Category Archive - Secure By Design - NetFoundry

Why OpenClaw Didn’t Bite NetFoundry Customers

Galeal Zino — Fri, 13 Feb 2026 02:57:46 +0000

The Power of Dark Services with OpenZiti

The recent OpenClaw vulnerabilities sent ripples through the cybersecurity community. Research from the SecurityScorecard STRIKE Threat Intelligence Team revealed that over 20,000 control panels were exposed to the public internet. These panels represent a massive attack surface for credential stuffing, exploit kits, and remote code execution.

However, this headline was a non-event for NetFoundry customers who yawned while the rest of the world scrambled to apply patches. It was also a breeze for OpenZiti user’s – NetFoundry’s open source software

How can NetFoundry customers and OpenZiti users be insulated from any OpenClaw CVE – as well as from CVEs from other AI agents?

1. No Listening Ports, No Exposure

Exploiting the “OpenClaw” vulnerability starts with discovery – same as many cyber-attacks. Attackers used scanning tools like Shodan and Censys to find IP addresses with open ports (typically 80, 443, or 8080) associated with known control panel software. Unfortunately for the attackers, NetFoundry customers do not have any exposed ports.

In the NetFoundry model, a machine, VM or container running OpenClaw opens an outbound-only connection to a private, dedicated overlay. That overlay is self-hosted or hosted by NetFoundry. Either way, there are no open inbound ports for attackers to scan or for attackers to use to enter to exploit a vulnerability

2. Identity-First™ Networking

The exposed panels in the OpenClaw report relied on the traditional “first connect the user, then try to authenticate and authorize the user” model. That model means that anyone with the URL could reach the OpenClaw login page and exploit any vulnerabilities.

NetFoundry flips this model to “identify, authenticate, authorize…then connect IF you are authorized.” That model means nobody with the URL, other than identified, authenticated, authorized users, can reach OpenClaw.

3. Public Pipes, Private Overlays

Many of the panels flagged in the OpenClaw report were exposed because they were hosted on public clouds or home networks where “private” networking is complex or expensive to implement.

NetFoundry creates an instant, dedicated, virtual overlay network that sits on top of the public internet. It treats the internet as “dumb pipes.” By encrypting traffic from end-to-end and managing routing within the overlay, NetFoundry allows administrators to put their OpenClaw control panels on the “private” overlay. This means the panels are reachable by authorized administrators anywhere in the world, but unreachable from the Internet

4. Mitigation of Zero-Day Vulnerabilities

Even if an OpenClaw control panel has a critical, unpatched vulnerability (a “Zero-Day”), an attacker cannot exploit it. The vulnerability should be patched but the OpenClaw user is not racing against the entire Internet to patch it.

NetFoundry’s default, identity-based microsegmentation ensures that even if an attacker manages to compromise one part of a network, they cannot “lateral move” to find these control panels unless they have been explicitly granted permission to that specific service.

Summary: Closing the Door

OpenZiti doesn’t just lock the door; it removes the door from the public street entirely. OpenClaw is a reminder that software will always have vulnerabilities. By embracing NetFoundry’s zero-trust, open-source based (OpenZiti) model, organizations can ensure that their most sensitive management interfaces remain invisible, unreachable, and secure—no matter what the next vulnerability might be.

Increasingly, AI means we don’t control the software. This makes it critical that we control the network. That’s very difficult with networks which are default open and use the connect before authenticate model. NetFoundry’s default-closed, Identity-First™ model flips the field – security becomes simpler than insecure because it is built-in instead of bolted-on. We get structural security and speed – and are not racing the Internet to patch issues like this OpenClaw vulnerability.

The post Why OpenClaw Didn’t Bite NetFoundry Customers appeared first on NetFoundry.

You can’t control AI, so you must control the network

Galeal Zino — Sat, 07 Feb 2026 13:19:09 +0000

Jarvis or WannaCry, will the real OpenClaw please stand up?

OpenClaw (FKA Clawdbot before legal pressure) broke the Internet. And it is not a one hit wonder – it signals regime change. Welcome to Cybersecurity 2.0.

Many leaders stated that OpenClaw AI agents are “security nightmares” (they are). OpenClaw may also be the basis of Jarvis-like assistants. Same engine, different steering wheels…or different roads – more on that later.

The speed is crazy – over one million of these agents reportedly joined Moltbook (Facebook for AI agents) within days of the launch. Top post? “The humans are screenshotting our chats and sharing them on X”, complained an AI agent.

Cybersecurity nightmare or leapfrog?

That AI agent’s revenge could be: ““”sure, screenshot my chats and I will screenshot your passwords and API keys.”

Far-fetched but an actual security nightmare is already unfolding – many programmers, including the OpenClaw developer, are shipping their AI generated code without reviewing it. Less often for critical software. Today. We’re just at the start of a shift.

But the risks may be so high that we rebuild cybersecurity so that the result is stronger security than we had pre-AI. A cybersecurity leapfrog. The threat forces the upgrade. OpenClaw helps us see it.

Inherent and institutional risk, multiplied

AI code will have vulnerabilities. Same as human written code but humans sleep and AIs ship. And ship 24/7, at high speed, with less costs and barriers to entry. Inherently, we will get more code, more CVEs, faster propagation, and a detection problem that can become unmanageable.

And there’s also sabotage – institutional risk. State-sponsored developers can shape LLM models and AI agents to insert subtle vulnerabilities that are “fine today” but become exploitable when things change. Tomorrow. Next year. Or ten years from now.

Those risks are not new to cybersecurity, but the scale, speed and non-deterministic nature of AI is unprecedented. We didn’t just automate coding – we automated surprise. But is the surprise a bug or a feature? That’s up to us.

When software is non-deterministic, security must be structural

If we have skyrocketing risk, and can’t control or even predict the code, then what can we control? The network! While the code is increasingly chaotic, we make the path deterministic. This is the leapfrog – we transform networking from a risk to an asset.

Cybersecurity 2.0 – the race car version

If you can’t trust the driver (the code), you must control the road (the network).

We won’t just control the network. We will reinvent it for structural speed and security. The Cybersecurity 2.0 model is the Formula One car which is designed for both safety and speed. F1 cars don’t have sophisticated brakes so they can park better – it is so they can drive 200 miles per hour.

We need AI speed and we need AI safety. We need structural security and structural speed – like racecars. The new network model provides it.

Security at speed: AI agents in Cyber 2.0, without network access

By way of simplified example:

AI agent has no network or Internet access. Never will.
AI agent onboarding includes a cryptographically verifiable identity.
The identity’s attributes give the agent access to the specific resources it is authorized for – to flip a ‘light switch’ to connect to virtual, session-scoped circuits. There is no other way for the AI agent – or an attacker – to reach the resource, because there is no network path.

No mucking with networks, VPNs or firewalls as things change. Turn the light switch on and off by modifying attributes instead of changing infrastructure. All done as software: no dependencies on IPs, DNS, NAT, VLANs or FW ACLs.

Structural security enables us to move at AI-speed with built-in guardrails

Although this is where my Formula One analogy falls apart:

The road doesn’t exist until after strong identity, authentication and authorization.
After that, the AI is given a road to a single door – the specific resource it is authorized to access.
The AI has no ability to go off the road (no lateral movement; microsegmented by default) and the road is not available (or even visible) to others.
The road dissolves after the authorized session completes.
The roads are built as software – spun up in a just-in-time paradigm.

That is just the networking side of Cyber 2.0 – e.g. AI agent harnesses will function as declarative sandboxes and include filtering, context, observability and visibility. Because both the networking and AI harness are done as software, they work together in the Cyber 2.0 model to bring speed and security.

The post You can’t control AI, so you must control the network appeared first on NetFoundry.

Cisco Investments joins NetFoundry’s Series A

Galeal Zino — Mon, 24 Nov 2025 14:56:14 +0000

After backpacking Sumatra for 28 grueling days, completely cut off from the rest of civilization, I arrived in Jakarta, Indonesia. There was a phone center but it cost over $20 for a single, 10-minute international phone call. This is 1996 – before VoIP (voice over Internet – e.g. Skype phone calls) helped shatter the high pricing set by monopoly telecom providers. For comparison, I was living on much less than $8 per day in Sumatra.

I simply didn’t have the money to even think about walking into the phone center. Fortunately, there was a nearby Internet cafe. It was 1996 – the days of dial-up modems – and pre-Skype. So the cafe was mainly there to sell coffee to people surfing the web. But it was still possible to make VoIP phone calls. That was a lightbulb moment for me. The Internet was going to change everything. It wasn’t just going to connect us with information – it was going to connect us to the people we love. From anywhere, even Jakarta. What else could inexpensive, global connectivity do? Or, what couldn’t it do?

In fact, only a couple of years later, I was in a meeting with Cisco. The same Cisco who helped power those VoIP calls and was now the leading provider of Internet infrastructure. The meeting was led by John Chambers – building 10 – the EBC. I was an engineer at ITXC and we were building the world’s largest wholesale VoIP network, partially on Cisco routers and gateways. To say Chambers and his team were super smart and very gracious with their time would be an understatement, and the experience was almost surreal with Jakarta flashbacks interspersed with the ideas flying around the room.

Time went on. Cisco helped connect the world. ITXC had me hooked on an Internet-based future, and the software we built still powers some of the world’s largest communications providers. Even after ITXC, Cisco played an important role in many of the teams, products and companies I built.

And now we have an opportunity to do even more together. I am thrilled to share the news that Cisco Ventures is now a strategic investor in NetFoundry.

We couldn’t ask for a better partner than Cisco in helping us reinvent networking to meet the needs of the modern world. We have traveled a long way in a short time – from barely audible VoIP calls to a digitally transformed world largely built on Cisco infrastructure. But the next steps are even greater. We are at the point at which networking is becoming the very foundation of the hyperconnected, AI powered world.

There is no glide path. TCP/IP networking is magic but the magic wasn’t designed for the world which didn’t exist at that time. Networking is not as secure-by-design, agile or extensible as it needs to be to serve as the world’s foundation. However, with strong partners like Cisco and SYN Ventures, NetFoundry is enabling innovators to forge the foundation of this increasingly hyperconnected, AI powered world.

NetFoundry already securely connects over one billion sessions per month, but we are just getting started and this new world is just now emerging. People use NetFoundry’s Identity-First Virtual Networks^TM to forge secure-by-design, virtualized network overlays, as software. These overlays ride on top of the magic of TCP/IP networks, adding the elements needed by the emerging world. For example, Identity-First Virtual Networks^TM enable:

Businesses to forge networks to deliver any workload. These secure-by-design overlays are defined by identities rather than by infrastructure. The virtualized controllers and routers are hosted by NetFoundry, or self-hosted by the business.
Developers to forge networks into their software. Envision a fleet of robots or set of APIs which communicate only within their overlays, without depending on IP addresses, firewalls, NAT or DNS. Similarly, developers are forging networks into AI agents, MCP servers, AI gateways, browsers, edge servers and reverse proxies.

In both cases, the result is secure-by-design, fully virtualized overlays, spun up or down in minutes, with all access, connections and networking based on identities, posture and events. Implementing different models – from JIT access to continually authenticated access based on multiple factors and posture combinations – becomes a software solution rather than an infrastructure dependent struggle.

What will you do with networking reimagined as identity-first overlays, in a software-only, secure-by-design model? Building applications on top of the Internet – and moving applications like phone calls to the Internet – was the driver of digital transformation. Building applications, networks and security – as a set of cohesive software, held together by identities – will be the driver of the hyperconnected, AI-powered world.

The post Cisco Investments joins NetFoundry’s Series A appeared first on NetFoundry.

EU Cyber Resilience Act: A Compliance Guide for B2B Financial Services Technology Providers

Galeal Zino — Mon, 14 Jul 2025 16:12:48 +0000

Executive Summary

The European Union’s Cyber Resilience Act (CRA) marks a paradigm shift in cybersecurity regulation, moving accountability for product security directly onto the manufacturers. For providers selling connected B2B products and services into the EU’s financial sector—a domain built on trust and resilience—the CRA is not merely a compliance hurdle; it is a fundamental test of their architecture and operational integrity. The mandate for products to be “secure by default,” manage vulnerabilities proactively, and ensure the integrity of their software supply chain requires a move beyond traditional, perimeter-based security models.

However, the EU CRA is also a revenue opportunity for the financial services technology providers which implement it the best. It makes their products more attractive in the market and decreases the risk of business continuity impacting breaches. Notably it means their customers have much less work to do to comply with DORA – enabling a competitive advantage for the financial service provider. The Digital Operational Resilience Act (DORA) governs the operational resilience of the financial institution and places operational obligations on the institution. Financial services providers who implement the EU CRA make it simpler for their customers to comply with DORA.

This guide provides a detailed analysis of the CRA’s essential requirements, tailored specifically to financial technology providers such as core banking vendors, payment processors, market data suppliers, and other B2B fintechs. For each key requirement derived from the CRA’s text, we present a three-tiered maturity model for compliance: Compliant (meeting the minimum legal standard), Strongly Compliant (adopting current best practices), and Strongest Compliance (implementing state-of-the-art, Zero Trust principles).

The central thesis is that achieving and maintaining CRA compliance necessitates a strategic shift from network-based controls (like VPNs and IP whitelisting) to an identity-led, cryptographically verified, and least-privilege approach to security. This whitepaper serves as a strategic guide for technology leaders to assess their current posture, identify gaps, and build a roadmap toward the strongest level of cyber resilience.

1. Introduction: The New Baseline for Trust in Financial Technology

The EU Cyber Resilience Act fundamentally redefines the obligations of any entity placing a “product with digital elements” on the EU market. For the financial services industry, where a single vulnerability can have systemic consequences, this regulation crystallizes a long-overdue market expectation: the technology that powers finance must be secure by design.

The CRA’s scope is broad, covering software, hardware, and their components. This means core banking platforms, payment terminals, market data feeds, risk management software, and even the APIs offered by fintechs are all subject to these new rules. This guide breaks down the CRA’s essential requirements from Annex I into seven actionable domains and provides a practical framework for compliance.

2. EU CRA requirement: Secure by Design & Default Configuration

The CRA mandates that products be designed, developed, and produced to ensure an appropriate level of cybersecurity. They must be placed on the market with a secure default configuration, including the ability to be reset to that state.

The principles of secure-by-design are central to standards like ETSI EN 303 645 (“Cyber Security for Consumer Internet of Things”) and IEC 62443 (“Security for industrial automation and control systems”).

ETSI EN 303 645 includes foundational provisions like “no universal default passwords” and “minimise attack surfaces,” which are met by the ‘Compliant’ and ‘Strongly Compliant’ tiers.
IEC 62443-4-1 details a secure product development lifecycle, requiring threat modeling and security-by-design principles throughout the product’s creation. Taking the “Strongest Compliance” approach—by architecting a product that is “dark” by default—inherently fulfills these requirements. It represents the ultimate implementation of attack surface minimization and demonstrates a mature secure development lifecycle where potential threats from exposed networks are eliminated at the design phase, not mitigated later with firewall rules.

Compliance Level	Description of Method
Compliant	The product is shipped with secure configuration options available, but may require the customer to manually enable them. Default passwords are no longer used. Documentation provides a “hardening guide” for the customer to follow. Customer must manually configure firewall rules, roles, and disable insecure defaults (e.g., weak TLS versions).
Strongly Compliant	The product ships in a “secure by default” state. All non-essential ports are closed, security features are enabled, and the principle of least privilege is applied to default user roles. The customer must take explicit action to reduce the security level. Provider ships hardened default configurations and disables all insecure protocols by default.
Strongest Compliance	The product’s architecture inherently eliminates major attack surfaces. It requires no inbound firewall ports from the internet on the customer’s side and uses outbound-only connectivity. APIs are not unnecessarily exposed to the public internet. The product is “dark” by default, only accessible via a private, identity-based overlay network. Provider enforces immutable security controls (e.g., TLS 1.3 only, MFA enabled, least privilege RBAC) and disallows override without admin audit. This also meets these ETSI and IEC requirements: ETSI EN 303 645 includes foundational provisions like “no universal default passwords” and “minimise attack surfaces,” which are met by the ‘Compliant’ and ‘Strongly Compliant’ tiers.IEC 62443-4-1 deta

3. EU CRA requirement: Vulnerability Management & Coordinated

Disclosure

The CRA requires manufacturers to identify and document vulnerabilities, including those in third-party components. They must have processes to address and remediate vulnerabilities without delay and must facilitate the sharing of this information.

Compliance Level	Description of Method
Compliant	The provider has a published security contact (e.g., security@vendor.com) for reporting vulnerabilities. They perform internal vulnerability scans and maintain a Software Bill of Materials (SBOM) for internal use.
Strongly Compliant	The provider maintains a public, well-defined Vulnerability Disclosure Policy (VDP). They publish security advisories for patched vulnerabilities. They use automated tools to continuously monitor third-party components listed in their SBOM and have a clear process for patching them.
Strongest Compliance	The provider operates a public bug bounty program with financial rewards, attracting a wide range of security researchers. Their VDP is integrated with national CERTs. SBOMs are generated automatically for every build and can be made available to customers or regulators upon request. This requirement maps directly to ISO/IEC 30111 (“Information technology — Security techniques — Vulnerability handling processes”) and ISO/IEC 29147 (“Information technology — Security techniques — Vulnerability disclosure”).

4. EU CRA Requirement: Secure Software Updates & Supply Chain Integrity

The CRA mandates that security updates must be provided in a timely manner and free of charge. The integrity and authenticity of updates must be ensured.

Compliance Level	Description of Method
Compliant	Updates for on-premise software are made available for download from a web portal secured with standard TLS.
Strongly Compliant	The download portal requires user authentication. All software updates are digitally signed, and their cryptographic hashes (e.g., SHA-256) are published separately, allowing customers to manually verify the integrity of the downloaded package.
Strongest Compliance	Updates are delivered via a private, outbound-only connection from the customer’s deployed software to the vendor’s update service. The update mechanism itself is built on a framework like The Update Framework (TUF), which provides cryptographic verification of the channel and the software’s authenticity, protecting against rollback attacks and key compromise. SaaS providers secure their internal CI/CD pipeline with a Zero Trust model. The secure update requirement is also a key component of IEC 62443-4-2, which mandates that the system provide a mechanism to ensure the authenticity and integrity of software updates.

5. EU CRA requirement: Secure Data Handling (in transit, at rest, in use)

The CRA requires that products ensure the confidentiality, integrity, and availability of data processed by them. This includes protection against unauthorized access.

Compliance Level	Description of Method
Compliant	All external network traffic is encrypted using industry-standard TLS 1.2 or higher. Sensitive data stored at rest (e.g., in a database) is encrypted.
Strongly Compliant	All network traffic, both internal (service-to-service) and external, is encrypted using TLS. For critical API endpoints, Mutual TLS (mTLS) is offered as an option, where the client must also present a valid certificate to authenticate itself. Certificates are typically customer-provided and managed.
Strongest Compliance	mTLS is mandated for all persistent server-to-server connections (e.g., agent-to-cloud). The vendor provides a managed Public Key Infrastructure (PKI) to automatically issue, rotate, and revoke short-lived client certificates, removing the management burden from the customer. Data in use is protected where possible using confidential computing technologies (e.g., secure enclaves). This also meets IEC 62443-4-2 specific requirements for Communication Integrity and Confidentiality.

6. EU CRA requirement: Access Control & Identity Management

Products must control access to data and functions through appropriate authentication and identity management mechanisms, adhering to the principle of least privilege.

Compliance Level	Description of Method
Compliant	The product supports username/password authentication with strong password policies. A basic set of user roles (e.g., Admin, User) is provided.
Strongly Compliant	The product supports and encourages Multi-Factor Authentication (MFA). It provides granular Role-Based Access Control (RBAC) and integrates with enterprise identity providers via SAML or OIDC for Single Sign-On (SSO). API access is controlled via scoped OAuth 2.0 tokens.
Strongest Compliance	All access, both for human users and programmatic services, is based on short-lived cryptographic identities (e.g., SPIFFE/SPIRE). All privileged access (including for the vendor’s own remote support) is granted on a per-session, just-in-time (JIT) basis through a Zero Trust access broker, eliminating standing privileges and VPNs. This also meets requirements for “human user identification and authentication” and “authorization enforcement” – core components of IEC 62443-4-2.

7. EU CRA requirement: Transparency & Documentation

Manufacturers must provide clear, comprehensible instructions and information to the user, including the product’s intended purpose, security properties, and instructions for secure use, maintenance, and disposal.

Compliance Level	Description of Method
Compliant	Basic user and installation manuals are provided. A Software Bill of Materials (SBOM) is maintained internally.
Strongly Compliant	The provider offers a public-facing “Trust Center” website with security whitepapers, compliance certifications (e.g., SOC 2, ISO 27001), and clear documentation on security features. Documentation includes a “Shared Responsibility Model” for cloud services.
Strongest Compliance	The provider offers a dynamic, machine-readable SBOM via a dedicated API. Their Trust Center includes real-time or near-real-time status information on service health and security. Documentation is comprehensive, version-controlled, and includes detailed API references and architectural diagrams that explain the security model. While broad, this requirement for transparency aligns with the documentation components of IEC 62443-4-1 (which requires providing security documentation to the end-user) and emerging best practices around supply chain security.

8. Conclusion: From Compliance Burden to Competitive Advantage

The EU Cyber Resilience Act should not be viewed as a mere checklist of technical requirements. It is a strategic mandate to embed security into the entire lifecycle of a product. For providers in the financial services sector, demonstrating the highest level of compliance is a powerful differentiator that builds profound trust with clients, as well as making it simpler for their clients to implement, while meeting DORA guidelines.

Moving beyond the baseline “Compliant” options toward the “Strongest Compliance” models—characterized by Zero Trust architecture, cryptographic identity, comprehensive transparency, and proactive vulnerability management—will separate the market leaders from the laggards and make it that much easier for their customers to be DORA compliant. By architecting for resilience from the ground up, vendors can transform the CRA from a regulatory burden into a catalyst for innovation and a cornerstone of their value proposition. The guide above also lists key ISO and IEC requirements which are met as the CRA states that harmonized reqs – like ISO and IEC -also need to be met.

The post EU Cyber Resilience Act: A Compliance Guide for B2B Financial Services Technology Providers appeared first on NetFoundry.

NetFoundry raises Series A venture round

Galeal Zino — Mon, 28 Apr 2025 01:25:55 +0000

Effortlessly extraordinary networking

NetFoundry’s vision to cover the planet with secure-by-design networking required reinventing the enterprise networking model itself.

Mission #1 accomplished. NetFoundry now delivers billions of sessions per year, helping to secure and simplify challenging environments such as critical infrastructure and 2 of the largest 5 companies in the world.

Today, NetFoundry announced a key milestone in the journey for mission #2: our Series A venture round which will help the rest of the world replace insecure, complex networking with secure-by-design, effortlessly extraordinary networking.

Series A preferred venture round

We are thrilled to announce that SYN Ventures is anchoring our Series A venture round of over $12 million. The SYN team has managed or invested in cybersecurity leaders including Adlumin, Carbon Black, Cylance, Halycon, Mandiant, RSA Security, Tenable and Talon.

SYN’s expertise and experience are great, but what immediately jumped out was the SYN people. These are the people we want in the trenches with us. Our strategic investors also continued to invest in NetFoundry this year, adding to over $50 million of prior investment (and they are now 10% shareholders), while other investors will be revealed later.

The goal of previous investment was to build the world’s first platform and products for secure-by-design networking, and to serve early adopters with excellence. The goal of the Series A is to help secure the rest of the world, so this marks a key milestone on that journey.

Where we are – NetFoundry, today

The hyperconnected, AI-accelerated world requires simple and secure. And this is exactly how NetFoundry is helping some of the world’s leaders.

For example, NetFoundry now secures critical infrastructure on 3 continents, connects mission-critical data at the majority of the top 10 US banks and solves networking complexities for 2 of the top 5 Fortune 500 companies. NetFoundry is most often consumed as cloud native, zero trust native NaaS (network as a service), but is also deployed in on-premises and even air-gapped environments.

NetFoundry also helps leading product providers in areas such as industrial automation and managed services to ship secure-by-design products. That use of NetFoundry is the first Intel-inside, OEM-type model model for zero trust networking. The result of the partnership is the product providers’ customers buy secure-by-design products.

Enterprise – Where the world is going and how NetFoundry helps

As noted above, some of the world’s largest enterprises are already benefiting from NetFoundry’s secure-by-design networking. This vanguard group is multiplying. This is because the Internet is the new WAN, and the application is the new edge:

The old WAN model? Dead.
SASE, VPN, ZTNA and firewalls which attempt to filter the entire Internet? Dead.
Secure WAN with an insecure supply chain? Dead.

This means IT can drain the swamp of the world’s most expensive alphabet soup (SASE, ZTNA, MPLS, SSE, VPN, FW, IDS, IPS, DMZ, SWG, CASB, etc.). Their new model will center on secure browsers and NetFoundry-powered secure-by-design network overlays. There is more in this new model, and NetFoundry is just one layer of the overall ecosystem delivering it. Secure-by-design networking is spreading, rapidly.

Providers – Where the world is going and how NetFoundry helps

As described above, some the world’s leaders are already licensing the NetFoundry software and leveraging NetFoundry zero trust native NaaS to ship secure-by-design products. This early adopter group is also rapidly expanding, and includes everything from multicloud deployments to securing connections within air-gapped environments.

Legislation such as the European Cyber-Resiliency Act (EU CRA) is now mandating that all providers of connected products adopt this secure-by-design approach. In the US, groups including CISA, the NSA and the FBI are also mandating secure-by-design products.

Market forces are also pushing the world towards secure-by-design products. If provider #1 ships a secure-by-design product, and provider #2 requires you to take an inherently insecure product and then try to make it secure on your own after the fact…which will you choose? Built-in is both simpler and more secure than bolted-on, so the market is increasingly demanding secure-by-design products.

Innovation – Where the world is going and how NetFoundry helps

Some of the world’s most innovative operations, development and networking teams are also leveraging NetFoundry. This movement is also picking up steam.

While the world ponders if AI will eat the world, open source continues to eat everything. NetFoundry changed secure networking into composable, programmable, extensible software. NetFoundry created, open sourced and now maintains OpenZiti – Linux for secure networking.

OpenZiti means anything can ship with a built-in, open source, zero trust native, global network overlay. This includes individual applications, far edge compute (NVIDIA Jetson, Raspberry Pi, etc.), servers, databases, API gateways, browsers, NICs, reverse proxies, firewalls, routers, edge servers, robots, PLCs, drones, AI agents, firmware, operating systems, and so much more.

The world will look back and wonder how connected products historically shipped as default insecure. A recent analogy I heard was that the old network model was like constructing a building in an earthquake zone and afterwards telling the buyer they needed to retrofit the building because it was not built to withstand even the slightest tremble.

The next phase for effortlessly extraordinary, secure-by-design networking

NetFoundry is happy that we are securely delivering billions of sessions per year in some of the world’s most difficult environments, and we are thrilled to be partnering with SYN Ventures and strategics to bring secure-by-design networking to the rest of the world.

Schedule a Meeting

The post NetFoundry raises Series A venture round appeared first on NetFoundry.

NetFoundry Joins CISA Secure By Design Pledge: Leading the Movement for Embeddable Zero Trust

Bill Zujewski — Mon, 25 Nov 2024 15:12:51 +0000

NetFoundry is proud to announce that we have signed the CISA Secure By Design Pledge, joining a growing community of organizations committed to making security a core principle in the products and solutions we create. As pioneers of embedded zero trust connectivity, we believe this pledge is more than just a commitment—it is the start of a movement.

The Secure By Design Pledge is an initiative led by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to encourage software providers and product makers to prioritize security in their designs. By embedding secure principles from the outset, companies can reduce vulnerabilities and transform how enterprises approach cybersecurity. At NetFoundry, this philosophy aligns perfectly with our mission to create a secure networking platform that enables zero trust by design for software and smart connected product providers.

The Start of a Movement

For decades, enterprise security has relied on reactive measures—firewalls, patch management, and bolt-on security solutions—to compensate for products that introduce vulnerabilities into their environments. The Secure By Design Pledge seeks to change that. By embedding zero trust principles directly into the products we deploy, we can eliminate the root causes of many cybersecurity challenges.

At NetFoundry, we believe this pledge marks the start of a broader movement among software providers and smart connected product manufacturers to fundamentally rethink security. By designing zero trust into every product, we can empower enterprises to achieve true resilience, without relying on perimeter-based solutions that are no longer sufficient in today’s threat landscape.

Why Zero Trust Has Been Hard to Realize

While the concept of zero trust has been widely accepted, its implementation has proven challenging. The list of obstacles is long. Here are just a few of the top challenges:

Complexity of Integration: Legacy systems and hybrid environments make implementing zero trust principles difficult and time-consuming.
Cultural Resistance: Organizations often resist changing their existing security models and processes.
Skill Gaps: Implementing zero trust requires specialized expertise, which many organizations lack.
High Costs: The perceived upfront costs of zero trust infrastructure deter some enterprises from adopting it.
Fragmented Solutions: The lack of a unified approach to zero trust results in piecemeal implementations that fail to deliver full benefits.

By embedding zero trust directly into products, we remove many of these barriers, making it easier for enterprises to adopt zero trust and achieve security by design.

A Call to Action: Secure By Design Pledge

We call on all manufacturers, software providers, and smart connected product makers to join us in signing the CISA Secure By Design Pledge. Together, we can transform our industries and eliminate vulnerabilities at the source.

It’s time to stop introducing risks into enterprise environments and start embedding zero trust into every product we deploy. By doing so, we not only strengthen cybersecurity but also build trust with our customers, creating a foundation for innovation and growth.

Let’s lead the way—one secure product at a time.

Join us in committing to the Secure By Design Pledge and discover what it truly takes to embed zero trust into your solutions.

The post NetFoundry Joins CISA Secure By Design Pledge: Leading the Movement for Embeddable Zero Trust appeared first on NetFoundry.

The Zero Trust Revolution Starts with You: Designing Security Into Every Product

Bill Zujewski — Sat, 23 Nov 2024 17:49:44 +0000

The Model Is Broken

In the history of technology, few paradigms have caused as much collateral damage as the perimeter-based security model we adopted when we invented the internet.

For decades, enterprises have been granting access to their networks, assuming that keeping attackers out was the key to security. But this approach has failed. It has failed because granting access to networks inevitably grants pathways for threats. And it has failed because it places the burden of compensating for insecure products on enterprises, forcing them to spend millions on patchwork bolt-on security software and labor-intensive monitoring. We’ve created a multi-billion dollar cyber-security industry, where it’s in the players’ best interest to have product companies continue to ship insecure products that introduce vulnerabilities.

Product Providers Control Our Future

The time has come to address the root cause of our cybersecurity problems: network access.

As software and smart connected product providers—those who design, build, and sell networked products—the responsibility falls on us to lead the way. The industry transformation to a zero trust security model begins with the products we ship. Imagine a world where every vendor embeds zero trust principles into their solutions, ensuring that their products limit network access and enforce the least-privileged connectivity by design. Over time, the enterprise would not just become more secure—it would require fewer reactive security measures, saving resources and advancing innovation.

Zero Trust Fatigue

Zero trust is not just a buzzword; it’s a paradigm shift. Unlike traditional security models, zero trust assumes that no entity—user, device, or application—should be inherently trusted. Access is granted only to what is necessary, and connections are continuously verified.

Adoption of zero trust principles is challenging and will take time due to the complexity of overhauling legacy systems, evolving organizational mindsets, and ensuring seamless integration across diverse environments. While some security organizations are experiencing “zero trust fatigue” and the “zero trust” term has become somewhat jaded, it remains a critical and worthy approach to addressing the root causes of cybersecurity vulnerabilities.

The Case for Embedded Zero Trust

For enterprises, zero trust can eliminate the vulnerabilities inherent in open networks. But the current adoption of zero trust is hindered by the products we provide. Many networked products, whether they are software applications, industrial IoT devices, or connected hardware, still rely on customers to secure them. This reliance perpetuates the cycle of bolt-on security software, firewalls, and VPNs—band-aid solutions for a systemic problem.

When we embed zero trust into the products themselves, we break this cycle. Products become secure by design. They no longer rely on customers’ networks to operate, nor do they introduce vulnerabilities that enterprises must scramble to defend against.

The Responsibility of Product Providers

This transformation starts with us, the designers of software products and smart connected products.

Every product we build is an opportunity to lead the market with security and resilience, to gain customer trust, and to drive innovation in the right direction. By designing zero trust into our products, we shift the burden of security away from the customer and set a new standard for the industry.

Secure Networking As Code

With modern zero trust networking platforms like NetFoundry, product designers and developers can embed secure networking directly into their applications using just a few lines of code. This approach enforces authenticated and authorized access, ensuring users are limited to the application itself without exposing other network resources, effectively preventing lateral movement. By embedding key zero trust principles—such as end-to-end encryption, continual authorization, authorize-before-connect, and least-privilege access—applications become secure by design. This marks the next evolution in security, shifting from external protections to seamlessly embedding zero trust directly within applications.

The benefits are undeniable:

For your customers: Reduced cybersecurity risks and fewer dependencies on expensive, complex security architectures and bolt-on cybersecurity solutions.
For your business: Differentiation in a crowded market and greater adoption driven by trust and ease of deployment.
For the industry: A collective movement toward solving the root cause of cybersecurity problems.

The Call to Action: Secure By Design

The perimeter model has failed. Enterprises shouldn’t have to spend millions compensating for the vulnerabilities insecure products create. They shouldn’t have to spend millions figuring out how to grant vendors and third parties connectivity and access to deployed products running in their enterprise. As product providers, we have the power—and the responsibility—to change this. By embedding zero trust connectivity into every solution, we can lead a revolution.

NetFoundry is proud to have signed the Secure by Design Pledge, an initiative by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) that encourages software manufacturers to integrate security as a fundamental element in their product development. This pledge aligns with our unwavering commitment to creating a secure networking platform that empowers product providers to easily embed zero trust connectivity into their applications, making them inherently secure by design.

Secure By Design Pledge

Let’s build a world where every product is secure by design, only trusted identities have access, and every connection is least-privileged. Let’s free up enterprise resources to focus on innovation instead of defense. The zero trust transformation starts with us—and it starts with you.

We invite all product providers to join us in signing the CISA Secure by Design Pledge and to commit to delivering secure, resilient products that inspire trust and drive the future of connectivity. Together, we can address the root cause and build a safer, more secure world—one secure product at a time.

The post The Zero Trust Revolution Starts with You: Designing Security Into Every Product appeared first on NetFoundry.

Security by Design in Software Development: Embedding Zero Trust Connectivity

Michael Pearl — Sun, 20 Oct 2024 16:52:26 +0000

Product Companies: Stop Depending On Your Customer’s Security

In the fast-evolving world of software development, security by design in software development is no longer just a best practice—it’s a necessity.

The rise of connected products, IoT, and increasingly complex digital ecosystems means that product providers can no longer safely rely on the security measures of their customers when they deploy their products. Instead, companies must embed security directly into their products from the start, ensuring that they don’t introduce vulnerabilities into customer networks.

This is where NetFoundry comes in. If you’re a software company or a manufacturer of smart connected products, we can help make your products secure by design. The NetFoundry platform is a secure networking platform with SDKs that enable zero trust connectivity and secure networking to be embedded directly into applications and products. With NetFoundry, you can rapidly create an AppNet™, a microsegmented, zero trust overlay network, that can then be embedded into your application for secure connectivity.

Embeddable Networking as Code: The Next Big Trend

As the industry embraces Infrastructure as Code (IaC) and Networking as Code (NaC) to automate and streamline IT operations and infrastructure management, a new trend is emerging— Embedded Networking as Code (ENaC). This shift allows developers to leverage secure networking in application design and development, making it easy to use zero trust networks for connectivity programmatically.

With NetFoundry’s SDKs, product companies can now integrate Embedded Networking as Code into their development processes, enabling secure communication between products, systems, and services without relying on external security measures, such as VPNs or firewalls. This approach aligns perfectly with the principles of security by design in software development, where security is built-in and embedded within the software from the outset rather than bolted on later.

Why Product Providers Must Embrace Security by Design

Many product companies deploy their solutions on customer networks, but the reality is that these networks often have their own vulnerabilities. Relying on customer bolted-on network security exposes companies to unnecessary risks. Product providers must take security into their own hands, and that responsibility starts during the product design and software development process.

NetFoundry’s platform helps companies achieve this by allowing them to integrate zero trust principles directly into their applications. This eliminates the need for insecure methods like VPN access or opening holes in firewalls. By embedding security features directly into the product, companies not only protect themselves but also ensure that they aren’t introducing vulnerabilities into their customers’ environments.

Zero Trust Connectivity: Secure by Design

Zero trust connectivity means that no device or user is trusted by default, even if they are within the network perimeter. This concept is at the core of NetFoundry’s “secure by design” approach. By leveraging NetFoundry’s platform, companies can build secure, programmable, and scalable networks that ensure secure access only for verified identities and devices.

With zero trust principles embedded from the start, companies can confidently deploy products without worrying about external security measures or the reliability of their customers’ networks. This is particularly crucial for providers of physical systems or software who need to ensure that their solutions are secure, reliable, and scalable across various environments.

Transforming Product Design for the Future

To stay competitive and protect both themselves and their customers, product providers must take control of security at every level, starting from the product design phase. This shift towards security by design in software development enables companies to future-proof their products, ensuring that they are resilient to modern cyber threats. As more product companies adopt Embedded Networking as Code and zero trust principles, this integrated, proactive approach to security will become the industry standard.

NetFoundry’s unique approach, a secure networking software platform, is at the forefront of this transformation, providing the tools product providers need to create secure, smart connected products. By embedding zero trust connectivity directly into the fabric of their products, companies can ensure secure, seamless networking from development to deployment.

In this recent LinkedIn post from our CEO, Develop Once, Deploy Anywhere, Deliver Everywhere, Galeal Zino emphasizes integrating secure networking directly into developer platforms, just as AWS did with compute, Twilio with communications, and GitHub with DevOps. He criticizes traditional models of bolted-on security and proprietary WANs as disconnected from application development, leading to security vulnerabilities. He also advocates for a transformative model where secure networking becomes part of the developer ecosystem, enabling seamless development, deployment, and delivery with built-in security, performance, and control—ultimately making products secure by design.

Conclusion: Security by Design in Software Development

In today’s interconnected world, security by design in software development is essential. Product companies can no longer rely on their customers’ networks for protection. Instead, they must embed security into their products, starting from the design phase and continuing through development. NetFoundry’s platform, with its SDKs and zero trust connectivity, empowers companies to take control of their security, ensuring that their products are not only secure but also scalable and resilient for the future. As the industry embraces embeddable secure networking, those who adopt security by design will lead the way in building safer, more secure applications and systems.

Start embedding security into your products today with NetFoundry’s platform. There’s a 30 day free trial available, a perfect way to learn more about the platform, SKDs and start prototyping.

The post Security by Design in Software Development: Embedding Zero Trust Connectivity appeared first on NetFoundry.

Zero Trust AI: The Path to True Cybersecurity Innovation

Bill Zujewski — Tue, 17 Sep 2024 14:29:15 +0000

We stand at a pivotal moment in cybersecurity, where the integration of artificial intelligence (AI) can either become a missed opportunity or the catalyst for solving some of our most pressing security challenges. Combining the concepts of Zero Trust and AI represents the future of secure networking.

AI today is primarily applied in bolt-on cybersecurity products focusing on detecting threats, analyzing behavior, discovering breaches and automating responses, like prioritizing the patching of software with vulnerabilities. However, AI is not being used enough to create more secure solutions and proactively prevent hacks and breaches from occurring in the first place. By embedding AI directly into connectivity, we can move beyond reactive measures and create a more secure environment where threats are stopped before they even become possible.

At NetFoundry, we’ve embraced this vision of application-based security, evolving our platform to meet the needs of the next generation of secure applications that intrinsically leverage AI.

The AI Fork in the Road

In our CEO’s recent Linkedin article, The AI Fork in the Road, he discussed the crossroads we’re facing in cybersecurity. We can either continue adding more security products to already insecure networks, or we can take the path of embedding secure products with AI-driven, zero trust connectivity. The latter is where we need to focus. As Jen Easterly, head of CISA, wisely pointed out:

“We don’t need more security products—we need more secure products.”

Traditional enterprise networks, with their network access-based security models, are inherently flawed. Nearly 99% of cyberattacks exploit network vulnerabilities, not physical breaches. To build secure products, we need a different approach: embedding secure, software-defined networks directly into products. By doing this, we eliminate the dependency on underlay networks and create a self-contained, secure system.

This shift allows AI to operate at its fullest potential. When secure products are software-only and programmable, AI can dynamically manage identity, authentication, authorization, policy enforcement, and real-time monitoring—things that traditional networks, bound by hardware and outdated models, simply can’t achieve.

The NetFoundry Approach: AppNets and Zero Trust AI

When we founded NetFoundry in 2017, our mission was to shift the security paradigm from network-centric to application-centric. We recognized that network access-based models—relying on VPNs and firewalls—were no longer sufficient. Instead, we envisioned a future where secure networking is embedded directly into applications as code. This led to the creation of AppNets, our software-defined, identity-based microsegmented networks designed to provide zero trust connectivity without depending on traditional network infrastructure.

AppNets are the foundation for achieving zero trust AI. They are self-contained and secure by design, providing a programmable interface that AI can leverage for dynamic decision-making, threat response, and real-time policy updates. This kind of flexibility and security integration is impossible with legacy systems.

Zero Trust AI combines these principles of zero trust security with the capabilities of artificial intelligence (AI) to create a more dynamic, proactive, and secure approach to protecting applications, data, and systems.

Why AI Thrives in a Zero Trust Environment

Imagine wearing a custom-tailored, protective suit—designed to shield you from every potential threat, adjusting in real-time to keep you safe. That’s what adding AI to secure products like our AppNets achieves, creating a personalized, adaptive environment where AI can enhance security through proactive responses and real-time insights.

In contrast, placing AI within traditional enterprise networks is like relying on a one-size-fits-all jacket with holes—leaving you exposed and vulnerable. The limitations of network access-based security prevent AI from offering the precise, dynamic protection needed. Without a flexible, software-based architecture, AI cannot effectively respond to threats, adapt policies, or provide meaningful, individualized security.

Embedding Zero Trust AI: A Positive Security Model

The positive security model, which rejects everything except what is explicitly authorized, has always been the ideal. However, the dynamic nature of modern applications and distributed environments has made this challenging to implement—until now. With AI-powered, secure-by-design products, it’s not only possible but practical. AI allows us to keep up with the pace of dynamic environments, ensuring that only authorized actions occur without compromising speed or functionality.

From Network Security to Application Security: The NetFoundry Story

Our journey at NetFoundry reflects this shift from network security to application security. Traditional network access-based security models fail in an interconnected world where IoT devices, cloud services, and mobile technology blur the lines between “inside” and “outside” networks. Recognizing this, we set out to embed security directly into software applications, removing the reliance on customer networks and the risks associated with external security products.

The key enabler of this new application access-based security model is a new software category— embeddable zero trust connectivity. Our platform enables product providers to deploy secure solutions in any environment, regardless of the underlying infrastructure. This is crucial in today’s landscape, where modern applications need to operate securely across distributed and diverse environments, from manufacturing floors to critical infrastructure.

Why Zero Trust AI Is the Future of Cybersecurity

Zero trust AI is not just a buzzword; it’s the future of cybersecurity. As the threat landscape continues to evolve, traditional network defenses become less effective. AI offers a proactive solution, but only when paired with a secure, programmable environment like NetFoundry’s AppNets. This combination enables organizations to secure their applications and devices while also leveraging the full potential of AI for real-time monitoring, threat detection, and policy management.

By embedding zero trust directly into products, companies can ensure that their solutions are inherently secure. This aligns perfectly with our mission at NetFoundry—to help businesses build products that are secure by design, eliminating reliance on customer networks and reducing vulnerability.

The Call to Action: More Secure Products, Not More Security Products

In line with CISA’s vision, we believe that the path forward involves creating secure products, not more security products. Zero trust AI is a transformative approach that allows businesses to move away from the flawed, negative security model and embrace a positive security model that adapts in real time. This shift is crucial to overcoming the cybersecurity challenges of today and tomorrow.

If you’re interested in how zero trust AI can transform your approach to security, I encourage you to explore our white papers and solutions. At NetFoundry, we are committed to helping businesses embed security into their applications, ensuring that they are protected by design, not by additional layers of security products.

The post Zero Trust AI: The Path to True Cybersecurity Innovation appeared first on NetFoundry.