secure file transfer server, licensed per server with unlimited users.

• Protocols: FTP, FTPS/FTPES, SFTP, SCP, HTTP/S
• Deployment: Self-hosted on Windows Server, on-premises or on cloud VMs; Windows only
• Security: FIPS 140-2 validated crypto, TLS 1.3, two-factor authentication, IP auto-blocking, AD/LDAP, SAML SSO
• Automation: Event manager with alerts and sync tools; no scripting required
• Availability: Not native; available through the Cerberus + MFT Gateway bundle
• Perimeter: MFT Gateway reverse proxy (part of the same bundle)
• Pricing: Enterprise $3,499/year, Enterprise Plus $7,949/year

Cleo Integration Cloud

Cloud B2B integration platform that combines MFT with EDI translation.

• Protocols: AS2, AS4, OFTP2, SFTP (client and server), FTP/S, email, UDP/pTCP acceleration
• Deployment: Cloud, with the CIC Agent installed on-premises for cloud-to-ground connectivity. Cleo Harmony is Cleo’s separate on-premises product.
• Automation: EDI mapping and transformation, partner onboarding, end-to-end B2B flows into back-office systems
• Availability: Vendor-managed
• Integrations: S3, Azure Blob, GCS; pre-built API and EDI integrations for ERP, TMS, and WMS

GoAnywhere MFT (Fortra)

Broad-platform MFT with project-based workflow automation.

• Protocols: SFTP, FTPS, FTP, SCP, HTTP/S, AS2, AS3, AS4, PeSIT, MQ/JMS, SMTP/POP3/IMAP
• Deployment: On-premises, cloud (EC2, Azure), hybrid, MFTaaS; Windows, Linux, UNIX, AIX, IBM i, Solaris, HP-UX, macOS, Docker
• Security: OpenPGP, ZIP with AES, ICAP for DLP and antivirus, Kerberos; Drummond-certified AS2 and AS4
• Automation: Project workflows; monitoring of SFTP, FTP/S, S3, and Azure Blob servers for new or changed files; REST tasks
• Integrations: Dropbox, SharePoint, Salesforce, Azure Blob, S3, WebDAV

Kiteworks

MFT delivered as part of a broader governed data-exchange platform on a hardened virtual appliance.

• Protocols: SFTP, FTPS, AS2, HTTPS
• Deployment: On-premises, private cloud, hybrid, FedRAMP-authorized hosting
• Security: AES-256, FIPS 140-2; FedRAMP, ISO 27001, SOC 2 Type II; built-in DLP, ATP, and CDR; Drummond-certified AS2 (Secure MFT Server v9.4)
• Automation: Scheduling, workflow creation, partner onboarding, graphical monitoring
• Integrations: SIEM reporting

Globalscape EFT (Fortra)

Modular Windows MFT server, licensed per instance, with features sold as add-on modules.

• Protocols: SFTP, FTPS, HTTPS; AS2 through a separate module
• Deployment: Self-hosted on Windows Server, on-premises or on cloud VMs
• Security: OpenPGP module, ICAP inspection, SAML and RSA SecurID (Advanced Authentication module)
• Automation: Event Rules, Folder Monitor and Timer triggers, drag-and-drop Advanced Workflow Module
• Availability: Active-active behind a load balancer, or active-passive cluster
• Perimeter: DMZ Gateway with outbound-initiated connections; no inbound connections to the internal network

Serv-U Managed File Transfer Server

Self-hosted file transfer server with web and mobile ad-hoc sharing.

• Protocols: FTP, FTPS, SFTP, HTTP, HTTPS over IPv4 and IPv6. No AS2.
• Deployment: On-premises; Windows, Linux (RHEL 8, Rocky Linux 8)
• Security: FIPS 140-2 validated crypto, automatic IP lockouts, AD/LDAP, MFA
• Automation: Event-driven actions, rules that move files by name or size, scheduled sending
• Availability: Active-active web farm of up to five servers or three gateways
• Perimeter: Serv-U Gateway
• Integrations: AD/LDAP; optional external database

SFTP To Go

Fully managed hosted SFTP service on AWS, with built-in storage backed by Amazon S3.

• Protocols: SFTP, FTPS (explicit, passive), HTTPS web portal, optional Amazon S3 API. No AS2.
• Deployment: SaaS only
• Security: AES-256 in transit and at rest, two-factor authentication
• Automation: Management API, webhooks on file creation and change, S3 API scripting
• Availability: Vendor-managed (S3-backed storage)
• Integrations: Heroku add-on; custom SFTP/FTPS domains on higher tiers
• Storage: 20 GB to unlimited, depending on plan

Couchdrop

Cloud SFTP/FTP service that adds protocol endpoints on top of existing storage.

• Protocols: SFTP, FTPS, FTP, SCP, Rsync, S3.
• Deployment: SaaS only
• Security: Encrypted transfers, audit logging, option to disable insecure protocols such as plain FTP
• Automation: Rules triggered on file arrival, email-to-storage retrieval, JSON API
• Availability: Vendor-managed
• Integrations: 20+ storage platforms (Google Workspace, SharePoint, Dropbox, Azure Blob, S3, GCS, external FTP/SFTP servers, on-premises file servers), or Couchdrop’s S3-backed hosted storage

FAQs

Don’t miss our benchmarks and data-driven insights. The button opens Google; selecting AIMultiple confirms that you wish to see AIMultiple more often in Google search results.

Add as preferred source

Further Reading

• Top 8 Managed File Transfer (MFT) Solutions
• Top 10 GoAnywhere Alternatives Based on 1,000+ Reviews
• Top 4 Globalscape Alternatives Based on 500+ Reviews

Cite this research

Pick the format that matches where you're publishing. Pasting the link version into your CMS preserves the backlink.

@misc{dilmegani2026,
  author = {Dilmegani, Cem and Ermut, Sıla},
  title  = {{Top 12 MOVEit Alternatives}},
  year   = {2026},
  month  = oct,
  howpublished    = {\url{https://aimultiple.com/moveit-alternatives}},
  note   = {AIMultiple. Retrieved October 27, 2026}
}

Changelog

9 updates

202620252024

1. Apr 17

   Added Files.com as a new alternative, plus pricing figures for JSCAPE, Diplomat MFT and Stonebranch's AS2 features.

2. Apr 3

   Replaced the Files.com entry with Diplomat MFT by Coviant Software, including its key features list.

3. Feb 19

   Updated the "Progress MOVEit: Current Situation" section with new details on the 2023 MOVEit breach litigation and Progress Software's financial position.

4. Jan 12

   Added Stonebranch and Files.com to the Top 6 MOVEit Alternatives Analyzed section.

Reference Links

1.

https://www.sec.gov/Archives/edgar/data/0000876167/000087616726000110/exhibit991-q32026earningsr.htm

2.

May 5 Advisory: Progress MOVEit Automation Authentication Bypass [CVE-2026-4670] - Censys

Censys

3.

Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670) - Help Net Security

4.

NVD - Home

5.

Progress Patches 12 MOVEit Transfer Vulnerabilities

Daily CyberSecurity

Cem Dilmegani

Principal Analyst

Follow On

Cem has been the principal analyst at AIMultiple since 2017.

Cem's work at AIMultiple has been cited by leading global publications including Business Insider, Forbes, Morning Brew, and Washington Post, global firms like Deloitte and HPE, NGOs like World Economic Forum, and supranational organizations like European Commission. [1], [2], [3], [4], [5]

Throughout his career, Cem served as a tech consultant, tech buyer and tech entrepreneur. He advised enterprises on their technology decisions at McKinsey & Company and Altman Solon for more than a decade. He also published a McKinsey report on digitalization.

He led technology strategy and procurement of a telco while reporting to the CEO. He has also led commercial growth of deep tech company Hypatos that reached a 7 digit annual recurring revenue and a 9 digit valuation from 0 within 2 years. Cem's work in Hypatos was covered by leading technology publications like TechCrunch and Business Insider.

Cem regularly speaks at international technology conferences. He graduated from Bogazici University as a computer engineer and holds an MBA from Columbia Business School.

View Full Profile

Researched by

Sıla Ermut

Industry Analyst

Follow On

Sıla Ermut is an industry analyst at AIMultiple covering AI models, AI infrastructure, AI governance, and enterprise AI applications. Her research focuses mostly on the use of AI in marketing, healthcare, supply chains, and sustainability.
She previously worked as a recruiter in project management and consulting firms. Sıla holds a Master of Science degree in Social Psychology and a Bachelor of Arts degree in International Relations.

View Full Profile

Be the first to comment

Your email address will not be published. All fields are required. Comments are left in their original language.

Name

Email Address

Comment

0/450

Post Comment