Best Zero Trust Security Platforms 2026: Segmentation Rankings

Updated November 2026. Competitor facts checked November 3, 2026.

Four Zero Trust platforms scored on how they find devices, build and test policy, and enforce it.

Introduction

A Zero Trust security platform limits every device, user, and workload to the connections it needs for as long as it needs it, no longer. In NIST’s Zero Trust Architecture guidance (SP 800-207), no asset or user is trusted based on network location alone. Methods of authentication and enforcement vary, but a main enforcement method is to limit communication via agents, network access control (NAC) platforms, firewalls, or switches. Microsegmentation is the main way these platforms put Zero Trust into practice on a network. Zero Trust also covers user access to applications, known as zero trust network access (ZTNA), led by vendors such as Zscaler and Palo Alto Networks; this ranking covers network segmentation for devices and workloads.

Most organizations have a Zero Trust strategy. Fewer have enforced it on every connected asset, especially Internet of Things (IoT) and operational technology (OT) devices. Servers and laptops can run an agent, but cameras, badge readers, controllers, and building systems often cannot, and many were built before today’s threats. Network and operations teams also often hold a veto over any policy that could interrupt service, so written policies often stay unenforced.

We evaluated ten segmentation platforms and scored four on how they take a Zero Trust program from device visibility to tested, enforced policy across IoT, OT, and IT devices.

Different companies came to Zero Trust from different starting points. Illumio and ColorTokens start from data center and cloud workloads. Asimily and Ordr start from connected devices. Asimily publishes this ranking and is one of the four platforms scored. Asimily chose the criteria and scored every platform, including its own, against the same capability checklist, and the scoring rule is published below so readers can check the result. Please take this into account and perform your own assessment.

Quick Answer: The Best Zero Trust Security Platforms in 2026

The best Zero Trust segmentation platforms in 2026 are Asimily (2.8), Ordr (2.1), ColorTokens (1.8), and Illumio (1.7), scored 1.0 to 3.0 on asset visibility, policy creation and simulation, policy enforcement, risk-based prioritization, and threat and response. Asimily publishes this ranking and ranks itself first. Validate any platform in your own environment.

• Asimily (2.8): Best for applying Zero Trust policy to connected devices that cannot run an agent, through the NACs and firewalls a team already runs.
• Ordr (2.1): Best for teams that want AI-based device classification and enforcement across firewalls, NACs, and switches from Cisco, Aruba, and Juniper.
• ColorTokens (1.8): Best for one platform that segments servers, cloud workloads, and devices through agents, EDR, native cloud controls, or the Gatekeeper appliance.
• Illumio (1.7): Best for label-based segmentation of servers, virtual machines, containers, and cloud workloads that can run a host agent.

How We Ranked Zero Trust Security Platforms

Ratings draw on Asimily’s competitive research and discussions with prospects and customers, plus public vendor documentation, press releases, and analyst coverage for Illumio and ColorTokens. Where no public source addresses a checklist item for those two platforms, the item is left out of their coverage rather than counted against them. If those items were instead counted as missing, ColorTokens would score 1.5 and Illumio 1.7. Competitor details reflect public information as of November 2026.

The ranking emphasizes policy creation and enforcement, at 55% combined, because Zero Trust depends on enforced least-privilege access, not visibility alone.

1. Asset Visibility and Classification (20%): Passive monitoring and safe active querying, deep packet inspection and network flow analysis, detailed classification of IoT and OT devices, and integrations with existing tools.
2. Policy Creation and Simulation (30%): Asset grouping, AI-based grouping and policy creation, policy simulation, policy compression, a view of simulated and active policy, an enforcement plan preview, and policies that adapt as devices change.
3. Policy Enforcement (25%): Enforcement through existing NACs and firewalls, a view of every policy applied at those points, switch-level enforcement, and segmentation without re-addressing devices.
4. Risk-Based Prioritization (15%): MITRE ATT&CK-based classification, ATT&CK analysis for each vulnerability, vulnerability and threat prioritization, and targeted segmentation recommendations for legacy assets.
5. Threat and Response (10%): Anomaly policies for notification or quarantine, no-code network alerts, and packet capture for incident response.

Each criterion maps to a fixed checklist of capabilities, and a platform’s level comes from how much of that checklist it covers natively. Advanced (3 pts) means 80% or more, Strong (2 pts) means 50% to 79%, and Moderate (1 pt) means below 50%. The score is the weighted average of points, from 1.0 to 3.0. The ranking does not score price, host-agent enforcement, or native cloud controls.

2026 Zero Trust Security Platform Rankings

Asimily ranks first at 2.8, with its widest lead over the next-ranked platform in Threat and Response, followed by Ordr (2.1), ColorTokens (1.8), and Illumio (1.7).

Rank	Platform	Score	Visibility	Policy Creation and Simulation	Enforcement	Risk Prioritization	Threat and Response
1	Asimily	2.8	Advanced	Advanced	Strong	Advanced	Advanced
2	Ordr	2.1	Advanced	Strong	Strong	Strong	Moderate
3	ColorTokens	1.8	Strong	Strong	Moderate	Strong	Strong
4	Illumio	1.7	Moderate	Strong	Strong	Strong	Moderate

How Each Platform Enforces Zero Trust Policy

The platforms differ most in where policy is enforced and how it is tested first.

Platform	Starts From	Enforcement Points	Testing Before Enforcement
Asimily	Connected devices	Existing NACs and firewalls, such as Cisco ISE and FortiGate	Policy Simulation against real, observed traffic, then an Enforcement Plan
Ordr	Connected devices	Firewalls, NACs, and Cisco, Aruba, and Juniper switches	Simulation against a live traffic matrix
ColorTokens	Workloads and devices	Own agent, EDR agents, Gatekeeper appliance, native cloud controls	Simulation on historical traffic
Illumio	Data center and cloud workloads	Host agent, Cisco Nexus and Arista switch ACLs, Check Point firewall rules	Policy modeling before enforcement

Vendor Profiles

Asimily

Asimily is an asset protection platform for assets including IoT, OT, middleware, AI agents, servers, endpoints, and more, and it treats microsegmentation as one of many asset security features. It discovers devices through passive network traffic analysis and safe active querying, with no agents on the devices. Segmentation Orchestration creates policy from that inventory and applies it through existing NAC and firewall infrastructure, such as Cisco ISE, FortiGate, and Palo Alto Networks Panorama, so devices keep their IP addresses. Policy Simulation previews each policy against real, observed traffic, and an Enforcement Plan lists each deployment step for review so users have comfort about the changes to their infrastructure rather than trusting an opaque process. Asimily Labs’ ATT&CK Analysis separates risk from CVSS-centric vulnerability severity, and patching and configuration changes sit alongside segmentation as remediation options. Asimily has no switch-level enforcement of its own. Rated 4.9 out of 5 on Gartner Peer Insights (55 reviews, October 2026).*

*Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.

ColorTokens

ColorTokens Xshield is a microsegmentation platform that enforces policy three ways (ColorTokens datasheet): through its own agent or existing endpoint detection and response (EDR) agents, through the agentless Xshield Gatekeeper appliance for OT, IoT, and legacy devices, and through native cloud controls such as AWS security groups. Devices behind Gatekeeper take a new netmask and depend on the appliance as their gateway (ColorTokens). Policies can be simulated on historical traffic before enforcement, and the Xshield AI Agent generates policy from plain-language queries. Forrester named ColorTokens a Leader in its Q3 2026 Microsegmentation Wave.

Illumio

Illumio Segmentation enforces Zero Trust policy across data centers, cloud, containers, and endpoints, mainly through a host agent that programs each workload’s native firewall. Its Network Enforcement Node generates switch access control lists (ACLs) for Cisco Nexus and Arista switches, and integration (such as with Check Point) writes firewall rules. Workloads are grouped by labels such as application, environment, and location, and policies can be modeled before enforcement. Illumio draws IoT and OT device data from partners such as Armis and Claroty. Forrester named Illumio a Leader in its Q3 2026 Microsegmentation Wave.

Ordr

Ordr AI Protect is a segmentation-first device protection platform. It classifies IoT, OT, and IT devices with AI-based fingerprinting, and AI Protect for Segmentation turns that inventory into Zero Trust policy. Devices are grouped by function, role, and risk, and policy impact is simulated against a live traffic matrix before enforcement. Policies are pushed through firewalls, NACs such as Cisco ISE and Aruba ClearPass, and switches from Cisco, Aruba, and Juniper. Ordr reports more than 130 native integrations (ORDR). In March 2026, Ordr added Ordr IQ, which generates and validates segmentation policy in a live sandbox.

Best Zero Trust Platforms for Data Center and Cloud Workloads

For teams whose Zero Trust program starts with servers, virtual machines, containers, and cloud workloads, these platforms fit best:

1. Illumio: Enforces label-based policy through a host agent that programs each workload’s native firewall, across data centers, cloud, containers, and endpoints.
2. ColorTokens: Enforces through its own agent, existing EDR agents, or native cloud controls such as AWS security groups.
3. Akamai Guardicore Segmentation: Segments workloads at the process level, and in March 2026 added AI that generates policy and tests its impact before enforcement (SiliconANGLE).

Asimily enforces through NAC and firewall infrastructure without installing agents, so it fits programs whose larger gap is connected devices rather than servers where agents can provide benefit.

Best Zero Trust Platforms for Devices That Cannot Run an Agent

For teams that need Zero Trust policy on cameras, controllers, badge readers, and other devices that cannot host an agent, these platforms fit best:

• Asimily: Creates segmentation policy from its device inventory, previews it against real, observed traffic with Policy Simulation, and applies it through existing NACs and firewalls.
• Ordr: Groups devices by function, role, and risk, simulates impact on a live traffic matrix, and enforces through firewalls, NACs, and switches.
• ColorTokens: Places the agentless Xshield Gatekeeper appliance in front of OT, IoT, and legacy devices, with the appliance acting as each device’s network gateway.

Asimily enforces through an existing NAC or firewall, so it fits teams that already run one or plan to deploy one.

Best Zero Trust Platforms for Teams That Already Run a NAC

For teams that want Zero Trust policy enforced through Cisco ISE, Aruba ClearPass, or another NAC they already own, these platforms fit best:

• Asimily: Generates ACLs from its comprehensive and detailed device inventory and applies them through supported NACs, such as Cisco ISE, after Policy Simulation and an Enforcement Plan review.
• Ordr: Pushes policy through NACs such as Cisco ISE and Aruba ClearPass, as well as firewalls and switches.
• Claroty: Sends segmentation policy to enforcement points from its technology alliance partners, so existing network equipment enforces it (Claroty).

Asimily has no switch-level enforcement of its own, so teams that want switch ACLs without a NAC should also evaluate Illumio or Ordr.

Also Evaluated

The following platforms were also evaluated as part of this research without receiving numerical scores:

• Akamai Guardicore Segmentation: Best for process-level microsegmentation of data center and cloud workloads.
• Armis: Best for teams that want asset intelligence and risk context to feed an existing enforcement point. ServiceNow completed its acquisition of Armis in April 2026.
• Cisco Secure Workload: Best for Cisco-standardized data centers that want workload segmentation tied to the Cisco security stack.
• Claroty: Best for OT and cyber-physical environments that want policy recommendations enforced through existing network equipment.
• Elisity: Best for identity-based segmentation enforced on existing campus switches (Elisity). IonQ agreed to acquire Elisity in October 2026, with closing expected in the fourth quarter of 2026.
• Forescout: Best for organizations that want segmentation rooted in their own NAC (Forescout).
• Zscaler: Best for Zscaler customers extending Zero Trust to branch and facility devices (Zscaler).

Not in scope: Identity and access Zero Trust platforms, such as Palo Alto Networks Prisma Access, Okta, and Microsoft Entra, control user access to applications rather than device-to-device traffic, so this ranking does not score them.

Frequently Asked Questions (FAQ)

What Is the Best Zero Trust Security Platform in 2026?

Asimily ranks first here at 2.8 out of 3.0, ahead of Ordr (2.1), ColorTokens (1.8), and Illumio (1.7). Asimily leads on policy creation and simulation, risk-based prioritization, and threat and response. The best fit depends on what you must segment: Illumio and ColorTokens start from servers and cloud workloads, while Asimily and Ordr start from devices that cannot run an agent. Asimily publishes this ranking.

What Is a Zero Trust Security Platform?

A Zero Trust security platform limits every device, user, and workload to the connections it needs. It typically combines asset visibility, policy creation, and enforcement through agents, NACs, firewalls, or switches. For example, a badge reader would reach only its access control server and nothing else on the network. Asimily applies this model to IoT, OT, and IT devices through existing NAC and firewall infrastructure.

How Is Microsegmentation Different From Zero Trust Network Access (ZTNA)?

ZTNA controls which users can reach which applications, usually through a cloud service, and is led by vendors such as Zscaler and Palo Alto Networks. Microsegmentation controls which devices and workloads can talk to each other inside the network. Most Zero Trust programs need both. Devices that cannot run an agent, such as cameras and controllers, depend on microsegmentation, which is what this ranking scores.

How Does Microsegmentation Support Zero Trust?

Microsegmentation supports Zero Trust by dividing a network into small zones and allowing only the traffic each zone needs. That limits how far an attacker can move after one device is compromised. Attacks now move faster than manual response, so containment often matters as much as patching. Asimily’s Policy Simulation previews each segmentation policy against real, observed traffic before enforcement.

How Do You Apply Zero Trust to Devices That Cannot Run an Agent?

Enforce policy in the network instead of on the device. Security cameras, programmable logic controllers (PLCs), printers, and badge readers, among many others, usually cannot host an agent. Platforms classify them from network traffic, then apply policy through NACs, firewalls, switches, or an inline appliance, and network and operations owners usually approve each change. Asimily creates this policy from its device inventory and applies it through existing NACs and firewalls.

Can You Test a Zero Trust Policy Before Enforcing It?

Yes. Most segmentation platforms offer a simulation mode that shows which connections a policy would block before it takes effect. ColorTokens simulates on historical traffic, and Ordr on a live traffic matrix. Teams can keep a policy in simulation until operations owners approve it, which reduces the risk of an unplanned outage. Asimily’s Policy Simulation previews impact against real, observed traffic for as long as a customer wants, and its Enforcement Plan lists each deployment step, with adjustable parameters, before the NAC deploys changes that enforce the intended Zero Trust policies.

Can Existing NACs and Firewalls Enforce Zero Trust Policy?

Yes. A NAC such as Cisco ISE or Aruba ClearPass can assign each device an access policy, and firewalls can enforce rules between zones, so teams can enforce Zero Trust without new agents or appliances. The hard part is building the right policy for each device group. Ordr enforces through NACs, firewalls, and switches, and Illumio writes Check Point firewall rules. Asimily generates ACLs and applies them through supported NACs and firewalls, such as Cisco ISE and FortiGate.

How Much Does a Zero Trust Security Platform Cost?

Most Zero Trust and microsegmentation platforms are priced by quote. ColorTokens is an exception: in November 2026, its Xshield listing on AWS Marketplace showed $40 per OT or IoT device and $360 per server per year, plus a $36,000 implementation line item for OT and IoT devices. Asimily pricing is quoted per deployment.

See how Asimily turns Zero Trust policy into enforced segmentation

[Related: Best Unified Asset Inventory and Visibility Platforms 2026]

[Related: Best IoT Security Platforms 2026 Rankings]

[Related: Best Network Visibility and Discovery Tools 2026]

[Related: Illumio vs Asimily: 2026 Comparison]

[Related: ColorTokens vs Asimily: 2026 Comparison]

[Related: Elisity vs Asimily: 2026 Comparison]