In an era where cybersecurity threats are increasingly sophisticated, microsegmentation has emerged as a critical component of robust network defense strategies. VMblog recently sat down with Piotr Kupisiewicz, CTO of Elisity, Inc., to discuss the company’s groundbreaking approach to microsegmentation and its recent recognition as a “Strong Performer” in Forrester’s Q3 2024 Wave report.
Kupisiewicz sheds light on how Elisity’s cloud-delivered, identity-based platform is revolutionizing network segmentation, particularly in sectors like healthcare and manufacturing. From rapid deployment and comprehensive device visibility to AI-driven policy management, Elisity is addressing the complexities that have long plagued traditional network segmentation methods.
As organizations grapple with the challenges of securing diverse environments including IoT, OT, and IoMT devices, Kupisiewicz offers insights into Elisity’s innovative solutions and its vision for the future of network security.
VMblog: How does Elisity’s identity-based approach to microsegmentation differ from traditional network segmentation methods?
Piotr Kupisiewicz: Elisity’s microsegmentation platform solves the complexity, coverage gaps, and ongoing security operations challenges that have plagued teams attempting to implement meaningful, risk-reducing, Zero Trust network segmentation architectures. Network segmentation as a concept has been around for a long time – from the early days of VLANs and NAC (Network Access Control) to attempts at running complex networks powered by VMware’s NSX or Cisco ACI.
Elisity is cloud-delivered and does not require agents, hardware, or complicated changes to existing networks or ACLs, Elisity’s platform can be installed in hours at each physical location. In fact, over 83% of our customers implement critical security policies across their entire infrastructure within the first 90 days.
By providing complete visibility of every device, everywhere, Elisity significantly strengthens security postures. The platform leverages advanced machine learning algorithms to correlate device intelligence by triangulating metadata from identity, CMDB, EDR, and device databases. Elisity supports multiple vendors in each category to enable your organization the flexibility of not being locked in. This unparalleled discovery and visibility provide teams with the confidence to apply policies manually and automatically, benefiting from dynamic security policies. Furthermore, Elisity’s policies are easy to manage, simulate, update, and report on, streamlining the entire security process.
VMblog: What specific advantages did Forrester highlight that led to Elisity’s “Strong Performer” designation in the Q3 2024 Wave report?
Kupisiewicz: Sure. First, I want to say that we offer a breakdown on our website, providing visitors with insights on Elisity and The Forrester WaveTM Microsegmenation Solutions, Q3 2024 here.
Forrester stated on their blog and in the report that this was the second edition of the Forrester WaveTM, with the last one being back in Q1 2022. The analyst calls this “The Dawn of the Golden Age of Microsegmentation,” and we couldn’t agree more. In this evaluation, Elisity was cited as a Strong Performer in Microsegmentation Solutions. Elisity was one of 11 vendors evaluated for the Forrester Wave based on 23 criteria that examined a vendor’s current offering, strategy, and market presence. In its first appearance in a Forrester Wave, Elisity received the highest score possible in the vision, roadmap, network-based enforcement, and OT, healthcare, and IoT criteria.
In this evaluation, Forrester provided the following statements about Elisity:
“Elisity offers a fresh and exciting take on the old idea of making the network do the work.”
“The vendor’s (Elisity) vision is straightforward: to finally realize the least privilege access principle of Zero Trust where it is needed most, in the network.”
“Customers with physical sites like OT and healthcare that are running switches from Juniper, Cisco, or Arista will appreciate the agentless, policy-by-type innovation of ‘Elisity.'”
“Network infrastructure vendors have long had microsegmentation solutions on the market, but they were prone to project failure, usually due to complexity. Elisity makes this old idea work by removing the complexity, compressing the policy, and leveraging multiple vendors’ switch fabrics to enable microsegmentation.”
VMblog: How does Elisity address the challenges of discovering and applying policies on unmanaged devices like IoT, OT, IoMT?
Kupisiewicz: Elisity’s powerful discovery capabilities enable customers to discover every device on their network, from the known inventory of IT-managed devices to unknown devices like IoT, OT, IoMT, and ephemeral devices. Combine that with the Elisity IdentityGraphTM and integrations with device intelligence platforms like Claroty, Armis, ServiceNow, and identity data from Active Directory or Okta, and you’ll understand why Healthcare, Manufacturing, and other organizations with thousands of unmanaged devices are adopting Elisity.
Forrester sated in the Forrester WaveTM Microsegmentation, Q3 2024 report:
“These easy-to-understand policies can be deployed quickly without learning. Because these policies are most useful where there is a proliferation of different device types, Elisity has deep integrations with OT and healthcare technology providers. Customers with physical sites like OT and healthcare that are running switches from Juniper, Cisco, or Arista will appreciate the agentless policy-by-type innovation of Elisity.
VMblog: What emerging cybersecurity trends or threats is Elisity’s platform specifically designed to counter?
Kupisiewicz: Microsegmentation is essential to containing attackers’ lateral movement within compromised networks, making it fundamental to cyber defense and foundational to building zero trust architectures. With over 60% of successful attacks using tactics that enable threat actors to spread malware, ransomware, and identity-based attacks via the network, Elisity’s platform is a proactive way to limit the blast radius of attacks.
Now, NIST, CISA, HHS 405(d), PCI, and IEC 62443 all emphasize network segmentation, and it’s becoming a requirement in more and more frameworks and regulations. Cyber insurers are also looking for microsegmentation architecture that can be automated and leverage AI to discover, classify, and monitor all users, workloads, and devices wherever and whenever they appear on the network.
VMblog: Looking ahead, what key developments or features can we expect from Elisity in the next 12-18 months?
Kupisiewicz: As we look to the future of network security, microsegmentation is emerging as a critical component in the fight against increasingly sophisticated cyber threats, particularly in healthcare and manufacturing sectors. The cybersecurity industry is rapidly evolving to meet the complex needs of these verticals, with a focus on identity-based controls, agentless solutions, and seamless integration across hybrid environments.
In healthcare, where patient data protection and medical device security are paramount, we’re investing heavily in solutions that can easily implement granular controls across IT IoMT, and IoT assets. Our platform’s ability to abstract policy management from networks is proving invaluable in containing ransomware and minimizing incident blast radius.
For manufacturing and critical infrastructure, our development efforts are centered on protecting legacy OT systems and facilitating IT and OT network convergence. We’re also expanding our capabilities to support microservices architectures and public cloud environments, allowing organizations to manage security policies for all assets through a unified console.
Looking ahead, we anticipate significant advancements in AI and ML in leveraging integrations for real-time risk assessment and automated policy enforcement, moving towards the goal of instantaneous threat containment without compromising operational efficiency.
You can download a copy of The Forrester WaveTM Microsegmentation Solutions, Q3 2024 here: https://hubs.ly/Q02QBdc30
##
