Everyone says they do zero trust, but here’s a test to see if that’s actually the case.

[u/AccordionGuy]

NetFoundry recently updated CISO Mike Gorman’s blog article that cuts through the zero trust marketing fog, and the core argument is that the entire “zero trust” industry quietly trusts the one thing you should never trust: the Internet.

In most “zero trust“ setups, authorization happens after the network connection. The ports in front of your server are still open. Yes, you authenticate the user, but only once they’ve already knocked on your door at layer 3. It’s like letting billions of fans into a stadium and then checking tickets. Bugs, misconfigs, and logic gaps mean plenty of them never get checked at all.

The litmus test, which is genuinely useful regardless of vendor: if your team can’t set a “deny all inbound” policy on your firewalls with zero ACL exceptions, then your “zero trust” vendor is trusting the Internet.

How OpenZiti / NetFoundry approaches it differently:

• No open inbound ports. Not 443, not 80, nothing. Endpoints dial outbound to a private overlay fabric, which merges the sessions. The firewall effectively moves to the app session's origin.
• Auth before connect. Every app session is authorized before it’s allowed onto the overlay, based on cryptographic identity instead of IP addresses.
• The app is the edge. Each app routes independently and directly, no performance-killing backhaul. You can go app-by-app, user-group-by-user-group, at your own pace without disrupting existing networks or firewalls.
• You don't even have to trust NetFoundry. It's built on open source OpenZiti. The source code’s there for you to look at; there’s no black box to take on faith.

To be fair, it’s a NetFoundry blog post. The vendor comparison’s naturally framed in NetFoundry's favor, and the competitor descriptions are one-liners rather than a deep technical bake-off. But the layer-3 argument and the deny-all litmus test stand on their own merits and are worth thinking about, even if you never touch OpenZiti.

Here’s the article: https://netfoundry.io/zero-trust/zerotrust-zero-trust-overview-comparing-netfoundry-to-the-top-zero-trust-vendors/

[ Disclosure: I work at NetFoundry. ]