Zero Trust Platforms - NetFoundry

Short Summary

Zero Trust has become the default enterprise security architecture because resources and traffic no longer sit behind a single perimeter: users, workloads, data, and devices span data centers, public clouds, SaaS, Kubernetes, operational sites, partner networks, and edge environments. Much of this connectivity is now non-human (workloads, APIs, AI agents, IoT/OT, third parties), often crossing organizational boundaries. While many enterprises already deploy key components (MFA, ZTNA, endpoint posture, microsegmentation, cloud workload controls), these tools typically lack a shared policy model and don’t coordinate decisions, causing fragmented enforcement, duplicated or drifting policies, and unclear authority for access outcomes—especially at boundary crossings.

Identity is the primary attack surface: stolen credentials, cookies, OAuth tokens, API keys, and service secrets enable attackers to operate as legitimate entities unless trust is continuously evaluated and enforced mid-session (revocation, step-up, privilege reduction, termination). Machine credentials heighten risk because long-lived keys and shared secrets validate possession but not the true workload, requiring cryptographic workload identity verified per connection. Distributed, heterogeneous infrastructure further breaks topology-based controls (overlapping/private IPs, inconsistent logging/identity integration), demanding consistent policy enforcement independent of network layout.

The report distinguishes human access from workload connectivity: humans can often tolerate intermediaries that terminate/inspect TLS, while workloads require symmetric, frequent, mutually authenticated connections where such intermediaries can add latency and weaken end-to-end guarantees. A mature platform authenticates before connect, centralizes contextual authorization, continuously re-evaluates trust, supports heterogeneous enforcement models, and prioritizes segmentation to contain lateral movement.

A vendor spotlight on NetFoundry presents a three-plane architecture (management/control/data) with endpoint-held private keys, ABAC policy, microsegmentation via a private overlay, workload certificates, AI agent governance (MCP/LLM gateways), and extensive deployment options, while relying on external tooling for analytics and lacking built-in content inspection.

Interesting Facts

• Users, workloads, and data are distributed across data centers, public clouds, SaaS, Kubernetes clusters, operational sites, partner networks, and edge environments.
• Enterprises commonly deploy MFA, ZTNA, endpoint posture controls, microsegmentation, and cloud workload controls.
• Stolen session cookies, OAuth tokens, API keys, and service-account secrets can allow attackers to operate as legitimate users and services.
• Workload connections are symmetric, frequent, and mutually authenticated, and intermediaries can break end-to-end authentication and add latency.
• Overlapping and private IP ranges can defeat topology-based controls in heterogeneous environments.
• NetFoundry was founded in 2019 and is headquartered in Charlotte, North Carolina.
• NetFoundry is the creator and maintainer of the open-source Zero Trust networking software OpenZiti.
• NetFoundry uses a three-plane architecture consisting of management, control, and data planes.
• NetFoundry’s hosted service provides a private, dedicated fabric across more than 100 points of presence with SLAs up to 99.95%.
• NetFoundry holds SOC 2 Type II attestation.

Notable Quotes

• “Zero Trust is now the default architecture for enterprises whose resources are no longer protected by a single perimeter.”
• “These controls lack a shared policy model.”
• “Identity is now the primary attack surface.”
• “A shared secret or bearer token proves only possession: the check validates the credential presented but not that the sender is the workload it was issued to, which amounts to checking an ID card without looking at the face.”
• “A platform must enforce one policy across all of it, without depending on network layout or re-addressing traffic to fit a shared network.”
• “Prevention does not stop an attacker who is already inside, and the damage depends on what that attacker can reach next.”
• “A platform built for one center rarely covers the other by adding features, because the data path itself differs.”
• “Authentication at the start of a session says little about the rest of it.”
• “Enforcement must be observable to be trusted and improved.”
• “Zero Trust cannot be bought and switched on.”