Infrastructure & Reliability · Middleware — File transfer · Chapter 33 of 33
MFT products, infrastructure, licensing and the comparison
IBM Sterling, Axway, Progress MOVEit, Fortra’s GoAnywhere and Globalscape, Cleo, Kiteworks, JSCAPE and the cloud services — how an estate is built and sized, why almost nobody publishes a price, one cloud estate costed, and the comparison.
The managed file transfer (MFT) market is older and quieter than the messaging market, and it has consolidated through acquisition. The products differ less in what they can do — almost all speak the SSH File Transfer Protocol (SFTP), FTP over TLS, HTTPS and Applicability Statement 2 (AS2), and almost all offer workflows and Pretty Good Privacy (PGP) — than in their heritage, their scale, their security history and how they are sold.
The products
| Product | Owner, Sep 2026 | Heritage and strength | Typical fit |
|---|---|---|---|
| IBM Sterling File Gateway, on Sterling B2B Integrator | IBM | Business-to-business integration at very large scale; Electronic Data Interchange (EDI) and file gateway in one | Large banks and retailers with thousands of partners |
| IBM Sterling Connect:Direct | IBM | Point-to-point, mainframe-native, checkpoint restart; Secure+ adds TLS and certificates | Data-centre and mainframe batch transfers |
| IBM Sterling Secure Proxy | IBM | The gateway in the demilitarised zone (DMZ): stores no files, opens no inbound port to the internal network | The edge of a Sterling estate |
| Axway SecureTransport, Transfer CFT | Axway | A long banking and government history; gateway and internal tiers | Banks, especially in Europe |
| Progress MOVEit Transfer and Automation | Progress Software | Ease of use; broad mid-market and enterprise base | Organisations wanting a quick, complete product |
| Fortra GoAnywhere MFT | Fortra (formerly HelpSystems) | Broad protocol support and automation | General enterprise |
| Fortra Globalscape EFT | Fortra, acquired in 2020 | Windows-centred enterprise transfer server | Windows estates |
| Cleo Harmony, VLTrader, LexiCom | Cleo | Business-to-business and EDI integration | Supply-chain-heavy businesses |
| Kiteworks | Kiteworks (formerly Accellion) | Secure content sharing, file transfer and email in one platform | Regulated organisations sharing documents with people |
| JSCAPE MFT | Redwood Software, since 2020 | Cross-platform MFT with automation | Organisations already using Redwood’s automation |
| IBM MQ Managed File Transfer | IBM | Files carried over IBM MQ channels, with MQ’s delivery guarantees | Banks already running IBM MQ Advanced |
| AWS Transfer Family | Amazon | Managed SFTP, FTPS, FTP and AS2 endpoints into cloud storage | Workloads already in AWS |
| Azure Blob Storage SFTP | Microsoft | SFTP straight into blob storage | Simple partner drops into Azure |
The infrastructure under an estate
The sizing inputs differ from messaging’s, because files arrive in lumps rather than streams:
| Input | Why it matters | Worked example |
|---|---|---|
| Files per day, and the peak window | Most files arrive in a few hours before a cut-off | 40,000 files a day, 70% of them between 12:00 and 14:00 |
| The largest file | Sets the checkpoint and throughput requirement | A 25 GB overnight extract must move in a 30-minute window: about 14 MB a second, sustained |
| Partners and protocols | Drives gateway configuration, keys and often licensing | 600 partners: 520 SFTP, 60 AS2, 20 on Connect:Direct |
| Retention | Storage and, above all, exposure | Delete on confirmed delivery; keep the audit record, not the file |
| Environments | Production, disaster recovery, test — each may need a licence | Three estates, not one |
How MFT is licensed
Almost every commercial MFT product is sold by quote. IBM’s pricing pages for Sterling B2B Integrator and Connect:Direct say “request a quote” and publish no figure; MOVEit, GoAnywhere, Axway and Cleo do the same. The metrics behind the quotes are, however, predictable:
| Metric | Where you see it | What makes the quote grow |
|---|---|---|
| Per server or node | Most MFT servers and gateways | Every production, disaster-recovery and test instance |
| Per processor — Processor Value Unit (PVU) or Virtual Processor Core (VPC) | IBM Sterling products; Connect:Direct is sold per Processor Value Unit | Cores, and the same sub-capacity rules as other IBM software — see web middleware licensing |
| Per protocol or module | AS2, ad hoc person-to-person transfer, automation, APIs as add-ons | Each capability switched on |
| Per partner or user | Tiers of trading partners; per-user pricing in content-sharing products | Onboarding growth |
| Per endpoint-hour and per GB | The cloud services | Endpoints left running, and volume |
The only published price list is the cloud one
AWS Transfer Family (US East, observed 26 September 2026): $0.30 an hour for each protocol enabled on an endpoint — SFTP, FTPS, FTP and AS2 are each counted — plus $0.04 per GB uploaded or downloaded; AS2 messages $0.01 each for the first 100,000 a month; PGP decryption in its workflows $0.10 per GB. Azure Blob Storage SFTP is widely reported at $0.30 an hour per storage account while SFTP is enabled, whether used or not, plus normal storage charges; Microsoft’s own table renders only in its calculator.
The absence of prices everywhere else is itself a finding: in MFT, the buyer’s benchmark is the last quote, which is why banks re-tender these contracts when they renew.
One cloud estate, costed
| Item | Working | Annual list cost |
|---|---|---|
| SFTP endpoint, always on | $0.30 × 8,760 hours | $2,628 |
| AS2 on the same endpoint | $0.30 × 8,760 hours | $2,628 |
| 2 TB a month transferred | 2,000 GB × $0.04 × 12 | $960 |
| 20,000 AS2 messages a month | 20,000 × $0.01 × 12 | $2,400 |
| 1 TB a month PGP-decrypted in workflows | 1,000 GB × $0.10 × 12 | $1,200 |
| Total | Before storage and the other services it uses | About $9,800 |
The per-protocol hourly charge is the line people miss: every protocol left enabled costs about $2,600 a year whether anything uses it or not, and test environments left running double it.
The comparison
| Deployment | Licence metric | Public price, Sep 2026 | Security history in this chapter series | |
|---|---|---|---|---|
| IBM Sterling File Gateway / B2B Integrator | On premises, containers | Per PVU or VPC | None — quote | — |
| IBM Sterling Connect:Direct | On premises incl. mainframe | Per PVU | None — quote | — |
| Axway SecureTransport | On premises, cloud | Per server | None — quote | — |
| Progress MOVEit Transfer | On premises, cloud | Per server | None — quote | CVE-2023-34362, mass exploitation 2023 |
| Fortra GoAnywhere MFT | On premises, cloud | Per server | None — quote | CVE-2023-0669 (2023), CVE-2025-10035 (2025) |
| Fortra Globalscape EFT | On premises | Per server | None — quote | — |
| Cleo Harmony | On premises, cloud | Per server | None — quote | CVE-2024-50623 and -55956 (2024) |
| Kiteworks | On premises, cloud | Per user | None — quote | Predecessor Accellion FTA (2020–21) |
| IBM MQ Managed File Transfer | Wherever IBM MQ runs | Part of MQ Advanced, per VPC or PVU | USD 583 per VPC-month for MQ Advanced | — |
| AWS Transfer Family | AWS | Per protocol-hour and per GB | $0.30 an hour + $0.04 per GB | — |
| Azure Blob Storage SFTP | Azure | Per hour enabled, plus storage | About $0.30 an hour (reported) | — |
A dash in the last column means only that no mass-exploitation campaign against that product is described in the security chapter — not that the product has no vulnerabilities. Every product here publishes security advisories, and the controls in that chapter apply to all of them.
How to choose, as decision rules
- Thousands of trading partners and EDI: a business-to-business platform such as IBM Sterling or Axway, whose partner management is the product.
- Mainframe and data-centre batch: Connect:Direct, or IBM MQ Managed File Transfer if the bank already runs MQ Advanced.
- Partner drops into a single cloud: the provider’s managed service, with unused protocols switched off.
- Whatever the product: gateway in the DMZ holding nothing, administration off the internet, short retention, PGP, and a patch window measured in hours. The product decision matters less than whether those five are true.
What interviewers ask about MFT
- “Why do banks still use files when they have APIs?”
- “What is the difference between SFTP and FTPS?”
- “A partner resent yesterday’s salary file. What stopped a double payment — or what should have?”
- “Design the edge of an MFT estate so a compromised gateway exposes nothing.”
- “What would you have done differently from the Reserve Bank of New Zealand?”
- “How is MFT licensed, and why is it so hard to benchmark the price?”
Check yourself