What Is Cisco Secure Workload?

Modern enterprise environments no longer operate within the safe confines of a well-defined physical perimeter. Applications now span private data centers, bare-metal servers, virtualized clusters, and multiple public clouds. As east-west network traffic expands across these distributed systems, conventional perimeter firewalls fail to provide visibility into lateral communication or stop unauthorized movements during a breach.

Cisco Secure Workload (formerly Cisco Tetration) addresses this challenge directly. Engineered as a comprehensive workload protection and zero-trust microsegmentation platform, it delivers pervasive visibility, automated policy generation, and continuous compliance monitoring across heterogeneous environments. By shifting the security perimeter directly to the workload itself, organizations can implement granular zero-trust security policies regardless of where their applications run.

Architecture and Core Capabilities: How Cisco Secure Workload Powers Zero Trust

Cisco Secure Workload operates on a cyclical zero-trust pipeline that transforms raw infrastructure telemetry into enforceable microsegmentation policies. Rather than relying on static network parameters like IP subnets or VLANs, the platform establishes dynamic, identity-centric workload protection through a multi-stage architectural process:

1. Ubiquitous Telemetry Ingestion

The platform collects high-resolution, near-real-time telemetry from multiple points across the enterprise estate:
* Host Software Agents: Lightweight agents deployed on bare-metal servers, virtual machines, and container hosts capture network flow details (every connection, port, and protocol), process identifiers, user attribution, and file integrity data.
* Network Streaming Telemetry: For unmanaged devices, legacy platforms, or environments where agents cannot be installed, Secure Workload ingests flow records from hardware sensors (such as Cisco Nexus 9000 Series switches), NetFlow/IPFIX collectors, and cloud VPC flow logs.
* External Context Sources: Connectors ingest metadata from identity and orchestration systems, including VMware vCenter, AWS, Microsoft Azure, Google Cloud Platform, and Kubernetes clusters, enriching flow data with real-time operational context.

2. Big Data Analytics and Behavioral Baselining

Once ingested, billions of telemetry events are processed by a dedicated big data analytics engine. The platform normalizes connection flows and applies unsupervised machine learning algorithms to evaluate behavioral baselines. It identifies which processes are communicating, discovers ephemeral services, and flags anomalies such as unusual outbound data transfers or suspicious local privilege escalations.

3. Application Dependency Mapping (ADM)

Understanding which components of a multi-tier application must communicate is a major hurdle in microsegmentation. Secure Workload solves this through automated Application Dependency Mapping (ADM). ADM clusters workloads based on communication patterns, shared processes, and metadata tags. It builds an exact visual dependency graph of every application, highlighting inter-service and cross-environment traffic flows.

4. Zero-Trust Policy Generation and Simulation

Using the ADM data, the platform automatically drafts declarative, least-privilege policies (whitelists). Instead of relying on manual firewall rule creation, administrators receive algorithmically generated rules tailored to actual operational needs. Crucially, Secure Workload includes a policy analysis engine that allows security teams to simulate proposed rules against historical traffic, assessing the operational impact and preventing unexpected application outages before a rule goes live.

5. Distributed Enforcement and Host Integrity

Once verified, policies are distributed down to the host agents, which enforce rules natively via local operating system mechanisms (such as iptables/nftables in Linux and Windows Advanced Firewall in Windows Server). Because enforcement occurs at the operating system kernel level, the security posture travels with the workload across migrations. Concurrently, the platform monitors system processes against Common Vulnerabilities and Exposures (CVEs) and tracks software package integrity to flag vulnerable or compromised assets.

Technical Specifications, Documentation, and System Requirements

Cisco maintains detailed documentation, user guides, and technical data sheets to support both SaaS and on-premises deployments of Cisco Secure Workload. The primary specifications and authoritative resources are organized below.

Primary Documentation Repositories

• Cisco Secure Workload Data Sheet: The definitive reference for hardware appliances, virtual machine overhead, scalability limits, and sizing guidelines.
• Cisco Secure Workload User Guide: The operational manual covering workspace administration, application dependency mapping, policy lifecycle management, and alerting.
• Cisco DevNet API Documentation: The technical reference for Secure Workload’s RESTful APIs, facilitating automated agent deployment, external CMDB synchronization, and CI/CD policy-as-code pipelines.
• Release Notes: Published per minor and major release to track software compatibility, new features, and security patches.

Operating System and Platform Compatibility

Secure Workload host agents support a wide array of enterprise operating systems across x86 and ARM architectures:
* Linux Distributions: Red Hat Enterprise Linux (RHEL) 6.x through 9.x, CentOS, Oracle Linux, Ubuntu LTS (16.04 through 24.04), SUSE Linux Enterprise Server (SLES) 11 through 15, and Debian.
* Microsoft Windows: Windows Server 2008 R2 (limited functionality), 2012, 2012 R2, 2016, 2019, and 2022.
* Containers and Orchestrators: Kubernetes, Red Hat OpenShift, and Amazon EKS, deploying enforcement via containerized daemonsets or sidecars to enforce policies down to individual pods.
* Legacy and Specialized Systems: AIX and Solaris are supported via network-based telemetry sensors and external policy orchestration.

Hardware Appliance Specifications (On-Premises Deployments)

For organizations with stringent data sovereignty requirements that preclude the SaaS version, Cisco offers on-premises cluster configurations:
* Small/Virtual Form Factor: VMware ESXi-based virtual appliances designed for up to 1,000 workloads, requiring enterprise-grade NVMe storage and high-frequency compute resources.
* Medium/Compact Cluster: Multi-node rack server configuration (typically Cisco UCS C220/C240 M5/M6 servers) scaling up to 5,000–10,000 workloads.
* Large Enterprise Cluster: A multi-rack deployment scaling to tens of thousands of workloads, featuring dedicated analytics nodes, high-throughput ingest nodes, integrated Cisco Nexus fabric switches, and redundant cold-storage arrays.

Cisco Secure Workload vs. Illumio vs. Akamai Guardicore vs. Cisco ACI

Enterprises evaluating microsegmentation solutions often weigh Cisco Secure Workload against agent-based alternatives like Illumio Core and Akamai Guardicore Segmentation, or infrastructure-centric solutions such as Cisco Application Centric Infrastructure (ACI). The table below outlines how these platforms compare across essential architectural criteria.

Key Differentiators

• Hybrid Telemetry vs. Agent-Only: While Illumio and Akamai Guardicore excel at rapid software-only deployment across unmanaged switches, they remain blind to network devices, printers, and appliances that cannot host an agent. Cisco Secure Workload bridges this gap by unifying host-level process telemetry with network telemetry.
• Workload-Centric vs. Fabric-Centric (vs. Cisco ACI): Cisco ACI microsegmentation relies on network switches and Endpoint Groups (EPGs). Secure Workload operates closer to the application runtime, enabling security policies that follow workloads regardless of whether they run in an ACI-managed data center, a remote branch, or an AWS VPC. Secure Workload can also export generated policies directly into Cisco ACI contracts, marrying host security with fabric automation.

Deployment Lifecycle: From Agent Rollout to Zero-Trust Policy Enforcement

Deploying microsegmentation in an enterprise with thousands of intercommunicating applications requires a structured, non-disruptive implementation methodology. Deployments generally progress through four distinct phases:

[Phase 1: Preparation] ──> [Phase 2: Ingestion] ──> [Phase 3: Simulation] ──> [Phase 4: Enforcement]
  • Scope Hierarchy          • Passive ADM Ingestion   • Policy Verification      • Host Firewall Rules
  • Agent Onboarding         • Dependency Graphing     • "What-If" Analysis       • Continuous Compliance

Phase 1: Environment Scoping and Agent Installation

Before deploying software agents, define an enterprise scope tree within the Secure Workload console. Scopes are hierarchical boundaries (such as Production > US-East > Payments) governed by role-based access control (RBAC).
* Install the lightweight agent via standard configuration management platforms (Ansible, Puppet, Chef, or Microsoft Intune/SCCM). For container platforms, install the Secure Workload daemonset using Helm charts.
* Agents run passively upon installation. They consume minimal compute resources (typically under 1–2% CPU overhead and around 150 MB of memory) and establish a secure TLS connection back to the SaaS or on-premises analytics cluster.

Phase 2: Passive Observation and Application Dependency Mapping

Once agents are connected, the platform operates in observation mode:
* The system gathers flow metadata, listening ports, process interactions, and external network dependencies.
* Run the Application Dependency Mapping (ADM) engine on designated workspaces. ADM analyzes conversations across several business cycles (typically two to four weeks) to account for periodic events like batch jobs, backup windows, and maintenance scripts.
* The system clusters workloads into functional application tiers (e.g., Web, Application, Database) and presents an intuitive visual dependency graph.

Phase 3: Policy Definition and “What-If” Impact Analysis

Secure Workload generates recommended whitelist rules based on observed dependencies. In this phase, administrators inspect and refine these policies:
* Translate business logic into policy sets (e.g., allow Tier-1 Web Servers to query Tier-2 Application Servers on TCP port 8443, while blocking direct access to the MySQL database tier).
* Activate the Policy Analysis / Simulation Engine. The platform tests proposed rules against past and present real-world traffic flows.
* The simulation engine highlights any legitimate business traffic that would have been dropped, allowing administrators to tune policies and eliminate the risk of accidental production downtime.

Phase 4: Phased Enforcement and Continuous Compliance

With policies vetted, enforcement can be rolled out systematically:
* Transition policy sets from Audit/Testing Mode to Enforcement Mode. The platform programs the local host firewalls (iptables, Windows Advanced Firewall) to block unauthorized connections.
* Monitor traffic in real time. Any non-whitelisted packet is dropped at the host interface and logged as a policy violation.
* Continuous compliance tracking detects policy drift, anomalous network behaviors, and newly discovered vulnerabilities, ensuring workloads remain secure throughout their operational lifecycle.

Licensing Models and Deployment Architectures: SaaS vs. On-Premises

Choosing the right licensing structure and deployment architecture depends on an organization’s security strategy, infrastructure footprint, and data management policies. Cisco provides two primary delivery paths for Secure Workload.

Delivery Architectures

1. Cisco Secure Workload SaaS (Cloud-Delivered)

• Operational Model: Cisco manages, scales, and updates the big data cluster, analytics engines, and storage infrastructure within the cloud.
• Advantages: Rapid onboarding, zero on-premises management overhead, automated software updates, and elastic compute scaling.
• Best For: Enterprises adopting cloud-first strategies, organizations lacking dedicated data-center hardware budgets, and geographically distributed teams.

2. Cisco Secure Workload On-Premises (Customer-Managed)

• Operational Model: The analytics platform runs on dedicated bare-metal hardware or enterprise virtual clusters hosted in the customer’s private data center.
• Advantages: Absolute control over telemetry storage, zero data egress to public cloud infrastructure, and compliance with strict data sovereignty mandates (e.g., financial institutions, healthcare, defense).
• Best For: Highly regulated industries that prohibit storing metadata in public clouds or organizations with massive on-premises data centers.

Licensing Tiers and Workload Unit Counting

Cisco licenses Secure Workload via subscription tiers, typically structured around one-, three-, or five-year terms.

Unit Calculation

Licensing is calculated per protected workload instance:
* Virtual Machine or Bare-Metal Server: Consumes one workload license per operating system instance.
* Container Environments: Measured either per container host node (factoring in the density of pods running on that host) or via a container entitlement bundle.
* Unmanaged / Network-Monitored Endpoints: Often calculated at an adjusted tier when monitored exclusively through network flow records and switch telemetry without an agent.

Subscription Tiers and Enterprise Agreements

• Cisco Secure Workload Premier / Essentials: Tiers balance access to core zero-trust microsegmentation against advanced telemetry options (e.g., forensics, CVE tracking, and process integrity baselining).
• Cisco Enterprise Agreement (EA): For large organizations, licensing is commonly integrated into a Cisco Security Choice Enterprise Agreement. This approach consolidates billing, offers predictable annual spend, allows workload portability between on-premises and SaaS deployments, and includes “True-Forward” provisions that accommodate infrastructure growth without mid-term penalty audits.

Securing the Modern Distributed Enterprise

As applications grow more distributed and infrastructure scales across hybrid environments, traditional perimeter-centric security models are no longer sufficient to stop modern threats. Cisco Secure Workload provides a proven path toward true zero trust by embedding microsegmentation directly into host operating systems and combining it with network-level telemetry.

By automating dependency discovery, validating policies through live traffic simulation, and enforcing least-privilege access rules across bare-metal, virtualized, and containerized assets, Secure Workload prevents lateral movement without disrupting business operations. Whether delivered as a turn-key SaaS solution or managed on-premises for regulatory compliance, it gives enterprise security teams the visibility and control needed to protect critical workloads across any cloud or data center.

Please follow and like us: