Executive Summary
An MFT server is an internet-facing system full of other people's sensitive data. Choose it the way you would choose any other system an attacker will try first.
Much business data still moves as files: payroll to providers, claims to insurers, orders to suppliers, statements from banks. Managed file transfer software runs that exchange with encryption, partner accounts, automation, retries and a record of every file that moved. It replaces ad hoc FTP servers and scripts that nobody owns.
Because MFT servers face the internet and hold sensitive data from many parties, they have been targeted repeatedly. That changes how to evaluate them. Alongside protocols and automation, weigh who operates and patches the system, how quickly the vendor fixes vulnerabilities, and how much damage a compromise of the server could do. The approaches in this guide differ most on exactly those points.
Why File Transfer Became a Security Decision
A single criminal group has targeted file transfer systems from several vendors in turn. CISA states that in a 2020 to 2021 campaign TA505 used zero-day exploits to install a web shell on internet-facing Accellion FTA servers. CISA states that in late January 2023 the CL0P ransomware group used a zero-day vulnerability, CVE-2023-0669, to target the GoAnywhere MFT platform, with approximately 130 victims claimed over 10 days. CISA states that, according to open source information, beginning on May 27, 2023, the CL0P Ransomware Gang began exploiting a previously unknown SQL injection vulnerability, CVE-2023-34362, in Progress Software's MOVEit Transfer.
The lesson from these campaigns is not that one product is unsafe. It is that any internet-facing transfer system concentrates data from many parties in one place, and that zero-day vulnerabilities in such systems have been exploited at scale. The practical controls are the same whichever product you choose: keep as little data on the server as possible, restrict who can reach its interfaces, monitor it closely, and be able to patch it within hours.
Product architecture now reflects that history. Kiteworks states that Kiteworks MFT uses a hardened virtual appliance with an assume-breach design, centralized policy enforcement across channels and a unified audit log with automated SIEM feeds. Files.com states that there is nothing to install or patch and that customers get a record of every file that moves. Ask each vendor how its design limits the impact of a vulnerability, and how quickly past vulnerabilities were fixed.
Who Runs the Server
An SFTP server run with scripts is the arrangement with the least control: no central record, no partner management, and patching that depends on whoever set it up. The decision is between running MFT software yourself and using a service that runs it for you.
Self-hosted software gives full control over where data sits. Progress states that MOVEit is a Windows Server application that can run on-premises or in Azure, and is also available as a service hosted by Progress in the Azure Cloud. Cloud providers offer managed endpoints: Amazon Web Services states that Transfer Family provides fully managed file transfer server endpoints supporting SFTP, FTPS and FTP. A managed service moves patching to the provider; it does not remove the need to restrict access and monitor use.
| Model | What you get | What you take on |
|---|---|---|
| Self-hosted MFT software | Full control of data location and configuration | Patching, hardening and monitoring the server |
| Vendor-hosted MFT | The same product run by the vendor | Dependence on the vendor's operations and response |
| Cloud-native MFT service | Endpoints and automation with nothing to install | Data in the provider's cloud and its limits |
| Cloud provider endpoints | Managed SFTP, FTPS and FTP into cloud storage | Building partner management and automation yourself |
| B2B integration platform | File transfer alongside EDI, APIs and partner onboarding | A broader platform to adopt and operate |
How do you evaluate Managed File Transfer (MFT)?
Evaluate these products on security, partner operations and automation. Security covers encryption, access control, hardening, monitoring and the vendor's vulnerability record. Partner operations cover onboarding, protocols and self-service. Automation covers scheduled and event-driven transfers, retries, transformations and alerts.
Automation removes the scripts that make file transfer fragile. Progress states that MOVEit Automation provides workflow automation without scripting across MOVEit Cloud, MOVEit Transfer, hybrid cloud endpoints and FTP systems. For organizations with many trading partners, onboarding is the bottleneck: SEEBURGER states that the SEEBURGER BIS Platform enables MFT capabilities and includes centralized monitoring, community management and self-service onboarding with automated workflows.
| Capability | What it does | Buyer translation |
|---|---|---|
| Protocol support | SFTP, FTPS, HTTPS, AS2 and others | Match it to your partners' requirements, not a feature count. |
| Encryption and access control | Protects data in transit and at rest | Progress states that MOVEit encrypts data at rest and in motion and provides IT security controls for sensitive business data. |
| Hardening and exposure | Limits what an attacker can reach | Ask about gateways, reverse proxies and admin interface exposure. |
| Audit trail | Records every transfer and change | Needed for compliance and for investigating an incident. |
| Partner onboarding | Adds and manages external parties | Self-service onboarding scales to many partners. |
| Automation | Runs transfers on schedules and events | Replaces unmanaged scripts and cron jobs. |
| Policy across channels | Applies the same rules to email, SFTP and web | Kiteworks states that it enforces one Data Policy Engine across email, SFTP, web forms and desktop sync. |
| Vulnerability response | How fast the vendor fixes and notifies | Ask for the record of past advisories and patch times. |
Vendors in Managed File Transfer (MFT)
Representative vendors include Amazon Web Services, Cerberus FTP, Files.com, Kiteworks, Progress and SEEBURGER. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The approaches below differ by who runs the server and what surrounds the transfer. Several vendors offer both self-hosted and hosted options, so each approach describes where a product is designed to be strongest.
Some MFT products now sit inside broader integration platforms. A request for thruinc.com is answered by boomi.com. SEEBURGER states that SEEBURGER BIS is a cloud-native platform that connects everything from B2B/EDI and MFT to APIs, SaaS-to-SaaS and ERP systems. If file transfer is one of several integration needs, a platform that covers them together may be simpler to run than separate products.
| Vendor | Approach | Where it fits |
|---|---|---|
| SEEBURGER | B2B integration with MFT | MFT alongside EDI, APIs and partner onboarding |
| Amazon Web Services | Cloud provider endpoints | Managed SFTP, FTPS and FTP endpoints into AWS storage |
| Files.com | Cloud-native MFT | Managed endpoints, sharing and automation with nothing to patch |
| Progress | Enterprise MFT | MOVEit, self-hosted or hosted by Progress, with automation |
| Kiteworks | Governed data exchange | A hardened appliance with one policy across file channels |
| Cerberus FTP | Self-hosted transfer servers | A per-server licensed transfer server for secure protocols |
One representative of each approach is named here; the field runs to about twenty vendors, and several span camps. Approaches were defined before representatives were chosen, and being listed cannot be bought. File transfer vendors, named here or not, can make their case in the Spotlight below.
How much should you budget for Managed File Transfer (MFT)?
MFT is priced by server, by user and connection, by usage, or by a platform subscription, and the unit decides how cost grows. Cerberus FTP states that Cerberus FTP Server requires an annual subscription license, licensed per server, with no additional purchases to add connections or users. Amazon Web Services states that Transfer Family has no upfront costs and charges for the protocols enabled on server endpoints, the data transferred over SFTP, FTPS or FTP, AS2 messages, and data processed by Transfer Family workflows.
Published starting prices show the range. Files.com states that its platform starts at $199/month. Files.com lists a plan priced from $10k to over $1M annually, sized to usage, whose base quote includes the SLA, HIPAA BAA, multi-region storage and full onboarding. Model a year of your partners, users and volumes against each unit before comparing.
| Meter | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Per server | Each installed server | Environments and redundancy | Separate licenses for test and failover |
| Users and connections | People and partner accounts | Partner count | Every new partner becomes a cost |
| Usage | Protocol hours, data and messages | Volume | Always-on endpoints charged around the clock |
| Platform subscription | A tier of capacity and features | Moving up tiers | Security features such as SSO in higher tiers |
| Services | Onboarding and support | Complexity | Partner migration work not in the quote |
How long does implementation take for Managed File Transfer (MFT)?
File transfer migrations depend on the partner side: credentials, IP allow-lists, key exchanges and file naming that nobody documented. Inventory the flows before moving any of them.
List every file flow: partner, direction, protocol, schedule, data sensitivity and owner. Flows without an owner are the first finding.
Deploy with restricted access to admin interfaces, minimal retention and monitoring. Move a few low-risk flows and test failure and retry.
Move partners in waves, coordinating credentials and keys. Run old and new in parallel only as long as needed, then shut the old server.
Patch on a defined clock, review access and retention quarterly, and test the response to a vendor advisory.
What should you ask vendors about Managed File Transfer (MFT)?
Ask each vendor to answer on your partners, protocols and data.
-
Do you exchange files with many trading partners, including EDI or AS2?Yes Shortlist B2B integration platforms with MFT or enterprise MFT.No A simpler service or server may fit; continue.
-
Do you want to stop running and patching the server yourself?Yes Shortlist cloud-native MFT or vendor-hosted options.No Self-hosted MFT or a transfer server keeps control in-house.
-
Are the files highly sensitive or regulated?Yes Weight hardening, policy across channels and audit evidence.No Weight automation and partner self-service.