The easiest way to understand Appgate is to picture an office building with no lobby. The building is invisible from the street. A visitor proves who they are, shows that their laptop is healthy and states which room they need. Only then does a door appear - for that room, under those conditions, for that visit. This is Appgate's version of Zero Trust Network Access, or ZTNA. It replaces the broad promise of a virtual private network with a sequence of narrow, identity-based decisions.
That distinction matters because the old remote-access bargain aged badly. A VPN authenticates a user, creates a tunnel and often places that person somewhere inside a network. From there, segmentation rules and security tools attempt to limit movement. Appgate reverses the order. Applications stay cloaked. The system evaluates identity, device posture, location and other context, then issues an entitlement to a particular resource. Single-packet authorization helps keep the gateway itself quiet until a valid request arrives.
The shortest distance between two trusted points
Appgate's most important difference is less fashionable than the phrase Zero Trust: the route. Many cloud-delivered security products send traffic through the vendor's multi-tenant cloud for inspection. Appgate lets approved traffic travel directly between the user and a gateway near the protected application. The customer can run the system in Appgate's SaaS environment or self-host it across data centers, public clouds and isolated networks.
Two ways to reach the same private app
Traffic detours through the provider's inspection network. Central control is convenient, but distance and concentration can add latency and cost.
The policy decision is centralized; the approved connection takes a local path. That is useful when performance, sovereignty or intermittent connectivity matters.
This is why the company turns up in odd combinations of places: a Hollywood visualization studio guarding unreleased work, an energy operator protecting control systems, a financial institution screening suspicious behavior and military teams working with limited bandwidth. A cloud-only route is awkward when the network is air-gapped, the factory cannot pause or the tactical edge has a shaky connection.
Who buys it - and what they are really buying
The customer list leans large and complicated: enterprises, government agencies, defense organizations, managed service providers, banks, manufacturers and critical-infrastructure operators. Appgate reported roughly 650 organizations in about 70 countries at the end of 2022. Public references include DXC Technology, Rackspace, Chemours, Reltio, Nequi, FINRA, Parsons and U.S. military organizations.
The immediate purchase may be remote access, third-party access, a merger integration or the retirement of several VPNs. The deeper purchase is a common policy layer across people, devices and workloads. Rackspace said automation and API integration made its deployment manageable by one person. Chemours reported that moving from a traditional VPN improved access performance by 30 percent and cut access- and performance-related tickets by 80 percent.
“The ability to automate, and the ease of integration via API make it a one-person job to manage the entire network.”Francois Bester, Rackspace
The product earns money mostly through term-based licenses and SaaS subscriptions, with support, implementation, training and advisory work around them. In the last detailed public annual report, subscriptions supplied 81 percent of 2022 revenue; services and other work supplied 15 percent. Partners matter because this is rarely a clean-sheet sale. Appgate plugs into identity systems, endpoint tools, cloud platforms and security operations products from companies including AWS, CrowdStrike, Okta, Splunk, ServiceNow, Illumio and Google Cloud.
The product worked. The financing did not.
Here the tidy security story collides with corporate arithmetic. Appgate's roots reach back to AppGate Network Security AB, founded in Sweden in 1998. Cryptzone bought it in 2009, then joined other cybersecurity assets inside Cyxtera in 2017. The security operation spun out at the end of 2019. In October 2021, it reached public markets through a reverse merger with a shell company at an estimated $1 billion valuation.
What failed first was growth relative to spending. Revenue slipped from $43.0 million in 2021 to $42.7 million in 2022, while the customer count fell from 652 to 647. Free cash flow was negative $59.1 million in 2022. At year-end the company had $11.5 million in cash and $3.5 million of remaining revolver capacity. Management and its auditor raised substantial doubt about its ability to continue as a going concern. Workforce reductions in July 2022 and February 2023 were early signs that the public-company plan had met the limits of the balance sheet.
By May 2024, incremental borrowing was no longer a convincing bridge. Appgate and its major stakeholders chose a prepackaged Chapter 11 recapitalization. Existing debt holders and most equity holders had agreed to the plan before filing, which turned a process associated with years of limbo into an eight-week reset. The plan became effective on July 2. Old equity was canceled, debt converted to private ownership, and Appgate said it emerged with no issued corporate debt outstanding. Magnetar supplied additional equity financing, though the amount was not disclosed.
What changed their mind?
The public disclosures point to liquidity, not a sudden loss of faith in ZTNA. Recurring operating losses, limited cash and layered debt made another patch insufficient. The lesson is blunt: if a company burns more cash than its annual revenue while growth is flat, a promising market cannot refinance the business by itself.
The cost was real. Public shareholders lost their stake, creditors became owners and workers had already absorbed reductions. Yet unsecured creditors were left unimpaired, customers continued receiving service and the company kept releasing software. Days after emergence, Appgate introduced version 6.3 with an AI-based risk engine. That sequence does not make the restructuring painless. It shows what a coordinated reset can preserve when stakeholders agree before entering court.
A wider gate, with narrower permissions
Since going private, Appgate has simplified its story while widening its range. In 2025 it separated ZTNA from the 360 Fraud Protection portfolio. Brand Guardian monitors phishing, impersonation and dark-web exposure. Risk Control combines transaction patterns, device signals and behavioral biometrics. Adaptive Authentication gives developers components for login and multi-factor workflows. Cyber Advisory Services adds manual penetration testing, red teaming, adversary simulation and malware analysis.
The newer products extend the same identity thesis into machines and factories. Agentic AI Core Protection applies micro-perimeters to servers, virtual machines and Kubernetes workloads, because an autonomous agent calling an internal API can move laterally just as a compromised employee account can. The 2026 operational-technology offering brings remote access controls to plants, energy sites and industrial control systems, where downtime can be more dangerous than inconvenience.
Federal work provides the hardest proof point. Appgate has FIPS 140-3, SOC 2 Type 2 and Common Criteria EAL2+ credentials. It participated in U.S. Army Cyber Quest experiments and, in March 2026, said its software would be part of General Dynamics Information Technology's $120 million U.S. Air Force Next Generation Gateway task order. That broader program is designed to cover more than one million users across 187 bases. The task-order value is not Appgate revenue, but the scale explains why disconnected operation, direct routing and customer control are not brochure decorations.
What a buyer - or builder - can copy
“Direct-routed” is stronger than “modern.” A buyer can trace the traffic path, measure latency and inspect where data transits.
Contractors, factories, acquisitions and remote developers create obvious pain. Prove narrow access there before attempting a company-wide transformation.
Compare the license with VPN appliances, private circuits, cloud egress, admin hours, support tickets and downtime. A commissioned Forrester model used $5.5 million in three-year present-value costs and $17.1 million in benefits for a composite organization. It is a framework, not a universal quote.
APIs, a Terraform provider, command-line tools and Kubernetes components help a security product fit an existing stack instead of demanding that the stack disappear.
Appgate waited until formal restructuring was necessary. Founders should watch cash conversion and renewal economics with the same attention they give product telemetry.
When the model does not fit
Appgate is not an automatic answer for every network. A small company with a handful of SaaS applications and no private infrastructure may get sufficient access control from its identity provider or a simpler cloud service. A team that wants web filtering, data-loss prevention and private-app access from one global security edge may prefer a broader SSE suite. Direct routing also shifts responsibility: self-hosted customers must design gateways, high availability and policy carefully. Poorly mapped entitlements can turn least privilege into a support queue.
The migration fails if it is treated as a VPN swap with identical broad permissions. It also struggles where identity data is dirty, device posture is unavailable or application owners will not help define access. Zero Trust is an operating model disguised as a product category. Appgate supplies the enforcement machinery; the customer still has to decide whom to trust, for what, and for how long.
That is the useful tension in Appgate's story. Its software argues that yesterday's trust should never settle tomorrow's access decision. The company eventually applied a version of that logic to itself: the old public wrapper and its accumulated obligations no longer fit the operating business, so stakeholders replaced them. The new structure has bought Appgate time to prove the commercial thesis. It has not removed the need to prove it.