Illumio vs Akamai Guardicore Segmentation for east-west policy

On 24 March 2026 Akamai said it had analyzed more than 500 segmentation projects before shipping new policy-generation features for Akamai Guardicore Segmentation (Akamai, 24 March 2026). The failure those projects share is a traffic map that never becomes a deny.

That stall is east-west policy: which workload may talk to which workload after a host is already compromised. The comparison below is policy scope, how you roll enforcement out, how you roll a bad policy back, which operating systems and Kubernetes paths are documented, and what the agent costs in resources. It is a different purchase from user-to-app access. The live comparison for a remote-access client is Cloudflare Zero Trust vs Twingate. Akamai also sells Enterprise Application Access on the Guardicore Platform Agent. Leave that access path off this quote.

Illumio Segmentation uses an allowlist. Labels select the workloads, and the Virtual Enforcement Node (VEN) programs the host firewall. The Segmentation license includes quarantine. Akamai Guardicore Segmentation, in the public agent documentation updated 1 March 2026, tracks each connection together with the processes on it, then allows, alerts, or blocks, and reports the action to Centra. Process metadata is one field on the rule, not the whole product.

	Illumio	Akamai Guardicore Segmentation
Primary use case	East-west microsegmentation with Illumio Segmentation: allowlist policy on managed workloads, plus quarantine on that same license	East-west microsegmentation in Centra: publish connectivity policy for assets, with allow, alert, or block, including process metadata on the agent
Policy scope	Labels and label groups select workloads. Rules allow traffic that would otherwise be blocked. Selective enforcement covers chosen inbound ports and services only. Full enforcement is an allowlist on all ports and services	Assets, plus rules from a prebuilt template (Active Directory is the documented example), a DIY template, or a custom rule. The public agent doc couples the connection with process information. The product page also describes identity and container context. Every object type inside Centra was not opened
Rollout	Idle or visibility only, then selective enforcement, then full enforcement. Selective mode is set per workload. It does not control outbound traffic, and it does not apply to unmanaged workloads or workloads enforced through a Network Enforcement Node	Start from the Network Log, pick a template, review the rules Centra suggests, then publish. The 24 March 2026 release adds impact simulation and a readiness check before enforcement. The product page describes a phased workflow and a simulation before policies go live
Deploy	Segmentation is SaaS or on premises. Cloud resources on this license are SaaS-only. A VEN sits on each server or VM you will enforce. One VEN on a machine covers the containers on that machine	Cloud or on premises, per the product page. SaaS management is listed at no charge on the reseller listing below. On-premises management is a separate license. Agents are recommended for maximum visibility. Agentless is described for in-cloud PaaS, IoT, and OT
License/pricing	Reseller price on the Carahsoft contract path, plus workload ratios, in Editions. The private offer does not define how a unit maps to a server	Reseller prices on the BYNET listing, annual and upfront, with separate bands for visibility, enforcement, endpoints, Kubernetes hosts, and legacy OS. See Editions. A direct Akamai quote can differ
Who operates it	Security writes labels and rulesets and chooses the enforcement state. Server and cloud owners accept the host-firewall change	Security owns Centra, from the Network Log through publish. The March 2026 App Owner Portal is the path for application owners to approve policy

We reviewed Illumio’s Segmentation licensing guide, the VEN administration guide for Core 26.1, the Core 26.1 policy enforcement model, the Core 24.5 provisioning guide, the Core 24.4 container architecture, the 26 February 2026 Insights announcement, Akamai’s 24 March 2026 announcement, the product page, the public segmentation-policy page, the Guardicore Platform Agent requirements and segmentation section, both AWS Marketplace listings, and a June 2026 comment that names both products, all on 3 Oct 2026. We did not install either product, so this is not a hands-on benchmark. Akamai’s full segmentation administration guide asks for a Control Center login, which we did not have.

Illumio

Akamai Guardicore Segmentation

Illumio is still sold as Illumio. Thoma Bravo led its June 2021 Series F ($225 million) and still lists the company in that portfolio. The round left the segmentation product on Illumio’s own quote. Akamai completed its acquisition of Guardicore on 21 October 2021 (about $600 million). The segmentation name on a new quote is Akamai Guardicore Segmentation.

Editions and pricing

Neither vendor posts a credit-card total for a full data-center program. The figures below are reseller prices. Each one names the currency, the unit, the 12-month period, the commitment, and the product the line includes. Confirm a direct quote before you treat either listing as your invoice.

	Illumio	Akamai Guardicore Segmentation
How you buy it now	Standalone subscription per Illumio Workload for Segmentation, SaaS or on premises. Insights is a second standalone subscription. The AWS listing is marked Private Offer Only and names Carahsoft as the contract path. That makes the dollar below a reseller price, not an Illumio direct checkout price	Annual subscription paid upfront, licensed by protected assets. The public listing checked 3 Oct 2026 is a reseller price sold by BYNET, not by Akamai directly. A direct Akamai quote can differ
Reseller price (3 Oct 2026)	Reseller price, Carahsoft contract path: one contract unit of ZTS Platform Pricing is $425 USD per unit per 12 months, for Zero Trust Segmentation for the Cloud. The page says the mapping from that unit to workloads is set in the private offer. Workload math on the licensing guide, separate from that dollar: 1 standard server OS = 1 workload, 1 legacy OS = 2, 5 user endpoints = 1, 1 Kubernetes or OpenShift host = 6	Reseller price, seller BYNET, paid annually upfront for a 12-month commitment, product Akamai Guardicore Segmentation: workload visibility and enforcement for 200 assets $78,000 USD; workload visibility for 200 assets $39,000 USD; legacy visibility and enforcement for 100 assets $78,000 USD; endpoint or VDI visibility and enforcement for 1,000 assets $39,000 USD; Kubernetes host for 50 hosts $75,000 USD; disaster-recovery management $12,500 USD. AWS Marketplace. SaaS management is no charge. The same page’s AMI table is infrastructure, $10 USD per hour for m5.2xlarge and $1 USD per hour for t3.large, not the software subscription
What the invoice covers	Segmentation includes policy authoring, enforcement, and quarantine. Cloud resources on that license require the SaaS deployment. Do not multiply $425 USD by a workload count until the private offer defines the unit	Visibility and enforcement are different bands: the visibility line for 200 workloads does not include enforcement. On-premises management is required for a non-SaaS install, and that management dollar is not in the bullets above
Main buying consideration	Will finance accept a reseller private-offer unit, plus a 5-to-1 endpoint ratio and a 6-to-1 Kubernetes host ratio, before anyone treats $425 USD as a per-server rate?	Are you buying the BYNET enforcement band for 200 workloads at $78,000 USD, or the visibility-only band at $39,000 USD, knowing a direct Akamai price can differ?

Policy scope, rollout, and rollback

	Illumio	Akamai Guardicore Segmentation
What a rule can name	Labels on workloads, then ports and services. The VEN reports interfaces and listening processes to the Policy Compute Engine. The firewall rule the VEN writes is still an operating-system firewall rule: iptables on older Linux, nftables on newer Linux, Windows Filtering Platform on Windows, Packet Filter or Ipfilter on Solaris (VEN guide, Core 26.1)	The connection, including the processes involved, reported to Centra. Public policy steps also select assets and can start from an Active Directory template or a DIY template, then add a custom rule. Domain names appear in Marketplace highlight text. We did not open Centra to confirm every object type
How enforcement advances	Four policy modes exist. The documented progression is idle (visibility only, no firewall enforcement), then selective enforcement on chosen inbound ports, then full allowlist enforcement. A failed apply surfaces as a Policy Sync error. Static policy, in the Core 24.5 provisioning guide, can stage rules without enforcing them until they are applied	The public policy page says enforcement is decoupled from the underlying network, so a publish does not require a network change. Alert remains an action on the agent, separate from block. Impact simulation and the readiness check are the March 2026 controls before that publish
Rollback	Core 24.5 documents Restore, which copies an older policy version into the working draft, and Revert Immediately, which provisions that version. Restore fails when pending changes exist. The same page was not present at the 26.1 path checked on 3 Oct 2026, so the button names in 26.1 were not confirmed	Policy rollback steps were not in the public segmentation-policy page, which stops at publish and points to login-gated help. Not found in this research
Main buying consideration	Can the change board move idle, to selective inbound enforcement, to full enforcement, and restore a prior policy version when a provision goes wrong?	Can the team simulate, publish, and keep alert as a step before block, and will the order include the enforcement band rather than visibility only?

The comment puts Illumio and Guardicore on the host and process side of the line, against a VLAN. It does not split rollout, rollback, or coverage. Those rows are above and in the next section.

Operating systems, Kubernetes, and overhead

	Illumio	Akamai Guardicore Segmentation
Operating systems in the public docs	VEN Core 26.1 programs iptables, nftables, Windows Filtering Platform, and Solaris Packet Filter or Ipfilter. On Windows, flow collection uses the ilowfp driver. Policy is still written to the filtering platform	The public Guardicore Platform Agent requirements page, for an agent that can hold a Segmentation license, lists Windows 10 and 11, macOS 14 through 26, and Ubuntu 22.04 and 24.04, and at least 200 MB of free disk. Ubuntu on agent 7.1.0 and later requires GNOME. That page says virtual machines are not the recommended install for most users. The product page separately names servers, virtual machines, containers, and Kubernetes. A Windows Server or RHEL matrix was not on the public requirements page. Not found in this research
Kubernetes	One VEN on a machine covers containers on that machine. The Core 24.4 container architecture also describes a C-VEN that runs as a privileged pod and programs the node and pod namespaces. The licensing guide counts 1 Kubernetes or OpenShift host as 6 workloads. CLAS degraded-mode behavior was not re-checked for 26.1	The product page says one control plane covers cloud instances and Kubernetes containers, and that new pods are discovered as they are deployed. The BYNET reseller listing prices a Kubernetes host band at $75,000 USD for 50 hosts per 12 months. Pod-level policy objects were behind the login-gated admin guide
Overhead	The VEN architecture guide says the agent consumes CPU as needed to calculate and apply the firewall and otherwise stays idle. A CPU percentage or RAM floor was not in that paragraph	The platform-agent requirements page states a 200 MB disk floor and does not state a CPU percentage. A host-agent CPU figure was not found in this research. Do not read a partner line about a DPU path as the host-agent cost
What you should not hand to the SOC alone	Insights is a separate standalone license. The 26 February 2026 release reads Check Point and Fortinet firewall telemetry without an agent on those paths. The announcement says agents remain foundational for segmentation and enforcement	Enterprise Application Access and Secure Internet Access on the same platform agent are user-edge controls. A visibility-only asset band does not block. The 24 March 2026 features do not replace the agent
Main buying consideration	Do the servers you will enforce match the firewall platforms in the VEN guide, and is the Kubernetes host ratio of 6 workloads acceptable?	Are you deploying the platform agent on the desktop operating systems in the public matrix, the server and Kubernetes paths named on the product page, or both, and is the Kubernetes host line on the reseller quote?

Between these two, ransomware spread is the reason the budget exists. Illumio Segmentation can quarantine a workload the VEN already manages. Akamai Guardicore Segmentation can move a mapped application from alert to block. The Marketplace text names ransomware templates. Template contents were not reviewed. Neither result replaces backups or an endpoint agent that removes the malware.

Choose Illumio when the rollout has to move from visibility to selective inbound enforcement to a full allowlist on the host firewall, quarantine stays on the Segmentation license, and the Core 24.5 restore path is acceptable until you confirm it in the version you will run. Choose Akamai Guardicore Segmentation when policy is published in Centra, with process metadata and an alert step, after the March 2026 simulation, on a contract that prices enforcement rather than a visibility-only band. Treat both Marketplace dollars as reseller prices.