Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Piotr Kupisiewicz, CTO, Elisity
Over the last few years, engineering teams across the cyber ecosystem built platforms. Now comes the hard part: making them work at scale without collapsing. Here’s what separates platforms that deliver from ones that get ripped out after six months.
Single-Tenant Control Beats Shared Infrastructure
Multi-tenant SaaS had its moment. Now customers want their data back under their control. Single-tenant control planes give you real isolation, custom release cycles, and audit trails that don’t mix your data with 400 other companies.
We run dedicated Elisity Cloud Control Centers per customer. Not shared instances with labels. Separate environments. When audit time comes, customers point to their control plane. Done. No explaining how data isolation works in a shared database.
Multi-cloud deployments make this more relevant. Enforcement logic runs in customer data centers or clouds. Policy control stays isolated. You don’t share blast radius with anyone.
Test Security Policies Before You Ship Them
Security leaders who ship security policies straight to production without testing are either brave or looking for new jobs. 2026 marks the year where simulation stops being optional.
Modern platforms mirror production traffic against proposed policies. You see what breaks before users notice. Deploy in simulation mode, watch denied traffic, refine device classifications, flip to enforcement. No 2am emergency rollbacks because you blocked the CFO from the ERP system.
Simulation needs clean data. If your platform doesn’t know what devices talk to what, you’re just guessing. We correlate identity, device posture, and traffic patterns into one graph. Context makes simulation useful instead of theoretical.
APIs Need to Share Context, Not Just Alerts
Integration through APIs isn’t new. What changed: platforms that share live context beat those that batch-export alerts overnight. Security tools need to talk with real-time state data.
EDR detects suspicious behavior. SIEM correlates the alert. Network segmentation platform isolates the device-automatically. Not through middleware or manual runbooks. Through APIs that carry device identity, risk scores, and current network state.
We built more than 25 integrations because security teams already own tools that work. Ripping out existing EDR, CMDB, or SIEM platforms to adopt microsegmentation doesn’t fly. Modern platforms augment what you have through clean, telemetry-rich APIs.
Competitive edge in 2026: platforms that consume context from multiple sources and push enforcement decisions back out. One-way data flows are legacy thinking.
Enforcement Belongs at the Edge
Centralized policy decisions with distributed enforcement is table stakes. What’s next: embedding inference models directly at enforcement points.
Customers deploy Elisity Virtual Edge software that runs as containers on network switches or as VMs in their environment. Each Elisity Virtual Edge gleans identity metadata from traffic flows, detects devices, and enforces policy using switch native functionality. Control stays centralized. Enforcement happens at the network edge where traffic actually flows.
AI policy recommendations matter more when edge nodes make local decisions based on models trained centrally. Lower latency. Higher throughput. Resilient when control plane connectivity drops.
Edge enforcement also solves the “what happens when cloud goes down” problem. Virtual Edge Nodes keep enforcing last-known-good policies even without reaching the Elisity Cloud Control Center. Security fails closed, not open.
Data Quality Determines Everything
Security moved from “protect the network” to “validate every decision.” Validation depends entirely on data quality. Garbage identity data produces garbage policies.
Platforms that aggregate device metadata from multiple sources create one source of truth. We call ours Elisity IdentityGraphTM-real-time correlated visibility of user, workload, and device relationships. Active Directory says one thing. Your CMDB says another. Network telemetry adds a third data point. Elisity IdentityGraphTM reconciles all of it.
Clean data enables better policy decisions. Platforms suggest policies based on observed traffic patterns and identity attributes. Security teams build policies that are static (manually assigned by IP address) or dynamic (auto-assigned based on identity attributes like user, device type, or cloud metadata). Managing identity-based groups instead of individual IP rules reduces operational overhead significantly.
Data lineage matters too. When a policy blocks traffic, you need to trace back to the source data that drove that decision. Was it a misconfigured CMDB entry? Outdated AD group? Risk score from your EDR? Platforms that expose data lineage help engineers fix root causes instead of tweaking symptoms.
Cloud Compute Makes Real-Time Correlation Possible
Cloud-native architectures finally make it feasible to correlate massive datasets in real-time and adapt policies accordingly. Five years ago, compute and storage requirements were too high. On-prem infrastructure couldn’t scale fast enough.
Modern platforms ingest telemetry from network flows, identity systems, endpoint sensors, and threat intelligence feeds-all at once. We’re talking millions of events per hour that need correlation across users, devices, and workloads. Cloud elastic compute makes this economically viable. Spin up processing capacity when traffic spikes. Scale down during quiet periods.
Engineering challenge isn’t just storage or compute. Building data pipelines that maintain sub-second correlation times while handling schema variations across 25 integration sources is hard. AD sends identity data in one format. EDR sends risk scores in another. Network telemetry arrives as raw flows. Platforms need to normalize, correlate, and present unified views without bottlenecking enforcement decisions.
Now you can do something previously impossible: adapt policies based on live state changes. Device risk score jumps because EDR detected suspicious behavior? Policy enforcement responds immediately-isolating that device or restricting access-without waiting for batch processing or manual intervention. Closed-loop automation only works when your data pipeline runs fast enough to matter.
CTOs building these systems face one fundamental tradeoff: centralized intelligence versus distributed enforcement. You need cloud-scale analytics to correlate everything, but you can’t afford the latency of consulting a cloud service for every network decision. Answer: train models centrally, deploy them to edge enforcement points, and update continuously as new data arrives. Distributed intelligence model is what makes real-time policy adaptation practical at enterprise scale.
What To Build Now
Focus on platforms that preserve operational control. Single-tenant architectures with edge enforcement. Clean APIs that share context, not just alerts. Policy simulation that tests against real traffic. Data aggregation that creates actual sources of truth.
Platforms that survive 2026 balance scale with simplicity. Security teams manage identity-based policy groups instead of hand-crafting individual firewall rules. Platforms suggest policies based on observed behavior, but humans make final decisions. AI eliminates configuration uncertainty, not decision-making autonomy.
Security engineering stopped being about buying more tools. Now it’s about making existing tools work together through platforms that share context, enforce consistently, and fail gracefully.
##
ABOUT THE AUTHOR
Piotr Kupisiewicz brings over 20 years of cybersecurity expertise and enterprise architecture experience as CTO at Elisity. His background spans a decade at Cisco as Cyber Security Consultant designing end-to-end security architectures for Fortune 100 enterprises and Technical Lead supporting Cisco’s cybersecurity portfolio. He specialized in complex network segmentation projects across manufacturing, healthcare, and telecommunications sectors. Prior to Cisco, Piotr served as Software Engineer at Delphi Automotive Systems, developing critical traceability systems while managing IT/OT operations. His entrepreneurial foundation began when he founded StarNET, an internet service provider he operated for 13 years. Piotr holds a Master’s degree in Informatics from Politechnika Slaska w Gliwicach and maintains CCIE Security certification.
