Authorize every prompt. Authenticate every agent.

“It’s the capabilities, the authentication and authorization concepts that are built-in, and the auth providers to choose from – this is something that’s unique among the reverse-auth proxies that are there.”

“When you don’t have to worry about provisioning users and user-databases, it makes spinning up internal tools that much easier.”

“Anywhere I have to demonstrate that we use role-based access control I can use the group-based Pomerium configuration policy as evidence.”

“With Pomerium integrated, we now have a good handle on how to secure our internal apps and high-value assets if they don’t have their own authorization capabilities.”

“We can confidently tell clients and auditors: ‘we only give people access to the things they need.’ How we prove that is we can pull up the Pomerium configuration and say… ‘this team has access to these resources.’”

“Instead of opening all sorts of web servers to the outside, we secure them behind pomerium internally and externally. This has helped us achieve a centralized access control model with less vulnerable attack surface area in place of the previous perimeter-based security model.”

“Pomerium allows great control, speed and flexibility when it comes to securing and exposing internal web applications and services. It is far better to expose a few services, than to allow someone blanket access to internal resources. Pomerium makes it simple to wrap any website that you might normally have left exposed (even internally) in a good layer of encryption with access control, lowering the barrier to achieving good security.”

“Pomerium is great because it’s completely zero trust. I hate this buzzword but it’s true for Pomerium. It’s completely zero trust.”