At A Glance
- Part one of a six-part series on Zero Trust for AI agents.
- Vendor-hosted AI agents connect inbound into the systems you run, which makes your enterprise a public-facing service provider overnight.
- Vulnerability exploitation was the top way into breaches in the 2026 Verizon DBIR at 31%, and third-party involvement in breaches rose from 30% to 48%.
- Every familiar workaround (allowlists, VPNs, vendor tunnels, and self-hosting) puts something on the internet or inside your network.
- The NetFoundry AI Agent Frontdoor gives each system an identity and a single hostname, so agents get governed access and the systems stay off the public internet.
For most of the SaaS era, traffic ran in one direction. Your people and applications reached out to a vendor’s cloud, and the vendor defended its own front door to the internet. AI agents run that connection in reverse, which hands the front door, and the job of defending it, back to you. To see why that matters, start with how these agents reach in.
How Vendor-Hosted AI Agents Connect to Your Internal Systems
AI agents such as Claude, Microsoft Copilot, and Muse, along with agents embedded in platforms like Salesforce Agentforce and ServiceNow, run in vendor clouds. To do useful work, they reach back into systems you host yourself: ERP, core banking, application databases, and internal MCP servers. The vendor’s agent opens a connection inbound, toward your environment, and calls into systems that were built to sit behind your perimeter.
Why AI Agents Turn Your Enterprise Into a SaaS Provider
SaaS providers run public endpoints and spend billions securing them. As a SaaS customer, you consumed those services without inheriting that cost or risk. Agents erase that division of labor. Every system an agent touches now works like a public-facing service, and your name goes on the incident report when it fails. You are now Salesforce, or Microsoft, with the same exposure and none of their decades of security investment. Most enterprises also lack a plan for the day a vendor’s agent gets prompt-injected into doing something it was never meant to do.
How Vulnerability Exploitation and Third-Party Access Raise AI Agent Risk
Attackers have already shifted toward the weakness agents create. Vulnerability exploitation was the initial access vector in 31% of breaches in the 2026 Verizon Data Breach Investigations Report (DBIR), overtaking stolen credentials as the top way in. Third-party involvement in breaches climbed from 30% to 48%, and every vendor agent is a third party with a path into your systems.
Defenders are also losing ground on fixes. The same report puts the median time to fix known-exploited vulnerabilities at 43 days. Meanwhile, 28% of newly exploited vulnerabilities in the first half of 2026 were already under attack by the day they went public, according to the Zero Day Clock. Patching cannot win a race that starts before disclosure.
Why Allowlists, VPNs, Vendor Tunnels, and Self-Hosting Fall Short for AI Agents
Faced with inbound agent traffic, most teams reach for the tools they already own. Each one carries a cost:
- Allowlists and firewall rules: Publishing the system behind a firewall still requires a public-facing listener on the internet.
- VPNs and private links: Most AI vendors don’t support a VPN or private link into your environment.
- Vendor tunnels: Running a vendor’s proprietary tunnel installs a vendor-controlled network component inside your network, and you need one for every vendor.
- Self-hosting: Hosting the agent yourself means your team takes over operating the vendor’s stack.
Skip all four, and the agent you paid for sits idle. Each option lets the agent in only by opening something you will later regret. Part two of this series breaks down each trade in detail, and our walkthrough of AI agents without the operational and security headaches shows how these trade-offs play out in real agent workflows.
How to Give AI Agents Access Without Opening Inbound Ports
The NetFoundry AI Agent Frontdoor places identity-defined networking between the vendor’s cloud and your internal systems. Each system gets a single hostname. The vendor’s agent calls that hostname with the credential it already uses, so nothing changes on the vendor’s side. The Frontdoor authenticates each request, authorizes it per identity, per service, and per MCP tool, and logs it to your SIEM. Lightweight connectors installed beside each system dial outbound, so the system gets no inbound port, no public DNS record, and no firewall change. One door governs every vendor’s agents and your in-house agents under a single policy model, with a kill switch for each vendor.
Agents turned the perimeter inside out, and the controls that work now sit on the network around the agent. If you can’t control what an agent does, you can control what it can reach.
NetFoundry built the Frontdoor on Identity-First Reachability™, the same architecture that secures billions of sessions for critical infrastructure across healthcare, financial services, and energy. Our founders created and maintain OpenZiti, the world’s most widely used open-source Zero Trust platform. To see how the AI Agent Frontdoor would fit your vendor agents, talk to our team.
Next in the series: a closer look at why allowlists, VPNs, vendor tunnels, and Cloudflare each fall short.
Frequently Asked Questions
What is the NetFoundry AI Agent Frontdoor?
The NetFoundry AI Agent Frontdoor is a controlled entry point that sits between an AI agent hosted in a vendor’s cloud and the internal systems that agent needs to reach. It gives each internal system a single hostname, checks every request by identity and by tool, and keeps the underlying system invisible to the internet. Think of it as a staffed reception desk: visitors reach only the rooms they’re cleared for, and the building has no unlocked side doors.
Why can’t we use our existing firewall or VPN for AI agent access?
A firewall rule or allowlist (a list of approved addresses allowed through) still leaves the system reachable from the internet, so attackers can find and probe it. VPNs and private links would keep traffic private, but most AI vendors don’t offer them. NetFoundry’s AI Agent Frontdoor needs no inbound firewall rule at all, because the connectors beside each system only dial outbound.
Does an AI vendor have to change anything to connect through NetFoundry?
No. With the NetFoundry AI Agent Frontdoor, the vendor’s agent calls a hostname using the credential it already supports, so the vendor’s side of the integration stays exactly as it is.
What happens if one vendor’s AI agent is compromised?
NetFoundry’s AI Agent Frontdoor runs each vendor under its own identity and access policy, with a separate kill switch for each. Your team can cut off one vendor’s access without affecting any other vendor, and every request that agent made is already logged in your security monitoring system (SIEM) for investigation.
