netfoundry.io

What It Is

NetFoundry positions itself as an “Identity-First Reachability” zero-trust connectivity platform. Rather than filtering traffic after exposing a public entry point, its core idea is to make APIs, MCP, LLMs, AI Agents, and IT/OT/IoT sites unreachable and unscannable until the identity has been authorized. It targets machine-to-machine interactions, B2B connectivity, access to customer environments, and critical infrastructure scenarios, aiming to replace traditional S2S VPNs, firewall ACLs, and some API gateway exposure models.

Core Capabilities

In terms of protection, NetFoundry covers zero-trust API security, AI Enclaves, IT/OT/IoT connectivity, third-party access, and microsegmentation. Its key mechanisms include X.509 machine identities, pre-authentication policy evaluation, no inbound ports, mTLS, end-to-end encryption, and service-level least privilege. Deployment is flexible, with support for cloud, hybrid cloud, on-premises, and air-gapped environments, as well as Agent, Agentless, SDK, container, standalone binary, and application-embedded options. For management, it provides a console, Web Portal, and API, emphasizing identity-level observability, telemetry, governance, and auditing—showing “which identity called which API.” For integrations, it supports OAuth/OIDC, MFA, JIRA, ServiceNow, and Zendesk, and is based on the OpenZiti open-source project.

Compliance and Pricing

The content states that it supports environments involving HIPAA, CJIS, PCI/PCI-DSS, EU CRA, NIS-2, NERC CIP, IEC 62443, NIST 800-171, DORA, FedRAMP, SOC 2, FIPS/FIPS 140, and more, making it suitable for industries with heavy compliance requirements. However, the page does not disclose specific pricing, plans, or billing units; it only provides Pricing, Free Trial, and Demo entry points. Budget evaluation therefore requires contacting the vendor.

Pros and Cons

The main advantage is its clear architectural approach: reducing the attack surface by making services “unreachable before authentication,” rather than relying only on WAF or gateway rules. It also offers rich deployment options and SDKs, making it suitable for complex networks such as SaaS environments, industrial edge scenarios, and partner access. The downsides are that the vendor’s claimed 99.99% attack surface reduction needs real-world validation; enterprise adoption requires strong capabilities in identity, certificates, policies, and network governance; and if you already have SASE, ZTNA, or API Gateway systems in place, you will need to assess overlap and migration costs.

Who It’s For and Access from China

NetFoundry is better suited for mid-to-large enterprises, SaaS/ISVs, critical infrastructure operators, industrial IoT teams, healthcare, financial services, government contractors, and other teams that need to replace VPNs, protect APIs, or connect to customers’ private environments. The source content does not specify access from mainland China, payment methods, or local support, so china_access can only be rated as unknown. If cross-border connectivity is constrained, alternatives such as OpenZiti, Cloudflare Zero Trust, Zscaler Private Access, Tailscale, and Teleport may be worth evaluating.