In this demonstration, NetFoundry Senior Solutions Architect Nic Fragale highlights the inherent flaws of traditional perimeter-based security solutions, such as firewalls and VPNs.
He illustrates that leaving applications visible on the internet invites automated scanning and exploitation, proving that simply relying on API authentication layers like bearer tokens is ineffective if bad actors can reach the server. Fragale then introduces NetFoundry’s platform, demonstrating how closing all inbound firewall ports and utilizing an overlay network makes workloads entirely invisible to the internet. Finally, he shows how authorized users and devices are dynamically granted seamless, identity-verified access without the need to modify legacy network infrastructure.
Three Key Takeaways:
- Legacy Security Exposes Applications: Traditional “bolt-on” security layers are complex to manage and still leave web resources visible to the internet, allowing attackers to continuously scan and probe for vulnerabilities even if API authentication layers are present.
- Invisibility is the Ultimate Defense: By closing all inbound firewall ports and utilizing “cloaked mode,” NetFoundry makes applications, APIs, and workloads completely invisible to unauthorized internet traffic, entirely eliminating the attack surface and nullifying zero-day opportunities.
- Seamless Zero Trust Access: The platform operates on a “deny all” default state, granting end-to-end encrypted, identity-verified access to authorized users and devices in seconds, without requiring changes to firewalls, VPNs, or DNS records.
Frequently Asked Questions
1. Why isn’t API authentication (like bearer tokens) enough to protect my applications?
API authentication only works if the attacker can reach the server. Traditional security models leave applications visible on the public internet, allowing bad actors to endlessly scan, probe for vulnerabilities, and attempt brute-force attacks against the authentication layer itself. A lock on the door is ineffective if anyone can continuously test different keys without restriction.
2. How does NetFoundry make workloads “invisible” to attackers?
NetFoundry utilizes a zero-trust overlay network that allows you to close every inbound firewall port. Workloads communicate through an egress-only connection to the NetFoundry fabric. This completely removes the application from the public internet, leaving no open ports, no TCP handshakes, and absolutely zero scannable surface area for attackers to target.
3. If there are no open ports, how do authorized users and devices gain access?
Access is governed centrally through identity-verified policies rather than traditional network perimeter rules. Authorized users and endpoints run a NetFoundry client (or edge router) that securely connects to the fabric. When access is granted, the policy propagates in seconds—providing seamless, end-to-end authenticated and encrypted access without requiring VPNs, firewall changes, or public DNS records.
Full Transcript
Hi, I’m Nick Fragale, Senior Solutions Architect here at NetFoundry. Here’s a question worth sitting with for a moment: How many tools does your organization have to protect one private application? Possibly a firewall, IP allowlists, ACLs, a VPN, DMZ, possibly so many more? And each of these tools was created and put into place to solve a problem. But they seem to have created a brand new one.
Today I’m going to show you two things. First is how to make your private applications, APIs, AI gateways, all workloads invisible on the network. No open ports, nothing to scan, and nothing to exploit. And second, how you’ll provide identity-based access for not only users, but devices, without VPNs, without firewalls, without any ACL changes. Let’s get into it.
I want to start by showing you something that might look familiar. This is an exposure dashboard for a server that I just spun up in AWS. In theory, this is protected by a firewall and a WAF. Watch the activity feed while we talk about the legacy security stack.
Bolt-on protection layers are expensive to operate, difficult to keep in sync, and, critically, they still leave your applications visible on the internet. And anything that’s visible can be scanned. And anything that can be scanned can eventually be exploited. In contrast, NetFoundry creates an overlay that allows edges to communicate in an egress-only of their network. This moves all attack surfaces to the middle, and it protects fragile edges with little effort.
Back to the exposure dashboard. This is a web service with an API endpoint that I’ve protected with bearer token authentication—standard stuff, the kind of setup most teams would call “secured.” As you’ve started to see, there are already inbound scan attempts, dozens of IPs, multiple geographies, hitting multiple ports. This is automated, relentless, and it never stops.
Now here’s the uncomfortable part. I’m going to simulate accidental sharing of my access to the resource, the API URL, and a valid bearer token. I will now hit this endpoint from Postman. To show you there’s no magic here, I’ll first try without the bearer token. Unauthorized. Now with the token that was shared. There it is. A 200 response with a session payload. Token auth is working exactly as designed.
But here’s the thing: That token check only matters if you can reach the server in the first place. Right now, anyone who can discover this URL can start probing it. They can brute force tokens. They can look for injection points in the path. They can hammer the auth layer until they find a crack. I have no identity context from this view, just IP addresses, which can be spoofed, proxied, or rotated at will. I won’t know who’s attacking until they’ve already breached layer 7. This is the fundamental problem with perimeter-based security. A lock on the door means nothing if anyone can walk up and try a thousand keys.
So what’s the alternative?
Step one is simple, and it’s the most important thing I’ll show you today: Close every inbound firewall port. All of them. I’m going to flip “cloaked mode” on now.
Let’s try that Postman request again. Connection refused. Not a 401, not a 403. The server didn’t reject the request; the request never arrived. There’s no open port to knock on, no TCP handshake to initiate. From the internet’s perspective, this server does not exist. No surface area, no token brute force, no zero-day opportunity. Your API authentication layer is now completely irrelevant to an attacker because they can’t reach it.
Now, the obvious question: If nothing can reach it, how do authorized users and services get in?
I have the NetFoundry client running on my machine. This is my desktop edge, and by default, I have zero access to any private resource. “Deny all” is not a configuration option here; it is the default state. That’s a core principle of zero trust. While connected to the network, I am not associated with any services within it at the moment. Trying to connect using Postman and a private NetFoundry-enabled DNS record yields the same error.
Watch what happens when I add my identity to the access policy in the NetFoundry console. That policy change propagates through the NetFoundry fabric in seconds. No firewall rule changes, no VPN tunnel to spin up, no DNS records to modify.
Let’s now try Postman. And there it is. I’m in. And so is the API. End-to-end identity verified, zero trust connectivity. Every hop is mutually authenticated and encrypted.
Let me bring this together. The traditional security stack asks you to make a tradeoff: Either lock things down so tightly they become hard to use, or open them up enough to be operational and accept the exposure that comes with it. And, critically, it tells you that adding authentication to your APIs is enough. It isn’t. Authentication only protects what attackers can already reach.
NetFoundry eliminates that tradeoff entirely. With NetFoundry as the foundation, you can take your private applications, APIs, and AI gateways—all workloads—completely off the internet. No open ports, no scannable surface. While still giving every authorized user and non-human entity seamless, identity-verified access. Provisioned in seconds, revoked just as fast, with full audit visibility into every connection.
Simplified operations, zero trust by default, and no more wondering when the breach will happen because there’s nothing left to breach. Are you ready to launch your new products and APIs in hours versus weeks or months? Contact us immediately to get started. And thank you for watching.
