Firezone

Firezone provides zero trust network access (ZTNA) built directly on the WireGuard protocol, replacing traditional hub-and-spoke VPN concentrators with peer-to-peer encrypted tunnels between a lightweight client and gateways deployed near the protected resources. Access is granted per application, subnet, or service via group-based policies synced from an identity provider (OIDC), rather than granting broad network-level access the way a legacy VPN typically does, and no inbound firewall ports need to be opened to deploy it.

Founded in 2021 by Jamil Bou Kheir, a former Cisco security engineer, Firezone went through Y Combinator’s Winter 2022 batch and has raised roughly $2.9M from YC, 1984 Ventures, and other seed investors. The product began as a popular open-source, self-hosted WireGuard management tool on GitHub that gained meaningful organic developer adoption before the team layered a commercial, enterprise-ready SaaS offering (identity provider sync, centralized policy management, subscription support) on top of the same open-source core, which remains publicly available.

Building the paid product directly on a self-hosted tool that already had real, unpaid developer usage is a credible bottom-up path to enterprise adoption, and the WireGuard foundation gives Firezone a genuine performance argument (lower latency, less overhead) against legacy IPsec/OpenVPN-based ZTNA competitors. As a roughly seven-person, YC-backed company still early in its commercial SaaS transition, it is competing against far larger and better-capitalized ZTNA vendors, and its long-term differentiation will depend on whether the open-source community continues converting into paying enterprise customers at scale.