NetFoundry is a zero trust networking company that connects workloads, devices, users and AI agents without exposing any of them to the network. Its platform makes services unreachable by default: nothing listens on an open port, and a connection forms only after both ends have proved their identity and policy allows it. It is used to replace VPNs, MPLS links and inbound firewall rules, and increasingly to control what AI agents can reach.
The company created and maintains OpenZiti, an open source zero trust networking project, and sells the NetFoundry Platform on top of it with a managed global fabric and enterprise support.
At A Glance
| Vendor | NetFoundry |
|---|---|
| Category | Zero trust networking, workload connectivity, AI access security |
| Identities covered | Workloads, devices, users, AI agents, LLMs and MCP servers, each with an X.509 identity |
| Deployment | NetFoundry-Hosted or self-hosted, including air gapped |
| Agentic AI | AI Enclave, MCP Gateway, LLM Gateway, MCP Connect |
| Customers | KEO, CERM, Rhapsody, Digibee, Ominimo |
What NetFoundry Does
A service that listens on an open port can be scanned and attacked by anyone who can reach it, and VPNs, IP allow lists and inbound firewall rules only narrow who that is. NetFoundry’s model, Identity-First Reachability, replaces that with identity: every endpoint holds a cryptographic identity, every connection is dialled outward, and a route exists only once policy has authorised it. The aim is “making identity, not IP, the core of your network”. Applied to AI, the same model means an agent can reach only the models, tools and data its policy allows. The company reports more than 3,000 companies using its technology and over 1 billion sessions a month.
Products
OpenZiti
OpenZiti is the open source project behind everything NetFoundry sells, and the company remains its creator and sponsor. Teams can bring existing applications onto it with routers and tunnelers, or compile zero trust connectivity straight into their own software with SDKs. A Browser SDK embeds the same protection in web applications.
NetFoundry Platform
The commercial platform runs OpenZiti as a managed service with 24×7 support, including a FIPS compliant offering, and packages it for common network problems:
| Microsegmentation | Identity based policy across multi cloud and edge environments |
|---|---|
| Vulnerability Cloaking | A compensating control that removes open ports from unpatched services so attackers cannot scan or exploit them while a fix is pending |
| Site-to-Site and Customer Connect | Links between sites, partners and customers without VPNs or inbound firewall rules |
| OT and IoT Connectivity | An OT security platform with embedded zero trust for critical infrastructure |
| API Security | APIs reachable only by authorised identities |
AI Enclave
AI Enclave is an open source, policy-governed network fabric for AI workloads, in which each agent, model and MCP server is enrolled with its own cryptographic identity when it joins. It extends OpenZiti to teams running agents and models that must not be exposed to the internet or to each other, and every interaction is logged and metered against the identity that made it.
MCP Gateway
The MCP Gateway sits in front of an organisation’s MCP servers so that agents reach only the tools their policy allows. One command wraps a local stdio MCP server into a shared endpoint without code changes. It aggregates several back ends behind one endpoint, namespaces tools, isolates each client session and applies role based access control, and tools an agent is not allowed to use are removed from its registry altogether.
LLM Gateway
The LLM Gateway gives developers one OpenAI-compatible endpoint for every model they use, across OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex AI and Ollama, with identity based control over who can call which model and how much they can spend. It routes requests by cost, latency or data sensitivity, applies guardrails for PII, content safety, topic controls and prompt injection, and tracks cost and budgets per identity. Agents never receive the provider API keys.
NetFoundry MCP Connect
MCP Connect links agents, including third-party agents and frontier model APIs, to MCP servers and enterprise resources without exposing either. For each request it authenticates the user, the agent and the machine it runs on, checks the request against policy and only then opens an outbound-only, end to end encrypted session. Access can be revoked in seconds.
How It Works
NetFoundry runs in two ways. With NetFoundry-Hosted, NetFoundry operates the control plane and the fabric. Self-hosted customers run both in their own environment to meet data residency, air gap or sovereignty requirements. In either case workloads dial out, authenticate before connecting and open no inbound ports.
| Component | What it does |
|---|---|
| Control plane | Holds every identity, the policies that govern them and the orchestration that ties them together. It authorises connection requests and pushes policy to the edge. |
| NetFoundry Routers | Form the fabric that carries traffic and enforce policy at the edge for each connection request. |
| Tunnelers | Bring workloads that cannot be modified onto the fabric, running on Windows, macOS and Linux, with mobile clients for Android and iOS. |
| SDKs | Embed zero trust connectivity inside an application, with SDKs for Go, C, .NET, Java, Node and Swift. |
| Keys and encryption | Each identity is a key pair generated locally, and the private key never leaves its system. Mutual TLS authenticates both ends of every connection. |
Identities And Systems Covered
| Workloads and services | A certificate based identity issued at enrolment, with services unreachable by default |
|---|---|
| Devices and endpoints | Windows, macOS, Linux, Android and iOS through tunnelers, plus OT and IoT devices at the edge |
| Applications | Identity embedded in code through the SDKs and the OpenZiti Browser SDK |
| Human users | Authenticated through the customer’s identity provider |
| AI agents, LLMs and MCP servers | Each with its own cryptographic identity, separate from the people and service accounts that launched them, with no shared keys |
| Environments | Multi cloud, edge, on-premises and air gapped networks |
Company Background
| Headquarters | Charlotte, North Carolina, United States |
|---|---|
| Founders | Founded by the inventors and maintainers of OpenZiti: Galeal Zino (Founder and CEO), David Hart (CTO and Co-Founder) and Robert Caamano (Co-Founder) |
| Leadership | Mike Gorman (Chief Information Security Officer) |
| Funding | A $12 million investment announced in April 2025; Cisco Investments joined the Series A as a strategic investor in November 2025 |
| Recognition | Included in KuppingerCole’s evaluation of Zero Trust Platforms; Network Infrastructure Magazine Buyers Choice award for Zero Trust Networking Platform of the Year 2026 |
Note: This overview is compiled from NetFoundry’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.