Microsegmentation
Granular workload-to-workload network isolation.
Overview
Microsegmentation enforces least-privilege traffic policy between workloads, containers, and VMs to contain breaches. It maps dependencies and blocks unauthorized east-west flows in data center and cloud. Licensed per workload or protected node. Policy modeling is the main operational effort.
Advanced blast-radius containment after basic segmentation is in place.
Advantages
- Illumio strong visualization and host-based enforcement
- contains breach blast radius
- covers data center and cloud.
Trade-offs
- Heavy dependency-mapping and policy effort
- agent overhead
- over-restrictive policy can disrupt apps
- pricey at workload scale.
Open-source option
For cloud-native/Kubernetes estates, eBPF tools give strong open-source microsegmentation — Cilium (identity-aware L3–L7 policy), plus Calico and native NetworkPolicy. There is no mature OSS option for agent-based segmentation of legacy VM/bare-metal fleets, where commercial tools (Illumio, Guardicore) lead.
Vendors & tools in this area
The most widely adopted Kubernetes CNI with identity-based network policy — the non-Cilium OSS microsegmentation path this area's ossVerdict note already references.
Visit site →Automated, identity-driven microsegmentation — agentless policy generation via ML from observed traffic.
Visit site →