Reinventing Microsegmentation for the Hybrid, AI-Driven World
Microsegmentation is one of the most effective ways to stop lateral movement, yet only 24% of organizations have deployed it extensively. The reason is deployment complexity: segmentation built on firewall rules, ACLs and VLANs is slow to roll out and risky to change.
In this Technical First Look, Omdia Principal Analyst Justin Boyer reviews how NetFoundry takes a different approach. Instead of IP addresses, NetFoundry uses cryptographic identities for every workload and AI agent, and only connections that identity-based policy allows can be made. Through a live demo across Google Cloud and AWS, Omdia watched NetFoundry secure a private API, hide it from the network and revoke access instantly.
Key takeaways
- Microsegmentation stalls on complexity, not value. 69% of organizations use microsegmentation only moderately or on a limited basis, and 41% name deployment complexity as the main reason they don’t use it more widely.
- Identity replaces the IP address as the basis of policy. Every workload and AI agent gets its own cryptographic identity, and all connections are outbound to the fabric, so there are no inbound ports to scan. The same model covers east-west and north-south traffic.
- Omdia saw it work in a live demo. After a single tag was removed from a workload’s identity, access to a private AWS API stopped immediately. The API returned no response at all, not even an error.
Survey figures: Omdia, Network Security at a Crossroads: Reclaiming Relevance in Hybrid, Cloud-native Environments, August 2026.
FAQs
What is an Omdia Technical First Look? A Technical First Look is a short analyst report in which Omdia reviews a vendor’s solution firsthand. For this report, Omdia observed NetFoundry through a remote demonstration. NetFoundry commissioned the report, which is distributed under license from TechTarget, Inc.
What is identity-based microsegmentation? Identity-based microsegmentation controls which workloads can connect based on verified identities instead of IP addresses or network location. Each workload or AI agent receives a cryptographic identity, and policy defines which identities may reach which services. Because access follows identity, policies keep working as workloads move, scale or share IP addresses.
Does NetFoundry require changes to firewall rules or IP addressing? No. NetFoundry runs as a private overlay fabric, so segmentation is defined in identity-based policies rather than firewall rules, ACLs or VLANs. It works regardless of endpoint location or IP address conflicts, which lets teams segment one service or an entire subnet incrementally, without downtime.
How does NetFoundry differ from traditional ZTNA? Traditional ZTNA is designed for human users and routes traffic through the vendor’s cloud for content inspection. NetFoundry is designed for machine-to-machine connections, so trusted workloads communicate directly over end-to-end encrypted paths. NetFoundry doesn’t terminate TLS or decrypt traffic, which reduces latency and preserves data confidentiality.
How does NetFoundry secure AI agents? NetFoundry assigns each AI agent its own identity, limits what that agent can reach and makes unauthorized endpoints invisible to it. This blocks agent movement east-west and north-south. NetFoundry also offers an LLM gateway for Zero Trust access to models and an MCP gateway for securing MCP servers used by agents.
Can NetFoundry run on-premises or meet data residency requirements? Yes. Each customer gets a dedicated, single-tenant control plane and data plane, which can be hosted by NetFoundry, run on-premises or deployed in a hybrid setup. Customers choose hosting regions from supported AWS, Azure, Oracle Cloud Infrastructure or Google Cloud data centers, to keep data in-country when regulations require it.