Listen to this Post
Introduction: The Network Is No Longer a Safe Boundary
Cybersecurity has entered a new phase. Attackers are no longer limited by the speed of human operators, and artificial intelligence is increasingly capable of accelerating reconnaissance, identifying vulnerable systems, and helping adversaries move through compromised environments. In this reality, simply protecting the perimeter is no longer enough.
The harder question is what happens after an attacker gets inside.
This is where microsegmentation has become increasingly important. Instead of assuming that everything inside a corporate network can communicate freely, microsegmentation creates smaller security boundaries around applications, workloads, servers, containers, and services. The objective is straightforward: if one workload is compromised, the attacker should not automatically gain a path to everything else.
That philosophy has been central to the work of Isovalent cofounder Thomas Graf and is now part of Cisco’s broader security strategy following Cisco’s acquisition of Isovalent. The latest recognition from Forrester highlights just how important this approach has become.
According to Cisco, Cisco Secure Workload was named a Leader in The Forrester Wave™: Microsegmentation Solutions, Q3 2026. Cisco says the recognition reflects Secure Workload’s ability to provide application dependency visibility, develop security policies, and enforce those policies across modern hybrid and multi-cloud environments.
But the bigger story goes beyond one vendor or one analyst report.
The real shift is happening in the architecture of enterprise security itself.
Why East-West Traffic Has Become the Critical Battlefield
Traditional network security has historically concentrated heavily on north-south traffic: connections entering and leaving an organization.
That model made sense when applications lived primarily inside clearly defined data centers and the internet was separated from internal systems by relatively strong perimeter controls.
Modern infrastructure looks very different.
A single business application can now involve a physical server, virtual machines, containers, Kubernetes clusters, cloud databases, APIs, SaaS services, and workloads distributed across several geographic regions.
The result is an enormous amount of east-west traffic.
These are the internal communications taking place between workloads and applications. And while those connections are essential for business operations, they can also become highways for attackers.
If an attacker compromises one server and that server is allowed to communicate freely with dozens or hundreds of other systems, the initial compromise can quickly become a much larger incident.
Microsegmentation attempts to break that chain.
Microsegmentation: Turning a Flat Network Into Security Zones
Microsegmentation can be understood as creating security boundaries around individual workloads or logical groups of workloads rather than relying exclusively on traditional network segments.
Instead of saying, “Everything inside this network can communicate,” security teams can define more precise rules.
An application server may communicate with a database.
A web service may communicate with an API.
A container may communicate with a specific backend service.
A management system may communicate with a defined set of infrastructure components.
Everything else can be denied or restricted.
This follows the principle of least privilege at the network level.
The result is not necessarily a completely isolated environment. It is a more deliberate one.
Why AI Makes Lateral Movement More Dangerous
The emergence of AI-powered offensive capabilities adds another layer of urgency.
Cyberattacks traditionally required attackers to perform many repetitive activities manually: reconnaissance, vulnerability research, target identification, credential analysis, and infrastructure discovery.
AI can potentially accelerate portions of that workflow.
An attacker who previously needed hours to understand an unfamiliar environment may increasingly be able to automate parts of the process. Even when humans remain involved, automation can allow adversaries to investigate more targets and make decisions faster.
That creates an uncomfortable possibility.
A security team may have minutes or hours to contain an intrusion that an attacker can explore at machine speed.
This is why preventing lateral movement matters so much.
The objective is not necessarily to guarantee that the first compromise never happens. That is an increasingly difficult promise to make.
The objective is to make sure that one compromised workload does not become an enterprise-wide compromise.
Cisco Secure Workload Targets the Visibility Problem
One of the biggest obstacles to effective microsegmentation is surprisingly basic: organizations often do not have a complete understanding of how their applications communicate.
Security teams may know that a particular application exists, but understanding every dependency behind it can be considerably more difficult.
Which server does it contact?
Which database does it require?
Which API does it depend on?
Which container communicates with which service?
What happens if a connection is blocked?
Which communications are legitimate, and which are unnecessary?
Cisco Secure Workload is designed to help organizations answer these questions by providing application dependency visibility and policy capabilities across different infrastructure environments.
That visibility can become the foundation for segmentation.
Hybrid Infrastructure Makes Segmentation Harder
The modern enterprise rarely operates from a single infrastructure model.
A company might maintain traditional servers in a private data center while simultaneously operating virtual machines in public clouds and Kubernetes clusters managed by separate application teams.
Different environments often have different networking models, security controls, operational teams, and deployment practices.
This fragmentation creates an obvious security problem.
If every environment requires a completely different segmentation strategy, security teams can quickly lose consistency.
A policy that exists on-premises may not exist in the cloud.
A rule protecting a virtual machine may not translate cleanly to containers.
A security team may have excellent visibility into one environment while having almost no understanding of another.
Cisco’s approach is designed around bringing these environments under a more consistent policy and enforcement model.
Agent-Based and Agentless Enforcement
A particularly important part of the Secure Workload strategy is the combination of agent-based and agentless approaches.
Agent-based controls can provide deep visibility from the workload itself, potentially offering detailed information about processes, connections, and runtime behavior.
Agentless approaches can be useful when installing software on every workload is impractical or undesirable.
This distinction becomes increasingly important in large enterprises.
Some systems are easy to manage.
Others are legacy platforms, appliances, specialized infrastructure, or highly regulated workloads where installing an additional security component can introduce operational complications.
A flexible architecture therefore matters.
Forrester Recognition Highlights Policy and Enforcement
Cisco says Forrester described Secure Workload as a “hybrid agent-based and agentless solution” and highlighted its enforcement capabilities across on-premises and cloud-native environments.
Cisco also reports that it received the highest possible scores in several criteria, including policy administration, on-premises network-based enforcement, and cloud-native networking enforcement.
Those distinctions matter because visibility alone does not stop an attacker.
Knowing that two workloads communicate is useful.
Understanding why they communicate is better.
Being able to enforce a policy that prevents unauthorized communication is where visibility becomes an actual security control.
The Difference Between Seeing and Controlling
Modern security platforms increasingly emphasize visibility, but visibility should not be confused with containment.
A security dashboard can show that an unusual connection exists.
It can identify which workloads are communicating.
It can highlight a suspicious dependency.
But if the organization cannot act on that information, the attacker may continue moving.
Microsegmentation closes part of that gap by connecting discovery with enforcement.
The workflow becomes:
Discover → Understand → Define → Enforce → Monitor → Refine.
That cycle is at the heart of a mature segmentation program.
Cisco’s Multi-Cloud Security Vision
Cisco says its broader vision involves bringing network zone controls, workload microsegmentation, and runtime enforcement together through consistent security intent.
The idea is particularly relevant as workloads become increasingly mobile.
An application might begin in a private data center.
Later, part of the application may migrate to a public cloud.
A database may move to a managed service.
A component may be rewritten as a container and deployed through Kubernetes.
From the
From the security
Extending Segmentation Beyond the Workload
Cisco is also expanding its agentless microsegmentation capabilities.
The company says support is being extended to Cisco N9300 Series Smart Switches, providing another method of implementing segmentation without requiring software to be installed directly on workload devices.
This can be especially valuable in environments containing infrastructure where agents are difficult to deploy.
It also reflects a broader industry trend: segmentation is moving away from being purely a network-design problem and becoming a distributed security-control problem.
eBPF Adds Another Layer of Visibility
Cisco is also advancing its Secure Workload agent with eBPF technology.
eBPF has become increasingly important in Linux security and cloud-native environments because it can provide deep observability into system and network activity without requiring traditional kernel modifications.
For security teams, the attraction is obvious.
Modern applications are dynamic.
Containers start and disappear.
Services scale automatically.
Processes change.
Kubernetes workloads move.
Traditional static network diagrams struggle to keep pace with this behavior.
Runtime-aware visibility can provide a more accurate picture of what is actually happening.
Kubernetes Changes the Segmentation Equation
Kubernetes has fundamentally changed how many organizations think about workloads.
A traditional server might have a relatively stable identity.
A Kubernetes workload can be ephemeral.
Pods can be created, destroyed, rescheduled, and replicated automatically.
That means security policies cannot depend exclusively on fixed IP addresses.
Modern segmentation increasingly needs to understand application identity, workload identity, service relationships, namespaces, labels, and runtime behavior.
This is another reason cloud-native enforcement has become such an important part of enterprise security.
The Human Problem Behind the Technology
Technology alone does not create successful microsegmentation.
One of the most difficult parts of segmentation is deciding what should actually be allowed.
Security teams must understand application dependencies before aggressively enforcing policies.
If they block a connection that an application secretly depends on, they can create an outage.
If they allow everything “just in case,” the segmentation policy becomes almost meaningless.
This creates a delicate balance between security and operational continuity.
Policy Discovery Is Often the Hardest Step
Before enforcement begins, organizations need to observe their existing traffic.
This allows teams to distinguish legitimate dependencies from unnecessary communication.
The process can reveal surprising relationships.
An application that was believed to communicate with three services might actually depend on eight.
A legacy server may still be communicating with an obsolete system.
A development workload might have unexpected access to production infrastructure.
A segmentation project can therefore become an architectural discovery exercise as much as a cybersecurity initiative.
From Application Maps to Security Policies
Once dependencies are understood, the next step is translating them into policies.
This is where business context becomes important.
A database should not simply be protected because it is a database.
It should be protected according to which applications legitimately require access and what type of communication is necessary.
A payment-processing workload may require a very different policy from a development environment.
An identity system may need tightly controlled access from specific infrastructure.
Segmentation becomes much more powerful when policies are based on application intent rather than arbitrary network addresses.
Administrative Boundaries Matter
Large enterprises also need to consider who is allowed to create and modify segmentation policies.
A centralized security team may need global visibility, while application owners require control over policies affecting their own workloads.
Without carefully designed administrative boundaries, segmentation programs can become bottlenecks.
The objective should be centralized security intent without forcing every operational decision through one small team.
The Importance of Testing Before Enforcement
One of the safest ways to deploy microsegmentation is to begin with monitoring and simulation.
Organizations can first observe what a policy would block without actually blocking the traffic.
This provides an opportunity to identify hidden dependencies.
It also gives application owners a chance to validate the proposed policy.
Only after confidence has been established should enforcement gradually be introduced.
This approach reduces the risk of turning a security project into an availability incident.
Microsegmentation and Zero Trust
Microsegmentation fits naturally into a broader Zero Trust strategy.
Zero Trust rejects the assumption that network location automatically makes a system trustworthy.
Being inside the corporate network should not mean unrestricted access.
Instead, access should depend on identity, context, authorization, and explicit policy.
Microsegmentation extends that philosophy to workload-to-workload communication.
A compromised machine may still physically exist inside the trusted environment, but it should not automatically be trusted to communicate with every other system.
Why Blast Radius Matters More Than Ever
No security architecture can guarantee that every breach will be prevented.
The more realistic objective is resilience.
If an attacker compromises one workload, how much can they reach?
If credentials are stolen, what systems can those credentials access?
If a vulnerable application is exploited, how far can the attacker travel?
These questions define the blast radius of an incident.
Microsegmentation can reduce that blast radius by limiting unnecessary communication pathways.
That can transform a potentially catastrophic compromise into a much smaller, more manageable incident.
Deep Analysis: Understanding Microsegmentation From the Command Line
Inspect Active Network Connections
Security teams can begin investigating east-west communication directly from Linux systems.
ss -tulpen
This command provides visibility into listening services, active connections, ports, and associated processes.
For a more focused view of established connections:
ss -tp state established
This is useful during initial dependency discovery because it can reveal which processes are actively communicating with other systems.
Identify Processes Behind Network Activity
Administrators can combine socket visibility with process inspection:
sudo lsof -i -n -P
This can help map network activity back to applications and processes.
That mapping is important because an IP address alone rarely tells the complete story.
Inspect Kubernetes Network Policies
For Kubernetes environments, security teams can inspect existing policies with:
kubectl get networkpolicy -A
A more detailed view can be obtained with:
kubectl describe networkpolicy -A
These commands can expose whether namespaces and workloads already have restrictions in place.
Examine Kubernetes Workload Relationships
To understand the current workload landscape:
kubectl get pods -A -o wide
Administrators can then investigate services:
kubectl get svc -A
This provides a starting point for mapping applications, services, namespaces, and network identities before designing segmentation rules.
Review Linux Firewall Rules
On systems using nftables, administrators can inspect the current firewall configuration with:
sudo nft list ruleset
For environments using iptables:
sudo iptables -L -n -v
These commands should be used primarily for auditing and understanding the existing control plane before making changes.
Capture Traffic for Dependency Analysis
When deeper analysis is necessary, packet capture can help validate observed dependencies:
sudo tcpdump -i any -nn
For a specific port:
sudo tcpdump -i any -nn port 443
The goal is not simply to collect packets. It is to understand which communication flows are legitimate and which deserve closer investigation.
Important Operational Warning
Security teams should never blindly deploy restrictive firewall or segmentation rules into production based only on these commands.
The safer process is to observe traffic, document dependencies, test policies, validate them with application owners, and then introduce enforcement gradually.
Microsegmentation is ultimately a policy-engineering discipline, not simply a collection of firewall commands.
What Undercode Say: AI Has Changed the Segmentation Equation
1. The perimeter is no longer enough
Modern attackers do not need to destroy the perimeter if they can compromise a legitimate application.
- Internal traffic deserves the same attention as internet traffic
East-west communication can contain some of the most valuable signals during an intrusion.
3. Flat networks create unnecessary opportunities
Every unrestricted connection becomes a potential pathway for lateral movement.
4. AI increases the pressure on defenders
When attackers automate reconnaissance and decision-making, defenders need controls that operate continuously.
5. Microsegmentation provides containment
The biggest advantage is not necessarily preventing every initial compromise.
It is limiting what happens after compromise.
6. Visibility must come before enforcement
Security teams cannot safely restrict communication they do not understand.
7. Application dependency mapping is therefore fundamental
Without dependency intelligence, segmentation policies can easily break legitimate applications.
8. Hybrid infrastructure makes this harder
Physical servers, virtual machines, containers, Kubernetes, and public clouds rarely behave identically.
9. A single policy philosophy is valuable
Security requirements should remain consistent even when infrastructure changes.
10. Agentless enforcement can solve practical problems
Not every device can or should run a security agent.
11. Agent-based visibility still has major advantages
When available, workload-level telemetry can provide valuable runtime context.
12. eBPF is becoming strategically important
Modern Linux observability increasingly depends on the ability to understand activity close to the operating system.
13. Kubernetes requires identity-aware thinking
Static IP-based security models struggle with highly dynamic workloads.
14. Segmentation should follow application intent
The question should be “Who needs to communicate?” rather than simply “Who is on this subnet?”
15. Least privilege should apply to workloads
Workloads should have only the network access required for their function.
- Zero Trust and microsegmentation reinforce each other
Zero Trust establishes the philosophy; segmentation can provide an enforcement mechanism.
17. Security teams need operational flexibility
Central governance and decentralized application ownership can coexist when administrative boundaries are designed correctly.
18. Policy mistakes can create outages
A segmentation project that ignores application dependencies can become an availability problem.
19. Monitoring is the safest starting point
Organizations should understand traffic before attempting aggressive enforcement.
20. Simulation reduces deployment risk
Security teams can test policy assumptions without immediately interrupting production traffic.
21. Segmentation creates better incident-response options
When suspicious behavior appears, security teams can isolate workloads more precisely.
22. Containment speed matters
During an active breach, reducing available communication paths can buy defenders valuable time.
- Blast-radius reduction should be a measurable objective
Organizations should ask how many systems an attacker can reach from each critical workload.
24. Critical applications deserve stronger boundaries
Not every workload requires identical controls.
25. Identity infrastructure deserves special attention
Compromising authentication-related systems can dramatically increase attacker reach.
26. Legacy systems should not be forgotten
Old servers often contain sensitive data while operating under outdated security assumptions.
- Cloud migration does not eliminate segmentation requirements
Moving an application to the cloud changes infrastructure, not the underlying security need.
28. Containers do not eliminate traditional risks
They change the execution model, but compromised workloads can still become launch points for lateral movement.
29. Visibility can expose architectural weaknesses
Segmentation projects frequently reveal undocumented dependencies and unnecessary connectivity.
30. Security can become an application-architecture exercise
The process forces organizations to understand how their systems actually work.
31. Automation will become increasingly important
Manually managing thousands of workload relationships is not sustainable.
32. Policy should adapt to changing workloads
Dynamic environments require security controls capable of responding to infrastructure changes.
33. Enforcement must remain close to workloads
The closer security controls are to the workload, the more precise containment can become.
34. Distributed enforcement is increasingly logical
Modern applications are distributed, so security controls cannot remain tied to one physical location.
- Analyst recognition is useful, but not proof of universal superiority
A Forrester designation provides external context, but organizations still need to evaluate technology against their own requirements.
36. Customer experience matters
The best technical platform can fail if deployment is too complicated for operational teams.
37. Partners can accelerate implementation
Successful segmentation requires architecture, application knowledge, and operational planning.
- AI-powered attacks make lateral movement more urgent
As offensive automation improves, organizations need stronger controls that do not depend entirely on human reaction time.
- The future is likely to be identity- and intent-driven
Network security is gradually moving away from simple IP-based models toward application, workload, identity, and behavioral context.
40. The ultimate objective is resilience
The most valuable segmentation strategy is one that assumes compromise can happen and makes sure the compromise does not automatically become a catastrophe.
The Bigger Security Lesson
The most important message behind
It is that microsegmentation is becoming a foundational security control for modern infrastructure.
The enterprise network is no longer a clearly defined place. Applications are everywhere. Workloads move between clouds. Containers appear and disappear. Employees, services, APIs, machines, and autonomous systems communicate continuously.
In such an environment, security cannot depend on a wall surrounding the entire organization.
Security has to exist closer to the workloads themselves.
From Visibility to Enforcement
That is ultimately the journey Cisco Secure Workload is designed to support: understand application dependencies, translate that understanding into policy, and enforce those policies across distributed infrastructure.
The first step is visibility.
The second is understanding.
The third is policy.
The fourth is enforcement.
And the final step is continuous adaptation.
This cycle is becoming increasingly important as infrastructure and attacks both become more dynamic.
The AI Era Requires Smaller Security Boundaries
AI will not automatically make every cyberattack successful, but it has the potential to change the economics of offensive operations.
When machines can assist with reconnaissance, analysis, vulnerability discovery, and attack planning, defenders need architectures that limit the value of every successful intrusion.
That is where microsegmentation becomes strategically important.
If an attacker gets through one door, the rest of the building should not automatically be open.
✅ Cisco’s Forrester Recognition
The supplied article states that Cisco Secure Workload was named a Leader in The Forrester Wave™: Microsegmentation Solutions, Q3 2026. This is presented as Cisco’s reported recognition and is consistent with the article’s stated source.
The distinction matters: being named a Leader in an analyst evaluation does not mean every organization will find the product to be the best fit for its environment.
✅ Microsegmentation Can Reduce Lateral-Movement Opportunities
Microsegmentation is specifically designed to restrict unnecessary communication between workloads and systems. Limiting these pathways can reduce the potential blast radius of a compromise.
However, segmentation should be implemented carefully because overly restrictive policies can also disrupt legitimate application dependencies.
✅ East-West Traffic Is a Major Security Concern
Modern applications communicate extensively between internal services, containers, virtual machines, databases, APIs, and cloud components. Consequently, internal traffic is an important part of modern security monitoring and containment strategies.
The growing complexity of hybrid and cloud-native infrastructure makes understanding these relationships increasingly important.
❌ Microsegmentation Does Not Guarantee That a Breach Cannot Happen
Segmentation is not a magic shield. It does not automatically prevent phishing, credential theft, application vulnerabilities, supply-chain attacks, or every form of initial compromise.
Its primary value is limiting what an attacker can do after gaining access.
❌ Analyst Recognition Does Not Mean Universal Product Superiority
A Leader designation is an external evaluation based on a particular methodology, criteria, and point in time. Organizations should still conduct their own technical, operational, financial, and architectural assessments before selecting a platform.
Forrester itself notes that its research should not be interpreted as an endorsement requiring customers to select a particular company or product.
Prediction
(+1) Microsegmentation Will Become a Standard Control for AI-Era Enterprise Security
As enterprises deploy more AI systems, autonomous agents, cloud workloads, containers, APIs, and distributed applications, the number of machine-to-machine communication paths will continue to increase.
That growth will make traditional perimeter-focused security increasingly insufficient.
Organizations will increasingly treat microsegmentation as a standard component of Zero Trust architecture, particularly for critical applications and high-value infrastructure.
(+1) Runtime-Aware Segmentation Will Grow Faster
Static rules will struggle to keep pace with dynamic infrastructure.
Security platforms that can understand workload identity, runtime behavior, application dependencies, and changing infrastructure will become increasingly valuable.
Technologies such as eBPF are likely to play an important role in providing this deeper context.
(+1) AI Will Push Organizations Toward Automated Containment
If attackers can automate portions of intrusion operations, defenders will increasingly need automated mechanisms capable of detecting abnormal behavior and restricting communication quickly.
The future of segmentation will therefore likely involve greater integration between network policy, workload telemetry, identity, threat intelligence, and automated response.
(-1) Poorly Planned Segmentation Projects Will Continue to Fail
Organizations that treat microsegmentation as a simple firewall-rule deployment are likely to encounter application outages, operational resistance, policy sprawl, and administrative complexity.
The technology can be powerful, but successful implementation requires application discovery, careful policy design, testing, governance, and continuous refinement.
Final Thoughts: Build Security for the Breach You Cannot Prevent
The most important question in cybersecurity is no longer simply whether an organization can prevent every attack.
It is what happens when prevention fails.
A vulnerable application may eventually be exploited. A credential may eventually be stolen. An employee may eventually click the wrong link. A cloud service may eventually be misconfigured.
Security architecture must therefore assume that some defenses will fail.
Microsegmentation provides a way to design for that reality.
By making east-west traffic visible, restricting unnecessary communication, enforcing least-privilege principles, and placing controls closer to workloads, organizations can make lateral movement substantially more difficult.
Cisco’s recognition in the Forrester Wave: Microsegmentation Solutions, Q3 2026, therefore arrives at an important moment for enterprise security.
The network is becoming more distributed.
Applications are becoming more dynamic.
Attackers are becoming more automated.
And AI is accelerating both sides of the cybersecurity race.
In that environment, the organizations best positioned to withstand the next generation of attacks will not necessarily be the ones with the largest perimeter.
They will be the ones that understand exactly what is communicating with what — and have the ability to stop everything that should not be communicating.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: blogs.cisco.com
Extra Source Hub (Possible Sources for article):
https://www.stackexchange.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
