Pomerium is an identity and context-aware access proxy that gives users, services and AI agents zero trust access to private applications and infrastructure without a corporate VPN. Every request is checked against identity, device state and request context before it reaches the application behind the proxy.
It is aimed at platform and security teams that want one policy layer in front of internal web apps, SSH and TCP services, Kubernetes and MCP servers. Teams can run it entirely themselves or have Pomerium operate part of it.
At A Glance
| Vendor | Pomerium, Inc. |
|---|---|
| Category | Zero trust access, authorisation |
| Identities covered | Users, services, service accounts, AI agents |
| Deployment | Self-managed Core, managed control plane (Zero) or self-hosted control plane (Enterprise) |
| Agentic AI | Identity and tool policy for Model Context Protocol (MCP) requests |
| Customers | Mercedes-Benz, NVIDIA, Uber, Zendesk, Ahold Delhaize |
| Funding | Series A led by Benchmark (2024) |
| Market classification | Authorisation; also Workload Identity |
What Pomerium Does
VPNs grant broad network access once a user is connected, and they do little for services or AI agents. Pomerium replaces that model with policy-enforced routes to each application, evaluating every request rather than every session.
Because the data plane is separate from the control plane, enforcement always stays close to the workloads, wherever they run, while management can be self-run or delegated. The same policy language covers people, services and AI agents, so one set of rules governs every route into private systems.
Products
Pomerium Core
Core is the self-managed, open-source server and the data-plane engine behind every deployment model. Teams write access rules in the Pomerium Policy Language (PPL) and install Core from pre-built binaries, Linux packages, Docker images or source. Beyond web applications it supports MCP, SSH, TCP and UDP tunnelling, service accounts and kubectl access.
Pomerium Zero
Pomerium Zero suits teams that want Pomerium to run the control plane while they keep the data plane in their own environment. It handles onboarding and configuration and adds service accounts, organisations and quotas, offering clientless access to web applications with both on-premises and hosted benefits.
Pomerium Enterprise
Enterprise is for organisations that need the control plane on their own infrastructure. It provides the Enterprise Console and Enterprise API, Directory Sync for importing directory and external data, and views of service accounts, sessions and metrics. It installs with Docker, Kubernetes or system packages.
Clients And Tooling
- Pomerium CLI and Desktop clients for tunnelling non-HTTP protocols.
- Kubernetes Ingress Controller.
- Terraform provider.
- Go and JavaScript SDKs.
How It Works
Pomerium sits in front of internal applications and services as a proxy, and each request passes through three steps.
| Component | What it does |
|---|---|
| Authenticate | Users sign in through the organisation’s identity provider. |
| Authorize | Pomerium evaluates PPL policies using identity, device state and request context to decide whether the request may proceed. |
| Proxy | Allowed traffic flows to the internal application over a secure, policy-enforced route. |
| Control plane | Pomerium Zero (run by Pomerium) or Pomerium Enterprise (run by the customer) manages the Core clusters that do this work. |
Applications such as Grafana, Jenkins, Open WebUI and code-server sit behind the proxy unchanged, with documented setup guides for each.
Identities And Systems Covered
| Human users | Authenticated through identity providers such as Okta, Auth0, Entra ID, Google and Keycloak. |
|---|---|
| Services and service accounts | Including headless agents running in CI. |
| AI agents | Requests to protected MCP servers. |
| Devices | Device state as an input to access decisions. |
| Systems | Internal web applications, SSH, TCP and UDP services, Kubernetes and MCP servers. |
Agentic AI Capabilities
MCP Access Control
Pomerium applies identity and tool policy to Model Context Protocol requests so AI agents can work with internal resources safely. Teams can protect internal MCP servers, use PPL to limit which MCP tools a user may call, bridge MCP servers that have their own OAuth, and delegate MCP access to an LLM.
Headless Agents And Model Providers
Headless agents in CI authenticate with service accounts. The architecture is plug-and-play, so teams can use any model provider, LLM gateway or harness, including Claude, OpenAI, LangChain and Google.
Company Background
| Leadership | Bobby DeSimone, CEO and founder. |
|---|---|
| Funding | $13.75 million Series A led by Benchmark in June 2024, with Eric Vishria, General Partner at Benchmark, joining the board. |
| Open source | Pomerium Core has passed a reported 1 billion Docker pulls. |
Note: This overview is compiled from Pomerium’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.