ColorTokens vs Asimily:
2026 Comparison

Introduction

Segmentation is a stated priority that many programs have not finished. In Cisco’s 2026 Segmentation Report, 79% of respondents called segmentation a priority and only 33% had fully implemented it (<a href=”https://www.cisco.com/c/en/us/products/collateral/security/hypershield/segmentation-report-2026.html” target=”_blank” rel=”noopener”>Cisco</a>). ColorTokens approaches the gap from hosts, and for devices that cannot run an agent, it places an appliance in their traffic path. Asimily starts from an earlier point: how to get an accurate inventory of all devices. Once that has been safely gathered Asimily has its own inventory of every connected asset, analyzes vulnerabilities to focus on the riskiest ones, ties risk to exploitability, and enforces through the NACs and firewalls already in place.

ColorTokens at a Glance

• Product: ColorTokens Xshield, a host-first microsegmentation platform with an appliance for devices that cannot run an agent. It also can provide some anomaly detection, based on changed network behavior.
• Verifiable strength: one platform that enforces through its own agent, existing EDR agents, the Gatekeeper appliance, or native cloud controls (ColorTokens Xshield Data Sheet, 2026)
• List pricing: $40 per OT/IoT device and $360 per server per 12 months on AWS Marketplace, as of November 3, 2026
• Dated fact: named a Leader in The Forrester Wave: Microsegmentation Solutions, Q3 2026, Forrester Wave Report

1. Inventory and Visibility

Asimily provides a complete, agentless, and non-disruptive inventory across an entire cybersecurity tech stack, functioning as a single source of truth for assets, services, apps, workloads, and middleware. It combines deep packet inspection, AI and ML classification against a library of well over 10,000,000 observed devices and profiles, active querying, flow data, and correlation with over 150 different sources, such as Active Directory, CMDB, NAC, DHCP, vulnerability scanners, Mobile Device Management, EDR, and Threat Intelligence. Active methods suit only devices that tolerate the traffic, so Asimily pairs them with passive collection. Asimily reports that users can expect nearly 100% of their connected assets, such as IoT, OT, IoMT, and IT devices, workloads, services, applications, middleware, and AI chatbots, to be identified with 98% or higher accuracy. ColorTokens maps traffic flows and dependencies in its Xshield visualizer, and its Gatekeeper technical brief describes auto-tagging of the devices Gatekeeper protects. For device and risk context beyond its own agents and Gatekeeper, ColorTokens relies on connectors to other sources, such as threat intelligence, vulnerability databases, identity, EDR, and CMDB tools, per its datasheet.

Swipe to compare both platforms →

ColorTokens column: public ColorTokens documentation as of November 2026.

2. Exposure Management and Threat and Response

An excellent and detailed asset inventory feeds exposure analysis, and both platforms strive to deliver that. ColorTokens’ Xshield datasheet lists connectors to vulnerability databases, and a 2025 Armis and ColorTokens brief describes segmenting high-risk assets using Armis vulnerability data. Asimily ranks vulnerabilities by impact and likelihood to get from theoretical risk to true risk for an actual asset, with its own configuration and network neighborhood used for the exploitability analysis. Asimily Labs’ ATT&CK Analysis tests whether each vulnerability is in fact exploitable on a specific device in the here and now, so teams work from a shorter list of the riskiest devices. Asimily also recommends mitigations when no vendor patch exists, its risk analysis draws on software bills of materials (SBOMs), and Risk Simulator models how a fix or a segmentation change would alter a device’s risk score before anyone acts. ColorTokens’ public materials describe segmentation as its remediation and Asimily considers segmentation one of three options – patching, targeted remediation via configuration change, and then microsegmentation. For some devices, patching or a configuration change is the quicker fix. Both platforms detect anomalous behavior and can contain it. ColorTokens publishes 24-hour updates of MITRE lateral movement techniques, and its Gatekeeper brief describes anomaly detection with automated mitigation. Asimily’s anomaly policies alert or start to quarantine devices through NACs and supported firewalls when a policy is violated. Users can set specific rules as needed, and custom rules need no coding. For incident response, Asimily can record packets from any monitored device, on demand or when a policy is violated, so responders start with the traffic itself and not only an alert. ColorTokens’ public documentation does not describe packet capture.

Swipe to compare both platforms →

ColorTokens column: public ColorTokens documentation as of November 2026.

3. Risk Mitigation

ColorTokens enforces through its Xshield agent, existing EDR agents such as CrowdStrike and SentinelOne that configure host firewalls, the Gatekeeper appliance for devices that cannot run an agent (most IoT, OT and IoMT), or native cloud controls. Its Xshield AI Agent, announced March 10, 2026, generates policy from plain-language queries, and Xshield simulates policy against up to 30 days of historical traffic before enforcement, per The ColorTokens Difference. Public ColorTokens materials name no NAC or firewall enforcement integration. Asimily’s Segmentation Orchestration creates conflict-free policies from observed device behavior, simulates them against live traffic with Policy Simulation, and lets administrators review and adjust each step in an Enforcement Plan before commit, rather than asking users to hope that it all works out. Asimily then applies policy through existing NACs and firewalls, so enforcement lands on existing switch infrastructure via the commands pushed down from the NAC or firewall, with no new appliance in the traffic path. Continuous Segmentation applies policy to new devices that match, to get the most out of customers’ existing NAC and firewall investment. Asimily also provides IoT Patching and password management for supported IoT device types, and Configuration Control snapshots of connected devices.

Swipe to compare both platforms →

ColorTokens column: public ColorTokens documentation as of November 2026.

4. Sample Integrations

Both platforms integrate across the security stack. ColorTokens’ datasheet lists connectors for threat intelligence, vulnerability databases, identity, SIEM, EDR including CrowdStrike Falcon and SentinelOne, zero trust network access including Netskope and Appgate, and configuration management databases. Asimily correlates network, identity, vulnerability, endpoint, and service management data into one record per device, so ATT&CK Analysis of vulnerabilities works best with the fullest context, and applies policy through supported NACs and firewalls. Key Asimily integration categories and sample products include:

• AI & LLM Providers: Google Gemini, Anthropic Claude, others
• Network Traffic Sources: NetFlow, SNMP, sFlow
• Identity & Access Management (IAM): Active Directory/LDAP, Azure SSO, Okta
• DHCP & DNS: Infoblox, BlueCat, EfficientIP
• Network Access Control (NAC): Cisco ISE, Aruba ClearPass, Forescout
• Firewalls & Network Infrastructure: FortiGate, Arista Agni, Juniper
• Endpoint Detection and Response (EDR): CrowdStrike, SentinelOne
• CMMS / ITSM: ServiceNow Service Graph, EQ2

Not a complete list; integrations are added regularly.

5. Deployment Considerations

Asimily collects data from network traffic and integrations through the Asimily Edge collector software, which runs on a dedicated appliance, on a virtual machine, or as an app on supported Cisco switches that support application hosting. It analyzes mirrored (SPAN) traffic outside the traffic path and does not install software on monitored devices. Asimily offers cloud and on-premises deployment, including for air-gapped and internet-restricted networks. ColorTokens administers Xshield from a SaaS console, and a Gatekeeper appliance sits in the network path of the devices it protects, between the upstream router and the protected subnet. ColorTokens publishes list prices on AWS Marketplace: as of November 3, 2026, Xshield for OT/IoT lists at $40 per device and Xshield for Workloads at $360 per server per 12 months, with a separate $36,000 line item to implement microsegmentation for OT/IoT devices and unsupported workloads. Asimily pricing is quoted per deployment and customized to the unique network requirements for each individual customer.

Swipe to compare both platforms →

What to Test in a Proof of Value

• Re-addressing: record which devices change IP address, netmask, or gateway under each approach
• Inventory: compare the assets each platform finds in your environment, including devices that cannot run an agent
• Classification: check device types and roles against your configuration management database
• Exposure: ask each platform to rank the same vulnerable devices and explain which exposures are exploitable
• Policy quality: compare a proposed rule with the traffic actually observed for that asset
• Safety: confirm the simulation shows what would be blocked before anything is enforced
• Enforcement point: confirm where policy is applied and who owns that system
• Ownership: confirm who maintains the Gatekeeper appliance or the NAC and firewall policy after go-live
• Cost: compare per-device pricing, implementation fees, and any appliance hardware for the same device count
• Time to value: Asimily states users can expect value within 48 hours and most devices identified within 14 days; ask each vendor for its own timeline in writing

Example: Segmenting a PLC With an Appliance vs Through a NAC

Illustrative example, not a customer story. A programmable logic controller (PLC) on a flat OT subnet cannot run an agent, and the goal is to allow only the traffic it needs.

Appliance path (ColorTokens Gatekeeper).

1. A Gatekeeper appliance is placed with its WAN interface toward the upstream router and its LAN interface in the subnet to be protected.
2. The upstream DHCP pool for that subnet is disabled. On DHCP renewal the PLC receives a /32 address from the Gatekeeper, and a PLC with a static address has its netmask and gateway changed to match. This follows ColorTokens’ 2024 technical brief.
3. Policy is enforced on the Gatekeeper, which sits in the PLC’s traffic path.

NAC and firewall path (Asimily).

1. The PLC keeps its address and gateway. Asimily observes its traffic through Asimily Edge, classifies it, and ATT&CK Analysis shows which of its exposures an attacker could actually use.
2. The Create/Simulate Segmentation Policy wizard lists the ports, services, and recipients the PLC actually used, and generates a Dynamic ACL (DACL) policy for Cisco ISE or a policy for a firewall such as FortiGate.
3. Policy Simulation watches real traffic and reports what the policy would block, without blocking it.
4. An administrator reviews the Enforcement Plan, then applies the policy. The existing NAC or firewall enforces it.
5. Continuous Segmentation applies the same policy to new PLCs that match.

Both paths end in enforced least-privilege policy. The difference is where enforcement happens and what changes on the network: an appliance and new addressing for the first path, existing NAC or firewall policy for the second. A facility can use different paths in different subnets.

When ColorTokens Fits Better

ColorTokens is the closer fit when one platform should segment servers, endpoints, cloud workloads, and Kubernetes containers, the assets with general purpose processors that can run an agent, along with devices placed behind an appliance; its datasheet lists all of them. It can also enforce through existing EDR agents, which Forrester, as quoted in ColorTokens’ August 2026 release on The Forrester Wave: Microsegmentation Solutions, Q3 2026, called “some of the most flexible deployment options of any vendor” (vendor-reported). Gatekeeper enforces on the appliance itself, so it can protect a subnet where no NAC or firewall policy point is available to Asimily. ColorTokens’ AI Agent generates policy from plain-language queries. Many teams could run both: host-based segmentation for servers and endpoints, and agentless inventory, exposure analysis, and segmentation for devices.

Forrester does not endorse any company, product, brand, or service included in its research publications.

The Bottom Line

ColorTokens: ColorTokens is a host-first microsegmentation platform and an excellent host-based option. It spans servers, endpoints, cloud workloads, and containers, enforcing through its own agent, existing EDR agents, or native cloud controls, and it uses the Gatekeeper appliance for devices (IoT, OT, etc.) that cannot run an agent. It suits teams that want one platform for hosts and devices and can place an appliance in the network path.

• ColorTokens strengths: broad host coverage across servers, endpoints, cloud, and containers; enforcement through existing EDR agents; published per-unit list pricing; plain-language policy generation
• ColorTokens trade-offs: devices behind Gatekeeper get new netmask and gateway settings; an appliance sits in each protected traffic path and needs ongoing maintenance; vulnerability context comes through connectors and partners

Asimily: Asimily is an asset protection platform for assets including IoT, OT, middleware, AI agents, servers, endpoints and more. It treats microsegmentation as one of many features for asset security. It builds the inventory first, covering IoT, OT, IoMT, and IT devices plus software, services, applications, and middleware, then analyzes exploitability on each device with ATT&CK Analysis, then creates, simulates, and continuously maintains segmentation policy that existing NACs and firewalls enforce. This can result in more intelligent segmentation that understands risk. Apart from discovery and network segmentation, Asimily adds IoT Patching, password management, and Configuration Control.

• Asimily strengths: native inventory with deep packet inspection; ATT&CK Analysis of exploitability per device; Policy Simulation against live traffic; enforcement through existing NACs and firewalls with no device readdressing; packet capture for incident response
• Asimily trade-offs: enforcement needs an existing NAC or firewall policy point; no host agents for servers or cloud workloads; no switch-level enforcement of its own

Swipe to compare both platforms →