DEV Community: Jane Liu

Cerberus FTP Server vs Syncplify: What I Learned After Switching Our Secure File Transfer Setup

Jane Liu — Tue, 22 Sep 2026 12:59:25 +0000

We'd been running Cerberus FTP Server for a few years and it did the job well enough. Reliable, decent feature set, nothing to complain about really — until the renewal invoice arrived and the price had jumped dramatically. That's when we started looking around.

After evaluating a few options we landed on Syncplify Server! and have been running it for several months now. Here's an honest breakdown of how the two compare based on our actual experience.
Platform support

This was the first thing that surprised us. Cerberus is Windows only. Full stop. Syncplify runs on both Windows and Linux with identical feature parity across both — same scripting, same high availability setup, same security controls. For us that mattered because not everything in our environment runs Windows, and working around that with Cerberus was getting old.

Security architecture

Both products cover the basics well — SFTP, FTPS, granular access controls, Active Directory integration, two factor authentication. Where Syncplify genuinely pulled ahead for us was the built-in threat detection. The Protector system uses AI and heuristics to actively block suspicious activity rather than just logging it after the fact, which is a meaningful difference when you're transferring sensitive data regularly.

Syncplify also supports post-quantum encryption across all protocols, which isn't something we urgently needed today but felt like the right direction given where cryptographic standards are heading. Cerberus doesn't offer this.

Worth noting — Syncplify has maintained a zero CVE record, which given how often SFTP servers are targeted is something that carries real weight.

Pricing

This is where the difference becomes pretty significant. Cerberus starts at $1,599 per year on a subscription model, and several users have noted the pricing increased by over 400% in recent years. Syncplify uses a perpetual license model starting at $349 — you buy it once. For compliance heavy environments where you're planning to run this for years, that adds up to substantial savings over time.

Automation and scripting

Syncplify's SyncJS scripting through their AFT client is genuinely powerful once you get past the learning curve. We automated several file transfer workflows that we were handling manually before, which saved real time. Cerberus has an Event Manager that covers the basics but feels more limited in comparison.

Compliance

Both products support HIPAA compliant file transfer and GDPR requirements through audit logging and access controls. For regulated industries this is table stakes and both deliver. Syncplify's audit trails are detailed enough that we've had no issues demonstrating compliance during reviews.

Who should consider switching

If you're on Cerberus and happy with it, and Windows-only isn't a constraint, there's no urgent reason to move. But if you're running a mixed environment, care about where encryption standards are heading, or are feeling the pressure of annual subscription costs that keep climbing, Syncplify is worth evaluating seriously. The 15 day free trial covers the full feature set so there's not much risk in testing it properly.

Title: SFTP in Healthcare: What Most IT Teams Get Wrong About HIPAA Compliant File Transfer

Jane Liu — Mon, 21 Sep 2026 17:58:49 +0000

Healthcare IT has a reputation for being behind the curve on security, and having worked in this space for a while I can say that reputation isn't entirely unfair. But the gap I see most often isn't about sophisticated attacks or zero-day exploits — it's about file transfer, and specifically about the gap between what teams think is HIPAA compliant and what actually is.

Here's what comes up most often.

Treating encryption as a checkbox rather than a practice

Most healthcare IT teams know that data needs to be encrypted. What gets missed is the difference between encrypting data at rest and encrypting data in transit — and the assumption that having one means you've covered both. HIPAA requires protection of protected health information both when it's stored and when it's being transmitted. An SFTP server with strong encryption handles the in-transit side, but only if it's actually configured correctly, using modern cipher suites and not legacy algorithms that technically pass an audit but wouldn't hold up against a serious attack.

Post-quantum encryption is something very few healthcare organizations are thinking about yet, but given how long medical records need to be retained and how fast cryptographic standards are evolving, it's worth factoring into decisions you're making today about your secure file transfer infrastructure.

Audit logs that log the wrong things

HIPAA requires that you can demonstrate who accessed what protected health information and when. A surprising number of SFTP setups log that a file transfer happened without logging enough detail to satisfy that requirement — no user attribution, no IP address, no timestamp granular enough to be useful in an investigation.

When an auditor or an incident response team asks you to pull the access history for a specific file over the last 90 days, you need to be able to answer that question quickly and completely. If your current setup can't do that, your audit trail isn't HIPAA compliant regardless of what your policy documents say.

Shared credentials for file transfer accounts

This one is surprisingly common. A vendor or partner needs SFTP access to receive files, so someone creates a shared account with a generic username and password that gets emailed around. Six months later nobody knows who has those credentials or whether the person who originally set it up still works there.

HIPAA's access control requirements exist for exactly this reason. Every entity that accesses your systems should have individual, traceable credentials, and access should be revoked promptly when the relationship ends. Granular user management and virtual directories that limit each user to exactly what they need to see are not optional features for a healthcare environment — they're the baseline.

No high availability plan for critical transfers

Patient data doesn't stop needing to move because your file transfer server had a problem. Lab results, imaging files, referral documents — these have real clinical implications if they're delayed. A single point of failure in your file transfer infrastructure is a clinical risk as much as a technical one, and most healthcare IT teams don't have a tested high availability setup for their SFTP environment.

Active-active high availability across multiple nodes sounds like an enterprise concern but it's increasingly accessible even for smaller healthcare organizations, and the cost of downtime in a clinical environment makes it worth taking seriously.

Assuming on-premise means compliant

Running your own SFTP server on your own infrastructure doesn't automatically make you HIPAA compliant any more than having a lock on a door makes a room secure. Compliance comes from the combination of the right technical controls, proper configuration, detailed logging, access management, and documented procedures — not from where the server physically sits.

The flip side is also true — cloud hosted or hybrid deployments can absolutely be HIPAA compliant when set up correctly. The location matters less than the controls.

None of this is particularly exotic. The organizations that consistently pass HIPAA audits without drama aren't running unusually sophisticated setups — they got the fundamentals right, documented them properly, and actually check that they're still working periodically.

If you're not sure whether your current file transfer setup would hold up under scrutiny, the audit log question is the fastest diagnostic. Pull the access history for any sensitive file from last month and see how complete the picture is. That answer tells you a lot about where you actually stand.

5 Signs Your Secure File Transfer Setup Isn't As Secure As You Think

Jane Liu — Mon, 21 Sep 2026 17:41:22 +0000

Most sysadmins I've talked to assume their file transfer setup is fine because it hasn't caused problems yet. That's not the same as it being secure, and the difference tends to show up at the worst possible moment.

Here are five things worth checking if you haven't looked at your setup recently.

You're still using FTP somewhere

It sounds obvious but you'd be surprised how often a legacy FTP connection is still running quietly in the background, usually because it's been there for years and nobody wanted to touch it. FTP sends credentials and data in plain text with zero encryption. If it's still in your environment, it's a liability. SFTP or FTPS should be the minimum standard for any file transfer involving sensitive data in transit.

Your audit logs aren't detailed enough to satisfy an auditor

A lot of setups log that a file was transferred but not who accessed it, from where, or what they did with it. If you work in a regulated environment — healthcare, finance, legal — that's a compliance problem waiting to happen. HIPAA compliant file transfer requires granular audit trails that show exactly who touched what data and when. If you can't answer that question in under five minutes, your logging needs work.

You're relying on a single point of failure

If your SFTP server goes down, what happens to your file transfer operations? A lot of organizations don't have a real answer to that question because high availability feels like an enterprise problem until it isn't. Active-active high availability across multiple nodes isn't just for large enterprises — any organization transferring business critical data should have a plan for what happens when the primary server has a problem.

Your staff can access more than they need to

Overly permissive access controls are one of the most common issues in secure file transfer environments and one of the easiest to fix. If users can access folders that have nothing to do with their role, that's unnecessary exposure. Granular access controls, virtual directories, and role based permissions exist for a reason — using them properly significantly reduces the blast radius if credentials get compromised.

You haven't thought about what happens after a ransomware hit

Ransomware increasingly targets data in transit and data at rest simultaneously. If your file transfer server gets hit and you don't have secure offsite backups that are tested and actually restorable, you're in a difficult position. The backup existing isn't enough — when did you last verify it actually works?

None of these are exotic problems. They're the kind of things that get deprioritized because they haven't caused an incident yet. The organizations that tend to avoid serious data breaches aren't necessarily running more sophisticated setups — they just got the fundamentals right and kept them right.

Worth doing a quick audit of your own setup against this list. You might find more gaps than you expected.