Most Zero Trust buying conversations start with features. KuppingerCole Analysts’ new Buyer’s Compass: Zero Trust Platforms, written by Alexei Balaganski and commissioned by NetFoundry, starts somewhere more useful: the problem enterprises already have.
“Most enterprises already own the parts: Multifactor Authentication (MFA), Zero Trust Network Access (ZTNA), endpoint posture, microsegmentation, and cloud workload controls are widely deployed. These controls lack a shared policy model. Each runs on its own engine, with its own owner and view of risk, so they rarely make decisions together.”
That’s the gap we hear about from CTOs and platform teams every week. The tools are bought. The architecture that makes them coherent isn’t there yet. Download the Buyer’s Compass.
A person and a machine are different problems
The distinction that runs through the report is one we’ve built NetFoundry around. In KuppingerCole’s words:
“A human session can usually tolerate an intermediary that terminates and inspects traffic, while workload connections are symmetric, frequent, and mutually authenticated, so the same intermediary can break end-to-end authentication, expose data to a third party, and add latency.”
And on where the market stands today:
“No solution on the market covers every use case, and many vendors have focused on securing human access while machine-to-machine connectivity remains far less well served.”
That’s why KuppingerCole’s first recommendation matters so much:
“Name the primary outcome before looking at products.”
Five use cases
The Buyer’s Compass covers five Top Use Cases:
- Microsegmentation and Breach Containment
- Workload-to-Workload and Site-to-Site Connectivity
- AI Agent and Non-Human Access Governance
- Secure Hybrid Workforce and Third-Party Access
- Continuous Risk-Adaptive Access and Session Control
For anyone putting AI agents into production, the third one is where the urgency is. KuppingerCole puts the risk plainly:
“When a copilot, agent, Large Language Model (LLM) gateway, or Model Context Protocol (MCP) server accesses tools and data on behalf of a user or process, the main risk is an authorized identity acting beyond its intended scope. Agent identity, scoped reachability, and fast revocation address this.”
Questions worth asking any vendor
The report closes its evaluation guidance with a full section, Questions to Ask Vendors during RFPs, alongside NetFoundry’s responses. One of our favorite lines from the analysis is about credentials:
“A shared secret or bearer token proves only possession: the check validates the credential presented but not that the sender is the workload it was issued to, which amounts to checking an ID card without looking at the face.”
If your current approach to machine access is API keys and service-account secrets, that sentence is worth sitting with.
Where NetFoundry fits
The Buyer’s Compass includes a Vendor Spotlight on NetFoundry. KuppingerCole writes:
“This focus is deliberate: the market for securing human access is crowded with established solutions, while machine-to-machine connectivity is far less well served, and NetFoundry has built its platform around the latter.”
Among the Strengths KuppingerCole lists:
- “A single identity model covers human, non-human, and third-party connectivity, including flows otherwise handled by site-to-site VPNs and firewall rules.”
- “Private keys are generated on the originating endpoint and never leave it, so NetFoundry cannot decrypt customer traffic.”
- “Service-level microsegmentation for workload-to-workload, service-to-service, API-to-API, and machine-to-machine flows from a single overlay fabric.”
- “MCP Gateway and LLM Gateway make LLM endpoints and MCP servers invisible by default and issue cryptographic identities to AI agents.”
- “OT/IoT and unmodified IP application support through NetFoundry zLAN, including devices that cannot run an agent.”
And on the Leadership Compass:
“In the KuppingerCole Leadership Compass on Zero Trust Platforms 2026, NetFoundry is rated as Product, Innovation, and Overall Leader.”
Get the Buyer’s Compass
“Zero Trust cannot be bought and switched on.”
We agree. The Buyer’s Compass is the best starting point we’ve seen for choosing a platform you can actually operate.
Download the free KuppingerCole Buyer’s Compass: Zero Trust Platforms
This Buyer’s Compass from KuppingerCole Analysts AG was commissioned by NetFoundry.
