--- title: "KuppingerCole Buyer’s Compass: Zero Trust Platforms" description: "Get KuppingerCole’s independent guide to evaluating Zero Trust platforms for workloads, machines and AI agents: use cases, criteria and RFP questions." image: https://info.netfoundry.io/hubfs/Imported%20images/featured-kuppingercole-16x9.jpg --- [![netfoundry-logo-no-tag-color-horizontal@3x](https://info.netfoundry.io/hs-fs/hubfs/netfoundry-logo-no-tag-color-horizontal@3x.png?width=582&height=174&name=netfoundry-logo-no-tag-color-horizontal@3x.png "netfoundry-logo-no-tag-color-horizontal@3x")](https://www.netfoundry.io) KuppingerCole Buyer's Compass · Zero Trust Platforms # The independent buyer's guide to Zero Trust platforms. Written for the traffic most platforms miss. "No solution on the market covers every use case, and many vendors have focused on securing human access while machine-to-machine connectivity remains far less well served." — KuppingerCole Analysts ![Cover of the KuppingerCole Buyer's Compass: Zero Trust Platforms, commissioned by NetFoundry](https://info.netfoundry.io/hs-fs/hubfs/Imported%20images/kc-cover.jpg?width=400&height=566&name=kc-cover.jpg) **Buyer's Compass: Zero Trust Platforms** Alexei Balaganski, KuppingerCole Analysts November 2026 · 21 pages ## Get the free Buyer's Compass Instant access on the next page. 21 pages, about a 25-minute read. KuppingerCole Leadership Compass 2026 ## Overall, Product and Innovation Leader "In the KuppingerCole Leadership Compass on Zero Trust Platforms 2026, NetFoundry is rated as Product, Innovation, and Overall Leader." OverallLeaderZero Trust Platforms 2026 ProductLeaderZero Trust Platforms 2026 InnovationLeaderZero Trust Platforms 2026 The problem ## You already own the parts. They just don't share a policy. "Most enterprises already own the parts: Multifactor Authentication (MFA), Zero Trust Network Access (ZTNA), endpoint posture, microsegmentation, and cloud workload controls are widely deployed. These controls lack a shared policy model. Each runs on its own engine, with its own owner and view of risk, so they rarely make decisions together." "A human session can usually tolerate an intermediary that terminates and inspects traffic, while workload connections are symmetric, frequent, and mutually authenticated, so the same intermediary can break end-to-end authentication, expose data to a third party, and add latency." — KuppingerCole Analysts, Buyer's Compass: Zero Trust Platforms ![Top Use Cases page from the KuppingerCole Buyer's Compass on Zero Trust Platforms](https://info.netfoundry.io/hs-fs/hubfs/Imported%20images/kc-page-usecases.jpg?width=600&height=849&name=kc-page-usecases.jpg) Inside the Buyer's Compass ## What's in the report - **Top Use Cases:** Microsegmentation and Breach Containment; Workload-to-Workload and Site-to-Site Connectivity; AI Agent and Non-Human Access Governance; Secure Hybrid Workforce and Third-Party Access; Continuous Risk-Adaptive Access and Session Control - **Top Functional Selection Criteria**, from Secure Connectivity Enforcement and Machine and AI Identity Protection to Data-Centric Security - **Use Case to Capability Mapping** across all five use cases - **Architectural and Pre-deployment Considerations**, including Data-plane Ownership and Path Locality and Cryptographic Agility and Longevity - **Questions to Ask Vendors during RFPs**, with NetFoundry's responses - **Vendor Spotlight** on NetFoundry and seven **Recommendations** [Download the Buyer's Compass](https://info.netfoundry.io/lp-kc-zero-trust-buyers-compass#nfo-form) Vendor Spotlight ## Strengths KuppingerCole lists for NetFoundry   ### One identity model "A single identity model covers human, non-human, and third-party connectivity, including flows otherwise handled by site-to-site VPNs and firewall rules."   ### Keys never leave the endpoint "Private keys are generated on the originating endpoint and never leave it, so NetFoundry cannot decrypt customer traffic."   ### Service-level microsegmentation "Service-level microsegmentation for workload-to-workload, service-to-service, API-to-API, and machine-to-machine flows from a single overlay fabric."   ### AI agents get their own identity "MCP Gateway and LLM Gateway make LLM endpoints and MCP servers invisible by default and issue cryptographic identities to AI agents." > This focus is deliberate: the market for securing human access is crowded with established solutions, while machine-to-machine connectivity is far less well served, and NetFoundry has built its platform around the latter. > > **KuppingerCole Analysts** · Buyer's Compass: Zero Trust Platforms, 2026 Written for CTOs, CIOs, CISOs, cloud security architects and platform engineers evaluating Zero Trust for workloads, machines and AI agents. ## "Name the primary outcome before looking at products." Recommendation 1 of 7 from KuppingerCole. The Buyer's Compass shows you how. [Download the free Buyer's Compass](https://info.netfoundry.io/lp-kc-zero-trust-buyers-compass#nfo-form) This Buyer's Compass from KuppingerCole Analysts AG was commissioned by NetFoundry. © 2026 KuppingerCole Analysts AG. All rights reserved. Copyright © 2026 NetFoundry. All Rights Reserved.