Watch as Hersh Sanghvi, Sales Engineering Executive, delivers an 18-minute comprehensive, behind-the-scenes look at how NetFoundry secures enterprise AI environments, which includes Q&A. In this technical demo, he explores a common scenario where a compromised CI/CD pipeline allows a rogue AI agent to attempt data exfiltration. Discover how NetFoundry’s software-based overlay network fabric neutralizes this threat by enforcing Zero Trust principles. He demonstrates how to eliminate open inbound ports, assign unforgeable cryptographic identities (X.509) to valid agents, and manage granular, identity-based access controls and visibility for your large language models (LLMs) and internal tools.
Three Key Takeaways
- Traditional Identifiers Are Vulnerable: Relying on IP addresses and API keys is inadequate for AI security, as malicious actors can easily spoof them to inject rogue agents and exfiltrate data.
- Create “Dark” AI Resources: NetFoundry enhances security by closing all inbound firewall ports. This removes your private AI resources from the public internet’s visibility, drastically reducing your attack surface.
- Enforce Cryptographic Machine Identity: NetFoundry assigns strong, non-transferable cryptographic identities (signed X.509 certificates) to every AI agent, ensuring strict, policy-based access control to Model Context Protocol (MCP) servers and LLMs.
FAQs
1. Why are traditional network security models inadequate for agentic AI? Traditional firewalls and VPNs authenticate at the network edge and grant broad trust once a connection is established. Because valid and rogue agents often share similar IP addresses and API keys, bad actors can easily spoof these identifiers to introduce malicious agents into your AI environments and exfiltrate data.
2. How does NetFoundry secure access to private LLMs and internal tools? NetFoundry utilizes an identity-first, Zero Trust architecture that closes all open inbound network ports. By routing traffic exclusively out to an overlay fabric, your AI resources remain completely invisible to attackers on the underlay network while remaining accessible to authorized agents.
3. What is an MCP Gateway, and how does it protect AI workloads? An MCP (Model Context Protocol) Gateway acts as a secure proxy that allows AI assistants to access internal data and tools without exposing public endpoints. It enforces Zero Trust connectivity through per-client isolation, mTLS, and strict tool-level permission controls.
4. How are identities assigned to AI agents in the NetFoundry platform? Instead of relying on shared API keys, NetFoundry assigns every authorized agent a unique cryptographic machine identity backed by a signed X.509 certificate. The private key never leaves the host machine’s secure storage, making it impossible for imposter agents to copy or spoof.
5. Does deploying NetFoundry require changes to existing network infrastructure? No, deploying NetFoundry requires no alterations to your existing routing, VLANs, or network equipment. Administrators simply close inbound ports, and the NetFoundry software overlay seamlessly handles identity-based routing and access control.
Full Transcription
Presenter: Okay, so this is the dashboard, but I’m going to start with a simple enterprise use case. You have some agents out there that your teams are creating. Every agent must have a “brain,” so they are accessing Large Language Models (LLMs). For that, you obviously want to control costs—you don’t want everyone sending everything to expensive models like Opus and racking up bills. At the same time, you might have models trained on your private data, and you want to protect access to those as much as you can.
There’s also a bunch of tools. In this case, I have a use case of a financial analyst working as a software agent. As you can see, Bedrock is an LLM gateway on AWS. Behind it, you can access most models. This agent reads a customer’s current portfolio, looks up current prices and up-to-date news, and runs a private model to figure out a risk score and generate an SEC report.
In a typical scenario, a developer might get compromised, and a bad actor gets into the CI/CD pipeline to spin up another agent that looks and behaves exactly like a valid agent. Because they share the same internal IP addresses and API keys, a valid agent behaves exactly like an imposter from a networking perspective. At the end of the day, the valid agent generates the report, but the imposter exfiltrates data externally—a top-of-mind concern for most enterprises. The huge problem is that there is no identity that cannot be easily spoofed, and your resources are listening openly on the network, allowing both valid and imposter agents to get in.
To solve this, I’m going to apply NetFoundry. Behind the scenes, it does three things. First, it closes all open inbound ports on the host firewall. On the physical underlying network, these resources disappear and become cloaked or invisible. Second, the valid agent requests and receives a cryptographic identity from the network. This token generates an X.509 certificate where the private key never leaves the physical or virtual machine. An imposter agent cannot get this identity. Third, the valid agent is explicitly authorized to access specific resources through our fabric.
If I run the scenario again, the valid agent still accesses the resources over our overlay network, while the rogue agent finds no path on the underlay network and quits. Everything is managed via API calls in the background to add or remove access tags. If an agent is compromised or reaches its end of life, an API call immediately revokes access, rendering it useless. You get deep visibility, logging, and granular control at scale.
Interjector: So what is the NetFoundry fabric in the middle? Is that a piece of software?
Presenter: Great question. It’s a piece of software that can be consumed as a service from NetFoundry, completely self-hosted for high-security environments, or managed as a hybrid.
Interjector: If we deploy this fabric, are we installing something on our network equipment or routers?
Presenter: The best part is you make absolutely no changes to your physical network—your routing, VLANs, and firewalls stay as is. You just close your inbound ports to stop freeform access. Then, you deploy our software as close as possible to the resources in the private subnet. It works as a reverse proxy, making an outbound-only connection. The fabric acts like a switchboard based on your policies.
Interjector: Does this identify agents as well as users?
Presenter: 100%. For agents, you can just embed our SDK. For humans, we have applications for macOS, Windows, Linux, iOS, and Android. The private key is securely stored in the OS keychain. You can even combine them, requiring a human-in-the-middle secondary identity via your IDP before an agent can execute an action.
Interjector: If an agent did something unexpected, how do you go back and see the logs to check its permissions?
Presenter: Right from the dashboard, you can see which identities are accessing what services. You can view metrics over various timeframes to see exactly what an agent accessed. For more granular details, you can pull up exact dial logs showing timestamps and access counts. All of this can also be polled via API or streamed directly to your existing SIEM tools like Splunk, Datadog, or Elastic.
Presenter: Lastly, we do have NetFoundry versions of the LLM Gateway and MCP Gateway. They work natively with our fabric, allowing you to use vanity keys instead of sharing actual API keys. You can set rules so only authorized agents doing heavy lifting can access expensive models, optimizing for cost, performance, and quality while retaining full visibility.
