DevOps

Download KuppingerCole's Buyer's Compass on Zero Trust Platforms: use cases, selection criteria and RFP questions for workloads and AI agents.

AI infrastructure and MCP servers run on Linux. CVE-2026-98432, a 9.8-severity kernel TCP flaw, shows why removing network reachability matters as much as patching.

Enterprise-Managed Authorization decides who can use an MCP server. It doesn't build the private path to reach one. Here's how NetFoundry MCP Connect closes the gap.

NetFoundry's Philip Griffiths explains Identity-Defined Reachability (IDR) on the CSA blog: why reachability should be an output of authorization, not a precondition for it.

Every AI agent the business buys becomes a firewall ticket. Outbound-only connectors give vendor agents access with no inbound ports, DMZ, or public DNS.

A critical out-of-bounds write in the Brotli decoder (CVE-2026-111497) hits .NET, Node.js, and Python at once. Patch it, then shrink what an attacker can actually reach.

PHP2Shell runs before your login does. See why an exposed port lets attackers break a service without valid credentials, and how closing inbound ports removes the attack surface.

Every familiar way to let a vendor's AI agent reach your internal systems carries a cost. Here is the trade each one makes, and where NetFoundry Frontdoor wins.

MCP shipped with no auth in 2024. Here’s where its authentication and authorization stand now, what good looks like, and where real deployments still fall short.

Vendor-hosted AI agents call inbound into your ERP, databases, and MCP servers. See how that flips your attack surface and how Zero Trust closes it.

Legacy multi-cloud microsegmentation means a different agent in every cloud. See how one identity-first fabric enforces the same policy across cloud and edge.

This week’s Reachability Watch covers nearly 440 new CVEs, an unauthenticated script endpoint in LMCache, and how Vulnerability Cloaking closes the gap.

Vulnerability cloaking removes an unpatched service's open ports. See how outbound-only, identity-based connections leave attackers nothing to scan or exploit.

Sandbox AI agents with deny-by-default, per-executable network policy enforced by eBPF in the Linux kernel. No container changes, no sidecar proxies.

Network segmentation trusts the address, so attackers with stolen credentials walk right past it. See how cryptographic segmentation ties access to identity.

479 new network-exploitable CVEs, an AI agent platform whose quickstart ships with login off, and how Identity-First Reachability closes the gap.