Enterprise File Transfer in 2026: MFT vs File Sharing (+ 8 Tools Compared)

I'm Deqian Jia, co-founder of Peony. Every few weeks an IT or security lead asks me some version of the same question: "We have MOVEit (or GoAnywhere, or a pile of SFTP scripts) for moving files between systems — is that the same thing as the data room you sell?" It is not. They are three different tools that get blurred together because they all "move files," and picking the wrong one is how teams end up with either fragile automation or an audit they cannot pass.

Quick answer. Managed file transfer (MFT) is automated, protocol-driven, system-to-system movement of files on schedules and SLAs — nightly batches between applications and trading partners over SFTP, AS2, and FTPS, with retry logic and audit logging. Enterprise file sharing (EFSS) is human collaboration — people uploading, editing, and sending documents to each other. A data room is audience-controlled disclosure — sharing a defined document set with a defined audience (buyers, auditors, a board) with per-viewer analytics, NDA gates, and revocation. Three jobs, three tools. This guide covers the transfer/MFT side; for the human collaboration side, see our companion 10 enterprise file sharing solutions comparison.

This post owns the transfer / MFT intent — automated, machine-to-machine, protocol-driven movement. Its sibling, top 10 enterprise file sharing solutions, owns the sharing intent — human collaboration and external document sharing. If you landed here trying to send an investor deck or collaborate with a team, that page is the right one. If you are trying to move 100 GB of files to a dozen partners every night without a human touching them, you are in the right place.

Full disclosure up front, because it changes how you should read the tool section: I run Peony, a data room company. Peony is not an MFT platform — we do not do scheduled system-to-system automation, and I say so plainly in the honest-boundary section below. My goal here is to help you route the requirement correctly, not to bend an MFT question toward a data room answer.

What is managed file transfer?

Managed file transfer (MFT) is a technology that provides secure, reliable, automated transfer of data — marketed as a more auditable and secure alternative to ad hoc protocols like FTP and HTTP (Wikipedia). In plain terms, it is the system that moves files between systems on a schedule or a trigger, without a person clicking anything, and keeps a record proving it happened.

Enterprise MFT centralizes secure file exchange around a few capabilities that separate it from a raw FTP server or a cron job. It manages trading partners, supports multiple machine protocols (FTP/FTPS, SFTP, HTTP/S, AS2, OFTP2, PeSIT), encrypts data in transit and at rest, orchestrates transfers with low-code automation, and produces centralized monitoring and audit logs for regulatory compliance (JSCAPE). That is the system-to-system batch and EDI use case: a bank sending a nightly settlement file, a hospital exchanging claims with a clearinghouse, a logistics firm pushing manifests to carriers.

One thing to get straight before you shop, because vendors imply otherwise: there is no current Gartner Magic Quadrant for Managed File Transfer. Gartner's last dedicated MFT Magic Quadrant was published in 2009 (Gartner); there is no 2024-2026 MFT MQ. When you see market-size or "leader" claims, they come from second-tier research firms, not a current Gartner MQ. For scale, one such firm, Fortune Business Insights, values the MFT market at USD 2.40 billion in 2025, projected to USD 5.77 billion by 2034 at a 10.4% CAGR (Fortune Business Insights) — indicative, not authoritative, and estimates vary widely by firm.

MFT vs enterprise file sharing vs data rooms: which do you need?

The fastest way to route your requirement is to ask who moves the file and why. If a machine moves it on a schedule, you want MFT. If a person moves it to collaborate, you want file sharing. If a person discloses a defined set to a defined audience under control, you want a data room. Here is the decision table.

The blur happens because all three "move files," and some products span two categories. Kiteworks, for instance, bundles MFT and file sharing under one governance plane. But the underlying jobs stay distinct, and most 200-to-5,000-person organizations end up running more than one deliberately: an MFT platform for the automated partner feeds, an EFSS tool for day-to-day collaboration, and a data room when a deal or audit opens. For a deeper look at where a data room beats generic cloud storage for the human side, see virtual data room vs cloud storage.

Why is unpatched file transfer infrastructure a security risk?

Because internet-facing transfer software is a concentrated target, and unpatched instances are how mass breaches happen. The single most important fact in this entire guide: the two largest MFT breaches of the decade were not exotic — they were known vulnerabilities in widely deployed transfer products, exploited faster than customers patched. This is the trust wedge for the whole category, so it is worth walking through the verified numbers.

MOVEit Transfer (CVE-2023-34362). In 2023, the Cl0p ransomware group mass-exploited a critical SQL injection vulnerability in Progress MOVEit Transfer — CVE-2023-34362, CVSS v3.1 base score 9.8 CRITICAL — that let an unauthenticated attacker reach the MOVEit Transfer database in unpatched versions (NVD). The campaign became one of the largest of the decade. Per Emsisoft's tracker (as of June 28, 2024), it reached 2,773 victim organizations and 95,788,491 individuals, with education (39.1%), health (20.1%), and finance and professional services (13.3%) the most-affected sectors (Emsisoft). The tally grew over months — an earlier interim count (August 24, 2023) put it at 988 organizations and roughly 59.2 million individuals (SecurityWeek) — which tells you how a single unpatched flaw compounds.

Fortra GoAnywhere MFT — twice. In early 2023, Cl0p exploited CVE-2023-0669, a pre-auth remote code execution flaw in GoAnywhere MFT (patched in v7.1.2). Cl0p claimed data from more than 130 organizations, though it provided no evidence; independent tracking (NCC Group) attributed roughly 129 victims, and named victims like Community Health Systems disclosed about 1 million individuals in an SEC filing (SecurityWeek). Then in 2025 it happened again: CVE-2025-10035, a critical deserialization vulnerability in GoAnywhere MFT's License Servlet, disclosed September 18, 2025, affecting versions up to and including 7.8.3, scored CVSS 9.8 by NIST and 10.0 by Fortra (NVD). It was actively exploited — Microsoft observed threat actor Storm-1175 (known for Medusa ransomware) using it for initial access, abusing RMM tools, moving laterally, and deploying Medusa ransomware (Microsoft). Fortra shipped hotfixes and full releases in mid-September 2025; confirm exact fixed-version strings against Fortra's own advisory before you patch.

The lineage risk: Kiteworks / Accellion. Kiteworks is the successor to Accellion, whose legacy File Transfer Appliance (FTA) — already slated for retirement on April 30, 2021 — was mass-exploited by Cl0p/FIN11 in late 2020 and early 2021, leading to an $8.1 million settlement (Infosecurity Magazine). Kiteworks states the modern product runs on a different code base and was not subject to those attacks. Worth an honest mention, not a disqualification.

The pattern is the point. In every case the vulnerability was known and a fix existed or followed quickly; the damage came from internet-facing instances that were not patched, hardened, or monitored in time. When you evaluate any MFT vendor, weight their disclosure transparency and hotfix cadence at least as heavily as their feature matrix — and make rapid patching plus a locked-down web interface non-negotiable in your own deployment.

What are the best enterprise file transfer tools in 2026?

The eight platforms below cover the realistic shortlist for a 200-to-5,000-person org: dedicated MFT suites (Kiteworks, Fortra GoAnywhere, Progress MOVEit, IBM Sterling, Axway, JSCAPE), a modern API-first option with published pricing (Files.com), and the cloud primitive (AWS Transfer Family). Pricing is marked "published" only where it appears on the vendor's own page; everything else is "reported" or "quote-based." At-a-glance first, then notes.

Kiteworks positions itself as a Private Content Network — one control plane consolidating secure email, file sharing, MFT, web forms, APIs, and DRM under unified governance (Kiteworks). It is the compliance-heavy pick: it holds FedRAMP Moderate Authorization (independently assessed by Coalfire, continuously monitored since June 2017) and is FedRAMP High "In Process" for its Secure Gov Cloud (Kiteworks). Kiteworks also states that, due to its FedRAMP authorization, its platform supports roughly 90% of CMMC 2.0 Level 2 requirements out of the box plus 300+ governance controls (Kiteworks) — a vendor-stated figure, not an independent assessment, so treat the CMMC L2 number as Kiteworks' own claim. Note the Accellion lineage above.

Fortra GoAnywhere is a mature dedicated MFT suite with strong protocol coverage (SFTP, FTPS, AS2, PGP) and workflow automation. Its security story in 2026 is defined as much by its two CVEs (2023-0669 and 2025-10035) as by its features — which is a statement about patch discipline, not a verdict that the product is unusable. If you run GoAnywhere, your operational question is how fast you apply Fortra's hotfixes.

Progress MOVEit is still actively sold and maintained in 2026: a MOVEit Transfer Service Pack shipped in January 2026, and the current release uses OpenSSL 3 with FIPS-approved cryptography (Progress). MOVEit Transfer ships FIPS 140-2-validated AES-256 cryptography, delivery confirmation, non-repudiation, and tamper-evident audit logging for ISO 27001, HIPAA, PCI, GDPR, and SOX; MOVEit Cloud is the Azure-hosted SaaS version (Progress). Progress does not publish MOVEit license pricing — it is quote-based.

IBM Sterling File Gateway is a B2B file-exchange application for transferring files between internal and external partners across differing protocols, formats, and naming conventions, with centralized partner management, support for large transfers (hundreds of GB), encryption in transit and at rest, RESTful APIs, and hybrid-cloud/certified-container deployment (IBM). It is the heavyweight for high-volume EDI and complex partner ecosystems. Pricing is quote-based.

Axway SecureTransport is an enterprise MFT gateway supporting FTP, FTPS, HTTP, HTTPS, SSH/SFTP, AS2, and PeSIT plus REST APIs, built for resilient operations with fault tolerance, HA/clustering, zero-downtime upgrades, and guaranteed delivery, deployable on-prem, in cloud, hybrid, or as a managed service (Axway). Strong choice where PeSIT (common in European banking) and high availability matter. Pricing is quote-based.

JSCAPE by Redwood is a platform-independent MFT server handling any file size and any protocol — SFTP, FTP/S, HTTP/S, AS2, OFTP2, WebDAV — with low-code automation and unlimited users, trading partners, and concurrent connections included. It holds SOC 2 Type 1 and Type 2, ISO 27001, Drummond Certified, and FIPS 140-2 and 140-3 validated encryption (JSCAPE). Attractive when per-connection licensing on other suites gets expensive. Pricing is quote-based.

Files.com is a cloud MFT and automation platform, and one of the few with published pricing: Starter is $199/month (or $2,099/year) with 10 Full Users + 50 System Users, 1 TB monthly storage and transfer, and 2 outbound connections; Power is $499/month (or $5,269/year) with 20 Full Users + 100 System Users, 2 TB, and 5 outbound connections; Enterprise is custom. Overages are metered — Full Users $12/month, System Users $4/month, storage/transfer $100/TB/month, outbound connections $50/month each (Files.com). Good fit when you want transparent, self-serve pricing and modern APIs.

AWS Transfer Family is a managed cloud service for SFTP, FTPS, FTP, and AS2, with fully published usage pricing: $0.30/hour per enabled protocol per server endpoint, plus $0.04/GB for data uploaded and downloaded over SFTP/FTPS/FTP; AS2 endpoints are $0.30/hour with messages at $0.01 each for the first 100,000/month; SFTP connectors are $0.001 per call plus $0.40/GB (AWS). One caveat that surprises teams: because the endpoint bills per protocol per hour around the clock, a single always-on SFTP endpoint runs roughly $216/month before a single byte moves ($0.30 × 24 × 30), on top of the per-GB charge (Hykell). It is a cloud primitive — you assemble the workflow, orchestration, and partner management yourself — rather than a finished MFT product.

Which protocols and automation matter in MFT?

The protocols are the reason MFT exists as a category: they are how one machine hands a file to another machine securely and provably, with no human in the loop. Get the protocol layer right and the compliance and reliability layers follow.

• SFTP (SSH File Transfer Protocol) is the workhorse for secure system-to-system transfer over an encrypted SSH channel — the default for most partner feeds.
• FTPS is FTP over TLS, still common where partners standardized on it.
• AS2 wraps files with signing and encryption and returns an MDN receipt, giving you non-repudiation — cryptographic proof that a specific partner received a specific file. It is the backbone of EDI. AS2 (with signing/encryption and MDN receipts) and SFTP are the backbone secure transports for system-to-system MFT/EDI, and leading MFT products (Axway, JSCAPE, AWS Transfer Family, IBM Sterling) all support them as first-class protocols (JSCAPE).
• OFTP2 and PeSIT appear in automotive (OFTP2) and European banking (PeSIT) ecosystems.
• PGP encrypts the payload itself, so the file stays encrypted end to end regardless of transport — the common way to satisfy "encrypt at rest and in transit" for partner exchange.

Automation is the other half. The value of MFT over a hand-rolled script is retry logic (a failed transfer retries on a backoff instead of silently dropping), SLA monitoring and alerting (you get paged when the 2 a.m. batch to a carrier fails, not when the carrier calls), scheduling and event triggers (on a cron, or on file-arrival), guaranteed delivery and non-repudiation, and centralized key and credential management. Enterprise MFT delivers exactly this: low-code automation triggers let IT teams orchestrate transfers across platforms while meeting HIPAA, PCI DSS, SOX, GDPR, and GLBA requirements (JSCAPE).

On the recurring HIPAA encryption question — the highest-intent query in this whole space — here is the precise answer. Encrypt in transit with SFTP, FTPS, or HTTPS/TLS 1.2+, and encrypt the payload at rest (typically AES-256, often with PGP for partner exchange). That satisfies the HIPAA Security Rule's Transmission Security standard, 45 CFR 164.312(e)(1), which requires technical measures to guard against unauthorized access to ePHI transmitted over a network; its addressable implementation specifications are (e)(2)(i) integrity controls and (e)(2)(ii) encryption — "implement a mechanism to encrypt electronic protected health information whenever deemed appropriate" (Cornell Law / eCFR). SFTP and TLS are the common ways to satisfy this for file transfer; an MFT platform lets you enforce it on every endpoint and log it centrally.

How much does enterprise file transfer software cost in 2026?

Enterprise file transfer pricing ranges widely because vendors meter differently — per user, per connection, per module, or by usage — so the honest answer is "get a quote for the suites and benchmark against the published options." Below is what is actually published versus what is only reported.

Published pricing (on the vendor's own page):

• Files.com — Starter $199/month, Power $499/month, Enterprise custom; metered overages for users, storage/transfer, and connections (Files.com).
• Kiteworks Business Package — $25.50/user/month (40% discount for annual billing), minimum 5 users, self-serve up to 100 users; above 100 requires sales (Kiteworks).
• AWS Transfer Family — $0.30/hour per enabled protocol per endpoint + $0.04/GB (SFTP/FTPS/FTP); AS2 messages $0.01 each for the first 100,000/month (AWS). Remember the ~$216/month always-on endpoint floor before data moves (Hykell).

Reported / quote-based (not published by the vendor): Progress does not publish MOVEit pricing; resellers indicate rough ranges from about $5,000/year for a small deployment up to roughly $100,000/year for 1,000 users, with support typically 20-30% of license cost on top (Pro2col) — indicative, not official. Fortra GoAnywhere, IBM Sterling, Axway, and JSCAPE are likewise quote-based; price them by modules, connections, and deployment model, and add implementation and annual maintenance. The takeaway: sticker price is a fraction of total cost of ownership for the enterprise suites, and the two cheapest-looking options (AWS, a bare SFTP server) shift the most engineering work onto you.

Where does Peony fit — and where does it not?

Let me be direct, because getting this wrong wastes your time and mine: Peony is not a managed file transfer platform. We do not do scheduled or event-driven system-to-system automation. There is no cron-driven nightly SFTP job to trading partners, no AS2/MDN non-repudiation for EDI, no OFTP2 or PeSIT, no trading-partner management for machine-to-machine batches. If your requirement is "move 100 GB to 30 partners every night with retry logic and an SLA," Peony is the wrong tool — pick one of the MFT platforms above, most likely GoAnywhere, MOVEit, Axway, IBM Sterling, JSCAPE, Files.com, or AWS Transfer Family depending on your protocols and budget.

Where Peony wins is the layer MFT does not touch: the human deal-file-exchange layer. Diligence, audits, board and investor disclosure — cases where a person shares a defined document set with a defined audience and needs to control and measure what happens after the send. MFT's audit unit is "file X delivered to partner Y." A data room's audit unit is "this viewer read page 12 for 40 seconds, this one never opened the financials." That viewer-level analytics, plus NDA gates before access, dynamic watermarks that name each viewer, and one-click revocation after sending, is what MFT platforms are simply not built to do — and their own product pages do not claim to. Peony serves 6,800+ customers on exactly this human-disclosure job.

So segment honestly, and most organizations of this size run more than one tool on purpose:

• Automated system-to-system feeds (EDI, nightly batches, machine protocols): an MFT platform. Not Peony.
• Day-to-day human collaboration and internal sync: an EFSS tool — see our enterprise file sharing comparison. Peony does external sharing but is not a sync/collaboration suite.
• Controlled disclosure to a deal or audit audience (buyers, auditors, a board, investors): a data room — Peony, with per-viewer analytics, NDA gates, dynamic watermarks, and instant revocation.

If you are moving toward, say, an M&A process or a fundraise after your MFT feeds are handled, that is the moment a data room earns its place alongside — not instead of — your transfer stack. Peony's 6,800+ customers use it for that deal layer, with $26.3B in client assets managed across the rooms our customers run. See how the human side compares to legacy tools in virtual data room vs Dropbox and is OneDrive secure.

Frequently Asked Questions

What is the difference between managed file transfer (MFT) and enterprise file sharing?

Managed file transfer (MFT) is automated, protocol-driven, system-to-system movement of files on schedules and SLAs — nightly batches between applications and trading partners over SFTP, AS2, and FTPS, with retry logic, guaranteed delivery, and audit logging. Enterprise file sharing (EFSS) is human collaboration — people uploading, co-editing, and sending documents to each other. MFT is unattended and machine-to-machine; EFSS is attended and person-to-person. Most orgs need both, plus a data room for controlled deal disclosure.

Do I really need an MFT tool, or can I keep using SFTP scripts?

Homegrown SFTP scripts work until they don't — they typically lack retry logic, alerting on failed transfers, centralized audit trails, key rotation, and trading-partner management, which is exactly what auditors ask for under SOX, HIPAA, and PCI DSS. If you move sensitive files to more than a handful of partners on a schedule, an MFT platform buys you monitoring, guaranteed delivery, non-repudiation receipts, and one place to prove a transfer happened. If you move a few files a week between two internal systems, a well-maintained script with logging may be enough. The break point is usually audit pressure plus partner count.

Kiteworks vs GoAnywhere vs MOVEit — which is more secure in 2026?

All three ship strong cryptography and audit logging, so "most secure" in 2026 is less about features and more about patch discipline and breach history. MOVEit carries the CVE-2023-34362 mass-hack (2,773 organizations, per Emsisoft), Fortra GoAnywhere carries both CVE-2023-0669 and the fresh CVE-2025-10035 (CVSS 10.0 per Fortra, actively exploited to deploy Medusa ransomware), and Kiteworks carries breach lineage through its predecessor Accellion's legacy FTA appliance (Cl0p, 2021), though Kiteworks states the modern product runs on a different code base. The honest answer: any MFT gateway exposed to the internet is only as secure as your patching cadence. Pick the vendor whose disclosure and hotfix track record you trust, and treat rapid patching as non-negotiable.

Is MOVEit safe to use after the 2023 Cl0p breach?

MOVEit Transfer is still actively sold and maintained by Progress in 2026 — a MOVEit Transfer Service Pack shipped in January 2026, and the current release uses OpenSSL 3 with FIPS-approved cryptography. The 2023 breach exploited CVE-2023-34362, a critical SQL injection flaw (CVSS 9.8) in unpatched versions; patched, monitored deployments were the point. So MOVEit can be safe to run today, but only if you apply service packs promptly, restrict the web interface, and monitor for the next zero-day. The lesson of the Cl0p campaign is not "avoid MOVEit" — it is "unpatched internet-facing transfer software is how 2,700+ organizations got breached."

How do I encrypt files in transit and at rest for HIPAA file exchange?

For HIPAA, encrypt in transit with a strong transport protocol — SFTP (SSH), FTPS, or HTTPS/TLS 1.2+ — and encrypt sensitive files at rest, typically with AES-256; PGP file-level encryption is common for partner exchange so the payload stays encrypted end to end. This satisfies the HIPAA Security Rule's Transmission Security standard (45 CFR 164.312(e)), whose addressable specifications are integrity controls and encryption of ePHI "whenever deemed appropriate." In an MFT platform you enforce this centrally: require SFTP/FTPS on every partner endpoint, apply PGP to the payload, and log every transfer to a tamper-evident audit trail for your risk analysis.

How do I migrate from homegrown SFTP scripts to a managed file transfer platform?

Migrate in stages: (1) inventory every existing script, cron job, endpoint, credential, and PGP key so nothing silently breaks; (2) recreate each flow in the MFT platform as a scheduled or event-driven job with retry logic and failure alerting; (3) run old and new in parallel for a cutover window and reconcile that both produce identical transfers and receipts; (4) migrate trading-partner connections and rotate keys; (5) decommission the scripts once the audit trail proves the platform is authoritative. The order matters — inventory first, parallel-run before cutover, decommission last — because the scripts you forget are the ones that page you at 2 a.m.

How much does GoAnywhere MFT cost per year?

Fortra does not publish GoAnywhere MFT list pricing, so any specific number is a quote, not a published price. Reported ranges from resellers put a small deployment in the low five figures per year and larger multi-partner deployments materially higher, with annual maintenance/support typically added on top — but Fortra prices by modules, connections, and deployment, so you should get a direct quote. Treat all third-party figures as indicative. If you want published, self-serve pricing to benchmark against, Files.com (Starter $199/month), Kiteworks Business Package ($25.50/user/month), and AWS Transfer Family (usage-based) all post their rates.

How much does enterprise file transfer software cost in 2026?

It ranges widely because vendors price differently — by user, by connection, by module, or by usage. Published anchors in 2026: Files.com starts at $199/month (Starter) or $499/month (Power); Kiteworks lists a self-serve Business Package at $25.50/user/month; AWS Transfer Family is usage-based at $0.30/hour per enabled protocol per endpoint plus $0.04/GB. Quote-based platforms (MOVEit, GoAnywhere, Axway, IBM Sterling) are custom; reported MOVEit ranges run from roughly $5,000/year for a small deployment up to about $100,000/year for 1,000 users, with support often 20-30% of license on top. Budget for licensing plus implementation and ongoing maintenance, not just the sticker.

Which file transfer requirements do HIPAA and PCI DSS actually impose?

HIPAA's Security Rule requires, under Transmission Security (45 CFR 164.312(e)), technical measures to guard ePHI in transit, with addressable integrity controls and encryption — in practice, SFTP or TLS plus at-rest encryption of the payload. PCI DSS v4.0 Requirement 4 requires strong cryptography and secure protocols (e.g., TLS 1.2+, SSH-2, IPsec) whenever cardholder data (PAN) crosses open, public networks, with no fallback to insecure versions; the future-dated 4.x sub-requirements became mandatory April 1, 2025, per Basis Theory's PCI DSS Requirement 4 summary (the official PCI SSC document is gated). Both also imply audit logging and access control, which is why regulated shops move to MFT: it centralizes the encryption, the protocol enforcement, and the audit trail auditors ask to see.

When should I use a data room instead of an MFT platform?

Use a data room when the exchange is human, deal-shaped, and audience-controlled — diligence, an audit, a board or investor disclosure — where you need per-viewer analytics, NDA gates, watermarks, and the ability to revoke access after sending. Use an MFT platform when the exchange is automated, system-to-system, and scheduled — nightly EDI batches, application-to-application feeds, machine protocols like AS2. The two are not competitors; they solve different problems. I run Peony, a data room company, and we are explicitly not an MFT platform: if you need scheduled SFTP automation to trading partners, use an MFT tool — and use a data room for the human deal-file layer on top.

Sources

• Progress MOVEit — CVE-2023-34362 detail and CVSS 9.8: NVD
• MOVEit breach final tally (2,773 orgs / 95,788,491 individuals; sector split): Emsisoft
• MOVEit breach interim tally (988 orgs / ~59.2M individuals): SecurityWeek
• MOVEit Transfer Service Pack (January 2026): Progress
• MOVEit Transfer product security (FIPS 140-2 AES-256, tamper-evident logging): Progress
• MOVEit reported pricing ranges (quote-based): Pro2col
• GoAnywhere CVE-2023-0669 victim disclosures: SecurityWeek
• GoAnywhere CVE-2025-10035 detail and CVSS 9.8/10.0: NVD
• CVE-2025-10035 active exploitation (Storm-1175 / Medusa): Microsoft
• Accellion FTA breach $8.1M settlement (Kiteworks lineage): Infosecurity Magazine
• Kiteworks platform (Private Content Network): Kiteworks
• Kiteworks FedRAMP authorization (Moderate since June 2017): Kiteworks
• Kiteworks CMMC 2.0 Level 2 support (vendor-stated ~90%): Kiteworks
• Kiteworks Business Package pricing ($25.50/user/mo): Kiteworks
• Axway SecureTransport protocols and HA: Axway
• IBM Sterling File Gateway overview: IBM
• JSCAPE MFT Server (protocols, certifications, FIPS 140-2/140-3): JSCAPE
• Files.com published pricing: Files.com
• AWS Transfer Family published pricing: AWS
• AWS Transfer Family always-on endpoint cost (~$216/mo): Hykell
• HIPAA Security Rule Transmission Security (45 CFR 164.312(e)): Cornell Law / eCFR
• PCI DSS v4.0 Requirement 4 (strong cryptography in transit): Basis Theory
• Managed file transfer category definition: Wikipedia
• No current Gartner MFT Magic Quadrant (last 2009): Gartner
• MFT market size estimate (Fortune Business Insights): Fortune Business Insights

Related resources

• Top 10 Enterprise File Sharing Solutions — the sharing/collaboration companion to this transfer guide
• Top 10 Secure File Sharing Tools
• Secure File Sharing Guide
• Document Sharing Compliance Guide (SOC 2, GDPR, HIPAA)
• How to Send Confidential Documents via Email
• Send Tax Documents Securely
• Collect Documents From Clients Securely
• ITAR-Compliant Data Room
• Virtual Data Room vs Cloud Storage
• What Is a Virtual Data Room?