Network & Infrastructure Security

Illumio Segmentation

Host-based microsegmentation mapping dependencies to enforce least-privilege and contain breaches.

Illumio Segmentation Overview

What it does

Illumio Core is a host-based microsegmentation product that contains breaches by stopping lateral movement across data center, cloud, and endpoint workloads. Rather than relying on network firewalls or VLANs, it decouples segmentation policy from the underlying network and enforces rules directly on each workload through a lightweight agent paired with a centralized policy controller. This host-level model lets security teams write least-privilege policy based on application identity instead of IP addresses.

How it works

The Policy Compute Engine (PCE) ingests real-time traffic telemetry from a Virtual Enforcement Node (VEN) installed on each workload, builds an application dependency map of east-west flows, and computes per-workload policy. Policies are expressed through Role, Application, Environment, and Location labels, and the VEN enforces them using the operating system's native firewall on Linux and Windows hosts. Progressive enforcement modes let teams test rules before blocking traffic, while SecureConnect adds IPsec encryption between workloads. Coverage spans bare-metal servers, virtual machines, containers, and cloud instances. Named deployments include eBay, which segmented 3,000 servers, and Marriott Vacations.

Credentials and traction

Illumio has completed a SOC 2 Type II audit, holds a FedRAMP Moderate Authorization to Operate, and uses FIPS 140-2 validated cryptographic modules in its Policy Compute Engine and Virtual Enforcement Node. It was named a Leader in The Forrester Wave: Microsegmentation Solutions, Q3 2024, and a Customers' Choice in the 2026 Gartner Peer Insights Voice of the Customer for Network Security Microsegmentation, earning 4.8 of 5 across 59 reviews with 98% of reviewers willing to recommend. Deployments include federal agencies and 15 of the Fortune 100.

Key Capabilities

Microsegmentation

Discovers the actual north-south and east-west communication flows between workloads and devices by observing live traffic, producing the dependency data that allow-list policy is built from instead of hand-documented application maps. Products differ in flow sources (host agent, network sensors or switch telemetry, cloud flow logs, virtual switch) and therefore in how completely agentless assets are covered.

Programs the cloud provider's own network controls (AWS security groups, Azure network security groups, GCP firewall rules, VPC and VNet constructs) from the central segmentation policy, so cloud virtual machines are governed by the same labels and rules as on-premises workloads without a host agent. Products differ in provider breadth, whether enforcement uses native controls or requires proprietary virtual appliances, and how drift between cloud rules and intended policy is reconciled.

Contains an active breach by cutting the paths ransomware and attackers use to spread: pre-staged containment policies that block peer-to-peer SMB, RDP, WMI and other administrative protocols between endpoints and servers, a firebreak around devices that cannot run security agents, and quarantine of compromised workloads that can be triggered from the console, by a severity-level switch, or by SIEM, SOAR and EDR during an incident. Products differ in whether containment can be staged by threat level and activated with a single switch, and in how quickly a quarantine reaches every enforcement point.

Enforces segmentation policy on the workload itself through a host agent or existing endpoint hooks (operating system firewall, eBPF, an EDR agent already deployed), so the policy travels with the workload across data center, cloud and endpoint locations and gives per-process visibility. Products differ in operating system coverage, resource overhead, kernel or user-mode operation, and whether an existing EDR agent can be reused instead of deploying a new one.

Discovers and classifies every workload and device that communicates on the network, including unknown and unmanaged assets missing from the CMDB, using the product's own agents, network sensors and ingested external inventories, so segmentation policy can cover assets the organization did not know it had. Products differ in fingerprinting depth (device make, model, operating system, function), agentless reach, and use of external data sources.

At a glance

Deployment: Endpoint Agent · Hybrid · On-Premises · +1
Compliance: FedRAMP Moderate · FIPS 140-2 · +1
Integrations: 6 tools
Support: 24/7 Support · Community Forum · +7

Info last updated on September 7, 2026

Buyers

Start a shortlist with Illumio Segmentation

Compare options, add your notes, and run informed evaluations.

Vendors

Is this your product?

Claim your profile to connect with the teams looking for your solutions.

Claim your profile