business

Where the Money Is in VPN Works: One Policy for Every AI Agent, and Least-Privilege Access on the Company VPN

AI agents need network rules per program, and every agent vendor now ships its own fence that works only for its own agent. One policy and one record across all of them is the gap, and it’s where the money could be.

A company running AI agents in 2026 runs several: a coding agent from one vendor, another in CI, browser agents, home-grown scripts. Each vendor that offers network limits offers them for its own agent, with its own settings and its own logs, if any. Security teams end up with a fence per vendor and no single answer to “what can our agents reach, and what did they reach?”

VPN Works is that single answer: any program, one policy format, one record.

Where the revenue would come from, with prices as hypotheses to test. The engine is free: run, trace, guard and learn on one machine, so developers try it and trust it. Team, at about $8 to $12 per developer a month, gives one shared policy and one log across every agent. Enterprise, at about $20 to $30 per developer a month, adds single sign-on, log retention and settings pushed to every machine. Platforms pay by usage for managed exits and per-customer policies. Below, recent acquisitions in AI security: F5 bought CalypsoAI for $180 million, SailPoint bought Entro for about $200 million, SentinelOne bought Prompt Security for $250 million, CrowdStrike bought Pangea for $260 million and Cisco bought Astrix Security for about $400 million. From the first version of this post, October 1: the prices are hypotheses, still to be tested.

Who Pays, and for What

The core stays free and open source. Developers have to be able to try it on one machine and trust it, and they won’t trust a network sandbox they can’t read.

Teams would pay for what one machine can’t do alone: one policy shared across machines and CI, one place where every run’s record lands, and reviews of drafted policies. Larger companies would pay for records nobody can quietly edit, which is Ledger, fixed exits, which is Exit, and the company VPN, which is Scope. All three are on the roadmap.

The plugin platform adds a second line: Guard and Observer plugins for specific industries and tools, from the project and from others.

The Prices Are Hypotheses

The earlier version of this post put numbers on each tier. They were guesses then, and they’re still guesses; they’ll get tested with the first teams that run vpnw for real. What’s not a guess: the core is free, and stays free.

What Could Stop It

Agent vendors could make their own fences good enough that nobody wants another layer. Operating systems could add per-program network policy themselves. And the hard part of VPN Works, sealing, is easy on Linux and not yet solved on macOS, where many developers work.

What Has to Come First

Real agents running under vpnw every day, on more machines than one. Ledger, so the record holds up in an audit. And a few teams willing to say what they’d pay for. Contact