Forrester Names Illumio a Leader and a Customer Favorite in The Forrester Wave™: Microsegmentation Solutions, Q3 2026

Microsegmentation has outgrown its old job description. Increasingly, teams are working to contain breaches and build cyber resilience, which makes microsegmentation matter more than ever.

That work also asks more of the technology. Few setups are simple. Workloads run in hybrid and cloud setups, on endpoints, in containers, and in operational technology (OT). Covering that much ground takes more than a network control.

Forrester makes that case in its new Wave for Microsegmentation Solutions, Q3 2026. The firm writes that “microsegmentation can and should play a larger role in organizations’ broader security initiatives because advancements in the ease of deployment and operation have made microsegmentation suitable for a wider range of organizations and it can provide important capabilities outside of network security.”  

To size up the market, Forrester looked at 10 vendors. Illumio was named as a Leader, with the highest score of any vendor in the current offering and strategy categories. Illumio also earned a Customer Favorite nod from the people who use it every day.

Forrester's analysis points to what teams need as they build breach containment, and where Illumio fits.

Illumio received top scores in current offering and strategy categories  

Forrester scored all 10 microsegmentation vendors against 25 criteria. The criteria covers what the product does, where the company is headed, how it innovates, how it treats customers, and how it shows up in the market.

Illumio received the highest score possible in 10 of those criteria, including visualization, cloud-native networking enforcement, product security, vision, and innovation.

Forrester describes it this way: “Illumio excels at essential microsegmentation functions. It supports a rich mix of workloads with agent-based and agentless methods. It enriches asset and flow records with a wide range of attributes and automatically creates labels for use in policies.”

The report also notes that Illumio “provides segmentation and observability across hybrid cloud, data centers, containers, endpoints, and operational technology (OT).”

That breadth is the whole point. Critical data and applications sit across older systems, cloud, endpoints, and special-purpose assets. Security teams have to see and segment all of it without adding new silos.

The Illumio platform brings Illumio Insights and Illumio Segmentation together to help teams:

• Find assets and see how they talk to each other across complex systems
• Add context to asset and traffic data so teams can make better security calls
• Build and manage segmentation policy across a broad mix of workloads
• Support both agent-based and agentless methods
• Get a clear view for access control and incident response

Newer work builds on that. Network Posture, part of Illumio Insights, grades security posture against real network traffic. Teams know which risks to fix first instead of guessing.

Illumio is a Customer Favorite

Good technology is only part of a strong microsegmentation program. Teams also need ongoing skill, partnership, and support even after its deployed.

That’s where the Customer Favorite designation comes from. Forrester writes: “Customers appreciate the level of engagement they receive from the Illumio executive leadership team, including the CEO. Repeat customers indicate their satisfaction with the consistently high quality of technical support, regardless of the personnel assigned to their account. Illumio is a Customer Favorite in this evaluation.”

Scale backs it up. BNP Paribas, eBay, and Microsoft all run on Illumio. Microsoft has rolled out both Illumio Insights and Illumio Segmentation across its corporate IT.

“When we needed to bring these capabilities into Microsoft, Illumio was the only segmentation solution that would work at the scale of Microsoft and deliver in our environment,” said Igor Tsyganskiy, Global CISO of Microsoft.

Built for real-world, real-time environments

No two networks look alike. Most run several generations of systems at once, across many clouds, with a mix of operating systems, container platforms, and endpoints. Many can never be taken offline.

That's why the interface matters so much. Forrester says the Illumio user interface “provides easy access to information that supports both access control and incident response use cases,” while adding that “it is very dense and may be overly detailed for some users.” That balanced read is useful context for teams weighing how microsegmentation can support both preventive controls and response work.

This flexibility matters most at scale. Security teams need an approach that fits the environment they already have. Few of them can redesign infrastructure first and lower risk later.

Illumio helps teams build steady segmentation that works with hybrid, mixed environments as they are. Teams can start with their biggest risks and expand over time.

Building microsegmentation for security operations

Microsegmentation used to be seen as a network control. That view is too narrow for the work it now does.

Forrester ties it to incident response. They say microsegmentation solutions “can provide additional telemetry and forensic data for investigations as well as an abstraction layer that can incorporate business context and simplify orchestration of response and containment workflows.”

Attack surfaces keep growing, and microsegmentation now drives a much wider set of results. It helps teams limit lateral movement and wall off assets that have been hit. It guards critical applications, backs up Zero Trust work, and blunts the harm that ransomware and other attacks can do.

Illumio has built its strategy around that shift. Forrester says “Illumio has articulated a vision for microsegmentation as a core element of security operations,” and that Illumio is “bridging the gap between its traditional users and other parts of the security organization by delivering agents mapped to personas from other teams.”

That idea sits at the heart of the Illumio platform. It pulls visibility, segmentation, and breach containment into one place. Teams can go from seeing risk to cutting it down.

Contain the breach with Illumio

Illumio was founded on a simple idea: breaches are going to happen, but they don't have to turn into disasters.

For that to hold true, teams need to see how their systems talk to each other. They need to spot risky connections and shut down an attack without bringing the business to a halt. That calls for a platform like Illumio, one that works across many kinds of environments and covers both sides of the job: lowering risk up front and moving fast when something goes wrong.

Forrester reaches the same conclusion: “Organizations with large, heterogeneous environments focused on improving their cyber resilience should consider Illumio.” That lines up with what Illumio has always worked toward: clearer visibility, fewer risky paths left open, and breaches that stop before they spread.

For teams running large, complex environments that want to be more resilient, the case for microsegmentation has never been stronger.

Access a complimentary copy of The Forrester Wave™: Microsegmentation Solutions, Q3 2026.

Want to take the conversation further? Join the Illumio User Community to connect with other security practitioners and Illumio experts.

‍

Disclaimer

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.