Zero Trust and Microsegmentation: What It Really Looks Like in Practice

Zero Trust has become one of those terms that everyone loves to throw around—usually with a few flashy diagrams and a “never trust, always verify” tagline. But when you peel away the high-level talk, you’re left with one key question: how do you actually enforce Zero Trust in a way that works across modern, hybrid, and often chaotic IT environments?

That’s where microsegmentation comes into play. It’s not just a checkbox—it’s the foundation for limiting lateral movement, enforcing least privilege, and containing potential breaches before they spread. But as with most things in security, the devil is in the details. And when it comes to microsegmentation, how you implement it—and with what tools—can make or break your strategy.

In this post, I’m going to take a practical look at three leading technologies in this space: Illumio, Guardicore (now Akamai), and VMware NSX. Each brings a different approach to segmentation, and each fits differently depending on your environment, your architecture, and your team’s operational reality. I’ll walk through their strengths, their trade-offs, and what to consider if you’re evaluating or deploying one of these solutions.

Let’s break it down.

What is Microsegmentation?

Microsegmentation is one of those terms that sounds more complicated than it needs to be. At its core, it’s about breaking down your network into smaller zones and putting tight controls on what can talk to what. Not in a broad “data center to internet” kind of way—but down to the level of individual workloads, applications, or even processes.

In traditional networking, segmentation usually meant VLANs or firewalls separating environments like dev, test, and prod. That was fine back when everything lived in the same data center and followed predictable traffic patterns. But in today’s environments—where apps span multiple clouds, containers spin up and down on demand, and legacy systems still need to talk to cloud-native services—those old models just don’t cut it.

Microsegmentation is the evolution of that idea. Instead of segmenting based on IP ranges or subnets, you segment based on identity, role, or context. You define policies like: “Only this specific app server should talk to that database, on port 1433, and nothing else.” And more importantly, you enforce those policies as close to the workload as possible—at the host level, not at the perimeter.

When done right, microsegmentation gives you:

• Granular control over east-west traffic (the stuff most firewalls ignore).
• Visibility into what’s actually talking to what, and why.
• Blast radius reduction—because if something gets compromised, it can’t just roam freely through the network.

But here’s the thing: microsegmentation isn’t a product. It’s a strategy. And how you implement it—whether with an overlay model, agent-based enforcement, or something baked into your network fabric—makes a massive difference.

That’s why we’re going to look at how Illumio, Guardicore, and VMware NSX each approach this problem, and how they fit into different kinds of environments.

How do the different technologies work?

Illumio

Illumio takes a host-based approach to microsegmentation. It uses lightweight agents called VENs (Virtual Enforcement Nodes) that sit on each workload. These agents aren’t inline—they don’t touch the traffic—but they do program the OS firewall (like iptables or Windows Filtering Platform) to enforce segmentation rules.

At the core is the Policy Compute Engine (PCE), which collects real-time telemetry from the VENs—things like traffic flows, metadata, and process-level info. Based on that, it builds a live application dependency map and recommends allowlist rules using simple, label-based policies (e.g., “Role: Web”, “App: ERP”, etc.).

Some things Illumio gets right:

• No inline components → no latency, no choke points.
• Works anywhere → data center, cloud, hybrid, no problem.
• Agentless fallback → for legacy systems and cloud services.
• Vulnerability-aware → combines segmentation with scan data.

It’s clean, scalable, and doesn’t require rearchitecting your network, hence it works in brownfield deployments and across cloud providers.

Guardicore

Guardicore (Akamai Guardicore Segmentation) uses a mix of agent-based sensors and agentless collectors (e.g., flow logs, APIs) to gather traffic data from workloads across data centers, clouds, containers, and endpoints.

A central management console (SaaS or on-prem) builds a real-time and historical map of network activity, showing flows down to the user and process level.

Key features:

• Dynamic flow mapping with fine-grained visibility.
• AI-assisted policy creation and use-case templates.
• Flexible, label-based enforcement decoupled from the network.
• Automated asset labeling via integrations with orchestration tools and CMDBs.
• Integrated breach detection, deception, and threat hunting (Akamai Hunt).
• Support for hybrid environments, including legacy, cloud, VMs, containers, and IoT.

Policies follow workloads across environments, independent of underlying infrastructure, and like Illumio works in brownfield environments since it uses an agent based architecture.

VMware NSX

VMware NSX uses a network virtualization layer to deliver microsegmentation within software-defined data centers (SDDC). It embeds security controls directly into the hypervisor, allowing traffic control between virtual machines without relying on external firewalls.

NSX enforces policies through a distributed firewall that operates at the virtual NIC level, with deep integration into the VMware ecosystem (vSphere, vCenter, etc.).

Key features:

• Distributed firewall (DFW) applies L2–L7 policies to east-west traffic inside the hypervisor.
• Policy enforcement is tied to VM attributes like tags, OS, name, and security groups.
• Centralized management through the NSX Manager and vSphere interface.
• Visibility tools include flow monitoring and traffic analysis with integration to NSX Intelligence.
• Service-defined firewall extends microsegmentation to bare metal and containerized workloads.
• Integration with third-party tools, including threat detection and SIEM platforms.
• Platform coverage includes VMware vSphere environments, NSX-T for multi-cloud and Kubernetes, and support for public cloud workloads via NSX Cloud.

Policies move with workloads across hosts and clusters, managed through consistent policy definitions in the NSX control plane.

Which technology should I choose?

Illumio vs. Guardicore vs. VMware NSX

Feature	Illumio	Guardicore (Akamai)	VMware NSX
Enforcement Method	Host-based, uses OS-native firewalls (via VEN)	Host-based sensors + agentless options	Hypervisor-level (via distributed firewall)
Traffic Handling	Out-of-band, not inline	Agent collects data; enforcement out-of-band	In-hypervisor, inline between vNICs
Management Console	PCE (on-prem or SaaS)	SaaS or on-prem management console	NSX Manager (typically on-prem)
Visibility	Flow and metadata-level	Flow, process, and user-level	VM and flow-level (via NSX Intelligence)
Policy Granularity	Workload-level (L3/L4 rules)	Process, user, app-level	VM and app-level (L3–L7 with NSX Advanced features)
Policy Creation	Label-based, auto-generated from flow data	AI-driven, template-based, flexible labels	Tag/group-based using vSphere objects
Infrastructure Dependency	Network-agnostic	Network-agnostic	Requires VMware stack (vSphere/NSX)
Cloud/Hybrid Support	Yes (multi-cloud, hybrid, agentless options)	Yes (multi-cloud, hybrid, agentless and agent-based)	Yes (via NSX Cloud, but tied to VMware infrastructure)
Container Support	Yes (containerized VEN)	Yes (Kubernetes, containers)	Yes (NSX-T with K8s integrations)
Legacy/IoT Support	Yes (via flow ingestion, no agent required)	Yes (via agentless collectors)	Limited (depends on network placement)
Threat Detection	No native threat detection	Yes (built-in detection, deception, threat hunting)	Yes (with NSX Advanced Threat Prevention)
Deployment Type	Lightweight agent; decoupled from infrastructure	Hybrid deployment (agent + integrations)	Fully integrated into VMware virtual infrastructure

Illumio, Guardicore (Akamai), and VMware NSX all deliver microsegmentation, but through different architectural models. Illumio and Guardicore combine agent-based and agentless data collection with rich visibility at the process and user level. VMware NSX enforces policies directly in the hypervisor, tightly integrated with the VMware ecosystem. If you only plan on using VMware as your main platform for virtualization NSX is the logical choice, however if you plan to mix different platforms including public cloud, Illumio and Guardicore are both better options.

from StarWind Blog https://bit.ly/4kimJDs
via IFTTT