Competitive Landscape: Network Security Microsegmentation

25 March 2026 - ID G00844123 - 27 min read

By Christian Canales, Adam Hils

Organizational demands for zero-trust and least-privilege access are driving microsegmentation innovation. Technology and service providers investing in AI, cloud-native, and IoT/OT integration will have the competitive edge in the short to medium term.

Overview

Key Findings

AI-driven microsegmentation offers a significant opportunity for vendor differentiation, with capabilities ranging from AI-assisted anomaly detection and dynamic policy adjustments, to deeper insights into cloud API interactions and complex containerized environments.
Microsegmentation is increasingly critical in hybrid, cloud, and containerized environments, driving demand for agentless offerings that enforce least-privilege access and dynamic policies despite deployment challenges from fragmented architectures.
Microsegmentation vendors lack the specialized capabilities of cyber-physical system (CPS) protection platforms, relying on third-party integrations for logs and telemetry.

Recommendations

Ensure that offerings provide strong compliance and auditing capabilities by incorporating AI-driven risk scoring, automated vulnerability management, and adaptive policy enforcement to meet IT regulatory requirements.
Deliver agentless microsegmentation that dynamically enforces least-privilege policies across cloud and containerized assets, expanding real-time visibility, topology mapping, and policy enforcement.
Develop two distinct products — one for IT and one for CPS microsegmentation — with unified management but separate policies that address CPS-specific requirements. Or, leverage integrations with CPS protection platforms through strategic partnerships.

Strategic Planning Assumption

By 2030, 10% of organizations will have sufficient trust to run autonomous agents to segment their networks with no human oversight, up from less than 1% in 2026.

Analysis

Market Definition

Gartner defines network security microsegmentation as an effort that can create more granular and dynamic access policies than traditional network segmentation (often north-south traffic segmentation). It allows the insertion of a security policy between any two workloads in the same broadcast domain — with microsegmentation technologies narrowing fine-grained network zones down to individual assets and applications. In CPS environments, “microsegmentation” typically refers to implementing segmentation at the zones and conduits level, as defined by standards such as ISA/IEC 62443.

This research profiles eight network security microsegmentation providers: Akamai Technologies, Broadcom, Cisco, ColorTokens, Elisity, Illumio, Zero Networks, and Zscaler.

In addition to the eight vendors profiled in this research, the following nine providers continue to show product investments and offer a comprehensive set of network security microsegmentation features: Forescout, Fortinet, HPE, Nutanix, Onclave Networks, Palo Alto Networks, Tigera, Xage Security, and Zentera Systems.

This research defines this market by three macro forces shaping vendor differentiation: AI, cloud, and CPS. AI enables advanced detection and policy automation but requires transparency and security for trust. Cloud adoption drives demand for agentless, dynamic microsegmentation across hybrid and containerized environments, despite architectural challenges. CPS integration expands the attack surface and requires specialized safety and management. These forces push vendors to focus on operational simplicity, automation, unified management, and strong compliance to remain competitive.

A fourth macro force was added to the vendor profiles — campus and branch office — as vendors are extending deployment options to these use cases. However, capabilities are blurring with adjacent market technologies, including network access control (NAC), ZTNA/UZTNA, and campus network fabrics.

Competitive Situation and Trends

AI Enhancing Microsegmentation

AI capabilities can differentiate vendors by enabling anomaly detection, dynamic policy adjustments, and deeper insights. But human oversight, transparency, and strong security controls are essential for trust and adoption. For more information, see Market Trend: AI Is Enriching Network Security Microsegmentation Offerings.

Challenges:

Managing dynamic, hybrid, and multicloud environments remains complex, especially as organizations seek to balance automation with human oversight.
Fragmented security architectures and limited API integrations make deployment and interoperability a challenge.
There is a lack of trust and safety in AI-driven microsegmentation, requiring human oversight, transparency, and robust safeguards to prevent risks like model poisoning.
Encrypted traffic complicates risk identification and security controls across diverse environments.

Opportunities:

AI can enhance microsegmentation capabilities for organizations that want real-time adaptation of segmentation policies, especially in dynamic environments like cloud and containers.
AI can improve visibility for organizations by analyzing metadata from multiple sources (network traffic, logs, identity stores).
AI can assist with more accurate, business-tailored segmentation decisions as organizations strive for granular segmentation based on application identity, user roles, and behavioral context.
AI capabilities that integrate smoothly with diverse infrastructure help organizations overcome fragmented microsegmentation by delivering contextual awareness and unified policy enforcement.

Recommendations:

Do not leverage AI for dynamic policy adjustments in CPS environments, due to the distinct security and safety requirements of CPS assets.
Design solutions for operational simplicity with unified management and intuitive interfaces, utilizing AI for automated device discovery and policy updates to support organizations with limited resources.
Ensure that offerings provide strong compliance and auditing capabilities by incorporating AI-driven risk scoring, automated vulnerability management, and adaptive policy enforcement to meet IT regulatory requirements.
Build transparency and robust safeguards into AI systems to minimize false positives and maintain customer trust.

Microsegmentation in Modern Cloud Architectures

Microsegmentation is becoming increasingly critical as organizations shift to hybrid, cloud, and containerized environments. Yet deployment and management remain challenging due to fragmented architectures, diverse workloads, and incomplete API integrations.

Challenges:

Cloud environments are highly dynamic, with diverse workloads frequently spinning up and down. Gaining real-time visibility into all assets, communications, and dependencies is difficult, making it challenging to create and maintain effective microsegmentation policies.
As the number of microsegmentation rules grows, especially in large-scale or multicloud environments, managing, auditing, and troubleshooting policies becomes increasingly complex. Policy sprawl can lead to misconfigurations and security gaps.
Incomplete or weak API integrations, particularly with Kubernetes and cloud platforms, can hinder seamless operation across different environments and tools.
Despite automation, there is a continued need for human oversight, transparency, and robust safety mechanisms to prevent unintended consequences.

Opportunities:

Demand is growing for agentless microsegmentation in hybrid and multicloud environments due to operational challenges with agent deployment.
Rising adoption of containerized workloads and Kubernetes is driving demand for real-time visibility, topology mapping, and policy enforcement solutions.

Recommendations:

Deliver agentless microsegmentation that enforces least-privilege policies across cloud and containerized assets.
Develop deep integrations with cloud-native APIs, asset repositories, SaaS/cloud platforms, and orchestration tools for automatic discovery, profiling, and policy enforcement of cloud resources.
Expand real-time visibility, topology mapping, and policy enforcement for containerized workloads by providing visualization tools that map communication and dependencies in containerized and serverless environments.
Build integrations with hardware accelerators (e.g., DPUs, smartNICs) to provide unified rule management and high-performance enforcement in cloud settings.

Microsegmentation for CPS Security

The rapid proliferation of CPS devices is transforming business operations, but also expanding the attack surface and introducing new security challenges. To address these risks, organizations are turning to microsegmentation for compliance across IT and CPS environments. In CPS, “microsegmentation” generally refers to implementing segmentation at the zones and conduits level to ensure alignment with operational and safety requirements.

It is important to note that the vendors profiled in this research primarily focus on IT microsegmentation and broadly lack the specialized capabilities offered by CPS protection platforms, particularly in areas such as vulnerability and threat management. Additionally, the prevalence of proprietary and specialized protocols in CPS environments means that microsegmentation vendors are largely dependent on third-party integrations to access essential logs and telemetry.

Challenges:

CPS environments are highly fragmented — complicating integration, consistent policy enforcement, and scalability — while the lack of standard security controls or reporting on many CPS assets further hinders effective risk assessment and incident response.
Automation in sensitive CPS environments requires robust safety mechanisms, transparency, and human-in-the-loop controls to prevent unintended disruptions leading to safety incidents.
Continuous compliance in regulated sectors is challenging due to incomplete visibility into CPS assets, behaviors, and security posture, making it difficult to design effective microsegmentation policies.

Opportunities:

Extending identity-based access and least-privilege controls to CPS assets is a major differentiator, as there is growing demand for context-aware controls.
Many organizations are seeking unified management of IT and CPS operations while supporting the implementation of distinct security controls tailored to the unique safety requirements of CPS environments.

Recommendations:

Develop two distinct products, one tailored for IT and one for CPS microsegmentation, unifying management into one management plane but maintaining separate policies, with special attention to specific CPS requirements. Alternatively, leverage integrations with CPS protection platforms through strategic partnerships.
Incorporate features for ongoing compliance monitoring, reporting, and audit readiness, tailored to industry-specific regulations.
Recognize that organizations may need to use physical gateways to create enclaves of trusted CPS assets, since switches in these environments are often unmanaged, preventing the implementation of switch-based microsegmentation.

Competitive Profiles

Table 1 summarizes each provider’s key targeted markets and third-party security integrations.

Network Security Microsegmentation Providers

Vendor	Key Targeted Vertical Markets	Third-Party Security Integrations (Top 10)
Akamai Technologies	Financial services; manufacturing; IT/tech services	Armis, Claroty (CPS); Wiz/Orca (CNAPP); Cilium, Azure (K8s); Tufin, AlgoSec, Palo Alto Networks (NSPN and firewall); CrowdStrike (EDR); Tenable (vulnerability management)
Broadcom	Financial services; healthcare, government; education; manufacturing	Tufin, AlgoSec, FireMon (network security policy management); Palo Alto Networks, HPE Aruba (firewall/NAC); Cisco Splunk, IBM QRadar (SIEM); Carbon Black Cloud (EDR); Active Directory (identity); Palo Alto Networks (XDR)
Cisco	Healthcare; financial services; government; education; manufacturing	Armis (CPS); F5 and Citrix NetScaler (ADCs); ServiceNow (ITSM); Infoblox (DNS firewall); IBM QRadar (SIEM); Red Hat OpenShift, VMware vCenter (application labels)
ColorTokens	Healthcare; manufacturing; financial services/insurance; critical infrastructure/energy	CrowdStrike, Microsoft Defender, SentinelOne (EDR); Cisco Splunk, IBM QRadar (SIEM); Okta (identity); VMware vSphere (virtualized infrastructure); Tenable (vulnerability management); Claroty, Nozomi Networks (CPS)
Elisity	Healthcare; manufacturing; retail/distribution; financial services	CrowdStrike, SentinelOne (EDR); Claroty, Armis (CPS); Palo Alto Networks (firewall); Cisco, Arista Networks, Juniper Networks (switches/WLAN); Microsoft AD/Entra ID (identity); ServiceNow (ITSM)
Illumio	Financial services; government; manufacturing; healthcare; retail	Armis (CPS); AppGate, Netskope (ZTNA); Wiz (CNAPP); Check Point Software Technologies (firewall); Cisco Splunk, Microsoft Sentinel (SIEM); FireMon (policy management); Qualys (vulnerability management); ServiceNow (ITSM)
Zero Networks	Financial services; government, healthcare; manufacturing; retail including hospitality	Palo Alto Networks, Check Point Software Technologies, Fortinet, Cisco (firewall); Cisco (switches); Microsoft AD/Entra ID (identity); CrowdStrike, SentinelOne (EDR); Cisco Splunk, IBM QRadar (SIEM); ServiceNow (ITSM)
Zscaler	Manufacturing; healthcare; retail/distribution	Okta, Ping Identity (identity); CrowdStrike, SentinelOne, Microsoft Defender (EDR); Cisco Splunk, IBM QRadar, LogRhythm (SIEM); Cisco, Fortinet, Palo Alto Networks (firewall)

Source: Gartner (March 2026)

Akamai Technologies

Product or Portfolio Overview

Akamai’s Guardicore Segmentation delivers microsegmentation by providing visibility, policy enforcement, threat detection, and compliance tools across diverse environments. The management console can be cloud-hosted (SaaS) or on-premises.

How Akamai Competes

Akamai’s operations are global, though more than 70% of its revenue comes from North America and EMEA. In the past 18 months, the company introduced agentless enforcement for cloud-native resources in AWS, expanded agentless support to PaaS resources in AWS and Azure, and, in 1Q26, made a GenAI-driven policy engine generally available.

Akamai’s differentiation lies in its AI-driven network management and vulnerability remediation, unified policy management across diverse environments, and application-layer API visibility. However, monitoring and reporting capabilities lag behind some competitors’, with uneven integration into third-party SIEM and SOAR systems, particularly for organizations with complex security stacks, and end users report limited compatibility with AIX machines.

Akamai emphasizes the following capabilities in its go-to-market approach:

Artificial intelligence: The Guardicore Segmentation platform includes an AI chatbot that lets users query their environment for vulnerability remediation and streamlines security policy workflows. The GenAI-driven engine, introduced in 2026, automatically generates microsegmentation policies with enforcement readiness scoring and policy suggestions. AI capabilities identify and name applications and assets for clearer visibility and easier policy creation.
Cloud: Akamai offers agentless microsegmentation in the cloud, deploying a lightweight application within customer environments to orchestrate native security groups and unify policy management across different cloud providers. Akamai also supports microsegmentation for containerized environments by integrating with major Kubernetes platforms like Calico, EKS (Amazon), and AKS (Azure). It uses the native Kubernetes container network interface (CNI) for policy enforcement to minimize latency and streamline workflows.
Campus/branch: Akamai leverages its ZTNA offering to provide identity-based application access and endpoint segmentation, featuring automated application discovery, privileged access restriction, and unified policy management for distributed workforces.
CPS: Akamai enforces agentless microsegmentation for cyber-physical systems, by integrating with third-party network switches and using PacketFence and its proprietary Fingerbank technology. Ingesting third-party metadata enriches asset visualization and enables policy enforcement using logical labels, such as identity or risk score, instead of IP addresses.
Other capabilities: Akamai’s integration of application-layer visibility from its API security offering into Guardicore Segmentation enables organizations to see which assets are communicating over APIs and what types of sensitive data are being transmitted, such as PII or SSNs. Akamai Hunt is a managed service designed to support organizations with limited resources, providing services such as threat hunting and exposure management. A recent addition is shadow AI detection, which alerts to the use of unauthorized AI applications. Akamai’s partnerships with AMD and NVIDIA integrate microsegmentation into network switches using programmable DPUs — Pensando’s and NVIDIA BlueField — enabling agentless policy enforcement at the network edge, ideal for high-throughput data centers and low-latency environments.

Broadcom

Product or Portfolio Overview

The vDefend Distributed Firewall (DFW) serves as the microsegmentation and traffic filtering component within Broadcom’s vDefend platform. Additional security features — such as intrusion detection, policy management, and analytics — integrate with DFW to protect workloads running in data centers, public clouds, and hybrid environments.

How Broadcom Competes

Broadcom’s operations are global, with North America generating most of its revenue. In the past 18 months, the company has introduced the DFW 1-2-3-4 workflow capability, offering a four-stage approach to security segmentation. This guided process includes: security posture assessment and reporting (stage 1); protection of critical infrastructure services (stage 2); definition of environment or zone boundaries (stage 3); and granular, application-level microsegmentation (stage 4). Another new feature examines firewall policies to identify and optimize issues such as duplicate, redundant, contradictory, or overly permissive rules. Late in 2024, Broadcom introduced Intelligent Assist, a chatbot that uses LLMs to automate alert analysis and response, providing contextual insights and recommended actions.

Broadcom’s differentiation lies in delivering granular security controls across both data center and cloud environments, particularly for VMs and containers running on vSphere. However, while the bundling of DFW with VMware Cloud Foundation (VCF) provides a broad software stack, Gartner clients consistently report that they are being forced to consume licenses that they do not require.

Broadcom emphasizes the following capabilities in its go-to-market approach:

Artificial intelligence: Intelligent Assist works alongside the DFW, providing plain-language explanations of detected threats, recommending optimized DFW policies, and guiding remediation actions — helping security teams respond to attacks and strengthen microsegmentation defenses. Nevertheless, existing documentation does not cover scenarios involving LLM deployment at customer sites.
Cloud: Broadcom integrates microsegmentation directly with VMware Cloud Foundation, its overarching software virtualization platform, streamlining consistent deployment of granular security controls across data center and cloud environments. DFW provides differentiation through advanced threat detection and prevention capabilities that are delivered inside the hypervisor, especially for VMs or containers that are deployed on the vSphere hypervisor. DFW offers agentless and agent-based options with the VMware software stack, whether deployed in the cloud or in private data centers. However, for environments that do not run on VMware infrastructure, serverless microsegmentation is not supported.
Campus/branch: While DFW can apply policies to VMs by corporate location, the product does not support microsegmentation for employee devices.
CPS: DFW does not provide microsegmentation for CPS assets. It can offer network-based segmentation for traffic to and from these devices, but microsegmentation at the endpoint level is not supported.
Other capabilities: DFW provides strong performance and scalability, including support of up to 200,000 firewall rules, up to 20 Gbps per host in DFW throughput, and up to 9 Gbps per host in IDPS throughput. Additionally, it includes NDR capabilities, and malware prevention has been extended to cover file-less attacks.

Cisco

Product or Portfolio Overview

Cisco Secure Workload (CSW) and Cisco Hypershield deliver microsegmentation directly at the workload level. Cisco ACI enables segmentation of workloads, but enforcement occurs at the network fabric level. Cisco Multicloud Defense applies segmentation among cloud workloads, without implementing policies inside the workload. For campus environments, the Cisco Identity Services Engine (ISE) and Software-Defined Access (SDA) provide microsegmentation for endpoints, including IoT/OT devices.

How Cisco Competes

Cisco’s operations are global. In the past 18 months, the company has launched new Nexus 9300 switches that integrate Hypershield into its data center network fabric as a service. This is suitable for workloads where the installation of a kernel-level agent is not possible or desired (e.g., managed services, legacy systems, Windows workloads). The late 2025 software release of ACI added microsegmentation support for VMware VDS, Microsoft Hyper-V virtual switch, and bare-metal applications.

Cisco’s differentiation lies in its broad portfolio offering automated policy management and enforcement for cloud, data center, and CPS environments. Its capabilities to protect employee devices surpass most microsegmentation vendors, though Gartner clients have voiced that SDA can be complex to implement and troubleshoot. Customers also report confusion between CSW and Hypershield, with limited policy customization.

Cisco emphasizes the following capabilities in its go-to-market approach:

Artificial intelligence: Cisco’s products offer a range of AI-driven capabilities. Both CSW and Hypershield utilize AI for policy automation, providing recommendations that simplify security management and ensure consistent policy enforcement across diverse environments. Hypershield further harnesses AI to analyze public CVE data, automatically generating extended Berkeley Packet Filter (eBPF) programs that are deployed at the kernel level to mitigate vulnerabilities and prevent exploitation.
Cloud: Both CSW and Hypershield support security enforcement through agent-based and agentless approaches, enabling protection in private clouds as well as in VMs and Kubernetes clusters in public clouds. With Hypershield, enforcers connect to Cisco’s SaaS cloud management system, which simplifies deployment and firewall setup. For agent-based enforcement, Hypershield uses the Tesseract Security Agent, a kernel-level security enforcer that provides deep visibility inside workloads, leveraging eBPF technology.
Campus/branch: Cisco delivers microsegmentation for employee devices with ISE and SDA. ISE centrally manages policies by grouping endpoints based on user identity, device type, and location. SDA extends these capabilities in campus environments, utilizing VXLAN-GPO encapsulation and leveraging fabric control planes (LISP or BGP-EVPN) for scalable, unified policy enforcement and endpoint mobility. With advanced analytics and integration with broader Cisco security products (such as SD-WAN, SASE, and firewalls), SDA provides proactive monitoring and policy extension.
CPS: Through integration with CSW, ISE enables precise control over workload communications with CPS assets. ISE also integrates with Cyber Vision, Cisco’s CPS cybersecurity platform, providing real-time asset visibility and automated identity-based microsegmentation.
Other capabilities: Hypershield supports a “shadow” data plane, where any policy change or segmentation enhancement can be automatically tested. The ability to simulate what a policy would look like if activated enables organizations to test the impact of policies before enforcing them live, making segmentation more adaptive and resilient.

ColorTokens

Product or Portfolio Overview

ColorTokens’ Xshield microsegmentation offering consists of a centralized administration console and multiple policy enforcement points (such as host-based firewalls, Kubernetes sidecars, and agentless gateways).

How ColorTokens Competes

ColorTokens primarily operates in North America and has some presence in a number of countries in EMEA and Asia. In the past 18 months, ColorTokens has achieved FedRAMP Moderate certification, integrated Xshield with CrowdStrike Falcon platform, and acquired a startup, PureID, to enhance its identity-based segmentation capabilities.

ColorTokens’ differentiation lies in its unified platform that adapts to diverse environments, offering flexible enforcement methods, real-time threat intelligence integration, and comprehensive asset visibility from a single console. However, the dashboard lacks clear insights into traffic blocking context, which can complicate global policy deployment and prolong the learning phase.

ColorTokens emphasizes the following capabilities in its go-to-market approach:

Artificial intelligence: Xshield’s AI leverages real-time telemetry, asset data, and daily updated MITRE and CISA threat intelligence to enhance policy updates. Administrators can query a private-instance LLM for insights, with options for SaaS-based or private/on-premises LLMs. AI-driven recommendations streamline policy configuration, while the platform suggests templates to mitigate specific attack techniques and procedures, and maps threat intelligence to assets. AI assistance is integrated into a single console for all asset types, including servers, workstations, cloud, containers, IoT, and CPS.
Cloud: ColorTokens’ Xshield works alongside Azure NSGs and AWS SGs to deliver agent-based microsegmentation with adaptive security policies that respond to changes in workloads, roles, and networks. The platform provides near-real-time visibility using notifications, flow logs, and advanced tracing. Unified coverage for cloud, containers, and Kubernetes lets administrators visualize all assets in a single console, and test policy changes with simulations.

Campus/branch: ColorTokens secures employee devices by tagging and segmenting them based on location and environment, enabling policy enforcement and mapping of interactions. High-risk ports are prioritized, and policies can be simulated. However, the platform currently lacks integration with third-party NAC products, which limits its ability to leverage NAC features such as device onboarding, real-time posture checks, and automated network access restrictions.

CPS: ColorTokens provides microsegmentation through two methods: (1) its Gatekeeper appliance, which acts as a controller for CPS and legacy devices that cannot support an agent, and (2) integration with network firewalls and switch access control lists (ACLs) to enforce segmentation policies, for environments where deploying agents or additional devices is operationally impractical. ColorTokens also integrates with Nozomi Networks, leveraging Nozomi’s CPS threat monitoring. Integrations with Armis and Claroty are also supported.
Other capabilities: Organizations with CrowdStrike, SentinelOne and Microsoft Defender agents for server and user workstations can deploy ColorTokens without the need to install Xshield agents, providing investment protection and reducing operational overhead.

Elisity

Product or Portfolio Overview

The Elisity Platform consists of the Elisity Cloud Control Center — the user interface, hosted in the cloud — and the Elisity Virtual Edge — a control plane extension that integrates with network infrastructure.

How Elisity Competes

Elisity primarily operates in North America and has some presence in EMEA. In the past 18 months, the company has introduced agentic AI capabilities for network policy automation and enforcement. It also made advancements focused on agentless, identity-based microsegmentation on switches and WLAN data planes from multiple vendors, enabling a disruption-free deployment.

Elisity’s differentiation lies in its AI-driven device identification and categorization, scalable identity graph, and streamlined onboarding and microsegmentation for complex CPS environments. However, successful implementation requires good network hygiene and up-to-date patching, and Elisity’s visibility in IT data center environments is very limited.

Elisity emphasizes the following capabilities in its go-to-market approach:

Artificial intelligence: Elisity’s platform analyzes a data lake of customer assets, using AI to enhance device identification and categorization while leveraging private LLMs to enable unified policy enforcement across switches, firewalls, and cloud or SASE environments. The AI-driven insights are integrated with Elisity’s IdentityGraph, a scalable graph database that aggregates metadata from networks, devices, workloads, users, and behavioral data. Guided workflows assist administrators in navigating complex environments. AI recommendations are staged for human review and, once approved, activated into enforcement. Elisity allows administrators to simulate policy changes, enabling them to review the impact of recommended policies on existing network traffic before enforcement.
Cloud: Elisity enables north-south segmentation to resources in the public cloud, but does not provide east-west microsegmentation, including within Kubernetes containers.
Campus/branch: Elisity provides visibility and least-privilege policy for managed and unmanaged devices, users, and workloads. The IdentityGraph discovers, consolidates, and enriches identity data from multiple sources, such as Active Directory, CrowdStrike, ServiceNow, and Armis, to create a unified and accurate profile for each device. For remote workers, Elisity leverages pilot/POC-level third-party ZTNA integrations, as its agentless approach does not natively extend microsegmentation to remote endpoints.
CPS: Elisity excels in environments with a high density of CPS assets. The platform enables granular segmentation and control based on device type, user role, or function. Onboarding is simplified by eliminating the need for network reconfiguration, such as VLAN changes or IP address management. Elisity Virtual Edge, a lightweight and containerized application, can be deployed as a virtual machine or within compatible switching infrastructure. Onboarding is further streamlined through zero-touch provisioning, requiring only basic network information and a one-time token, after which the application auto-configures. The platform also supports mapping devices into zones and conduits in alignment with CPS segmentation standards like IEC 62443, enabling granular and context-aware policy enforcement for critical industrial assets.
Other capabilities: For sites that might be compromised by ransomware and that need to be isolated, Elisity supports the activation of a set of policies, defined in the event of that scenario, to stop lateral movements.

Illumio

Product or Portfolio Overview

Illumio Segmentation, part of the Illumio Breach Containment Platform, protects workloads across hybrid environments, including public cloud, on-premises data centers, containerized platforms, and endpoints. It offers a range of agentless and agent-based options, managed through its Unified Console for centralized policy control.

How Illumio Competes

Illumio’s operations are global, with roughly half of its customers in North America. In the past 18 months, the company announced Illumio Insights, an offering designed to identify risks by leveraging deep observability, behavioral analytics, and an AI security graph to uncover hidden threats such as unsanctioned traffic and misconfigured services. Illumio Insights complements Illumio Segmentation by providing visibility into traffic flows, evaluating policy effectiveness, and highlighting potential lateral movement risks that can be addressed through policy controls.

Illumio’s differentiation lies in its scalable application-centric microsegmentation and wide environmental coverage, combined with granular visibility, automated workflows, and agentless container security. However, Illumio has limited traction in campus-and-branch-office-driven deployments and lacks integration with leading NAC providers.

Illumio emphasizes the following capabilities in its go-to-market approach:

Artificial intelligence: The Insights dashboard provides differentiation by its granular visibility and control. Leveraging AI, the system identifies unexpected communication paths and connectivity among workloads, while also assessing confidence levels and highlighting areas of uncertainty. It offers detailed dashboards breaking down risky protocols, destination roles, cross-regional and country-level traffic flows, communications with unsanctioned LLM services, and compliance metrics. Additionally, workflows can be automated through SIEM and SOAR integrations.
Cloud: Illumio enables microsegmentation policies for workloads running across multiple public clouds using a centralized policy model. AWS, Azure, OCI, and GCP environments are supported, with Terraform integration to streamline large-scale deployments. For containers and Kubernetes, Illumio offers an agentless solution that provides visibility and topology mapping for containerized workloads. The integration of Azure Firewall as an enforcement point further strengthens security in Azure by providing unified rule management and enhanced visibility. This allows organizations to manage Illumio and Azure native firewall rules together, simplifying ongoing operations.
Campus/branch: Illumio delivers endpoint visibility and enforces security policies directly on devices, whether users are at home or in the office. Policies can leverage Active Directory groups and device identities to control access, and integration with third-party ZTNA products enables consistent policy enforcement across network access and microsegmentation.
CPS: Illumio integrates with Armis to leverage device identification, bringing CPS asset visibility into Illumio’s platform and enhancing threat containment and device intelligence.
Other capabilities: Illumio’s integration with NVIDIA BlueField DPUs delivers breach containment and policy enforcement at the hardware level, offloading segmentation to the DPU for efficient, high-performance security. Integrations with Qualys, Rapid7, and FireMon provide vulnerability insights, risk prioritization, and unified policy compliance reporting.

Zero Networks

Product or Portfolio Overview

Zero Networks’ offering includes a centralized policy engine that enforces microsegmentation policies leveraging host firewalls, Kubernetes CNIs, and cloud-native tools. This enables agentless deployment and incorporates port-level multifactor authentication (MFA) to secure privileged access and prevent lateral movement.

How Zero Networks Competes

Zero Networks primarily operates in North America, but also has operations in EMEA and Asia/Pacific. In the past 18 months, the company has introduced enhanced Kubernetes microsegmentation features that leverage native Kubernetes tools and eBPF technology, with automated discovery of workloads and granular traffic insights. In June 2025, Zero Networks announced having raised $55 million in Series C funding, bringing its total funding to over $100 million.

Zero Networks’ differentiation lies in a largely agentless offering with strong automation capabilities and low-touch deployment for simplified asset discovery and policy enforcement, with built-in MFA. However, Zero Networks lags in advanced reporting and customized alerting capabilities, and the absence of third-party NAC partnerships limits organizations seeking to integrate segmentation with their existing NAC infrastructure.

Zero Networks emphasizes the following capabilities in its go-to-market approach:

Artificial intelligence: Zero Networks’ deterministic enforcement engine forms the foundation of the platform, while AI is strategically used in supporting roles to enhance usability and knowledge sharing. This approach seeks to enhance customer experience and operational efficiency, while critical security functions stay rooted in factual data. AI enables natural language queries, helping internal support teams improve customer service and streamline onboarding and support processes. The breach readiness report, assisted by AI, provides customers with actionable insights into security gaps before deployment, serving as both a sales enabler and a practical tool for risk assessment.
Cloud: Zero Networks employs a segmentation server that integrates with asset repositories like Azure AD and various SaaS/cloud platforms, automatically discovering and profiling assets via lightweight API calls. For Kubernetes, its access matrix provides granular visibility with visual indicators for connection status, enabling policy enforcement even for teams without deep Kubernetes expertise. These capabilities are natively integrated with Kubernetes constructs such as CNI, allowing for automated policy management without the need for external tools.
Campus/branch: Zero Networks’ automation engine observes user and device behavior during a learning phase, and maps legitimate access patterns. Based on this information, it automatically generates granular firewall rules that restrict assets to only designated resources, accelerating and simplifying microsegmentation. Access to critical ports can be controlled with MFA, triggered when privileged access is requested, through integration with identity providers.
CPS: Zero Networks captures network-level information of CPS assets through integration with network switches, also leveraging its automation engine for policy creation and applying MFA.
Other capabilities: Zero Networks promotes its “low-touch” platform as an alternative to managed microsegmentation services, emphasizing decreased maintenance and staffing needs.

Zscaler

Product or Portfolio Overview

Zscaler’s offering includes Zscaler Zero Trust Device Segmentation and Zero Trust Cloud. The main components include a policy engine, agent-based and agentless enforcement, discovery/visualization tools, risk analytics, and policy recommendations.

How Zscaler Competes

Zscaler’s operations are global, though more than 80% of its revenue comes from North America and EMEA. In the past 18 months, the company has introduced its Zero Trust Branch appliance for branch microsegmentation, enhanced cloud workload protection, and launched an AI-powered engine to simplify application management and policy enforcement.

Zscaler’s differentiation lies in its granular and scalable microsegmentation for CPS assets. However, support for employee devices is limited with Zero Trust Device Segmentation, while Zero Trust Cloud is best-suited for pure cloud environments and is complex to configure.

Zscaler emphasizes the following capabilities in its go-to-market approach:

Artificial intelligence: While Zscaler’s microsegmentation solution is primarily centered on analytics and fingerprinting techniques, it now includes an AI engine, which provides policy recommendations.
Cloud: Zero Trust Cloud supports microsegmentation in AWS, Azure, and GCP environments, enforcing least-privileged access policies based on application identity, context, and user posture. Host-based agents are deployed on workloads, including Kubernetes containers (Amazon EKS). The platform uses ML to automate resource grouping and policy recommendations.
Campus/branch: While Zscaler provides the ability to group and segregate user devices, its Zero Trust Device Segmentation offering predominantly targets CPS assets. For employee devices, Zscaler positions its Zscaler Private Access (ZPA) offering for microsegmentation, which provides fine-grained access to individual assets and applications, and workload isolation. However, ZPA is a ZTNA product, requiring an agent and subscription per user.
CPS: Zscaler supports granular device fingerprinting and policy enforcement, leveraging both proprietary and commercial databases to accurately identify and manage CPS assets, though it does not cover all levels of the Purdue model. Zscaler facilitates the management of static IP address schemes common in CPS environments by providing customers with automation scripts (e.g., Active Directory Group Policy Objects [AD GPOs], Python, and PowerShell). The change in netmask of /32 does not require reboot, nor does it drop active sessions. Zscaler’s /32 subnet approach places each device on its own isolated network, reducing attack surfaces, supporting thousands of endpoints per cluster, and enabling high-availability redundancy.
Other capabilities: By combining network-based microsegmentation and existing ZTNA capabilities, Zscaler can replace the need for some security appliances, such as firewalls and NAC, with its zero-trust SD-WAN, primarily in branch locations. Another value proposition is the ability to remove costly switches, because Zero Trust Device Segmentation eliminates the need for inter-VLAN routing.

References and Methodology

Primary and secondary resources were used to prepare this research. We used additional industry sources and publicly available information to verify the accuracy of the information. Sources of data used by Gartner include the following:

Technology provider questionnaires
Technology provider briefings and interviews
Data from Gartner interactions with end users and technology providers
Articles in the general and trade media
Published company announcements and financial earnings reports

In addition, factual review of the technology provider information was conducted with the respective technology providers. Our conclusions about competitive positioning consider these inputs but, ultimately, reflect Gartner’s own judgment based on our overall perspective of the market.