Defeat Lateral Threats

Lateral threat movement, where an attacker that has compromised one system crosses the network to reach additional systems, succeeds when the network lacks sufficient segmentation to prevent that crossing. Traditional segmentation approaches rely on firewall rules between subnets or VLANs, but enforcing fine-grained policies at the workload level requires creating and maintaining large numbers of firewall rules that grow exponentially as the number of protected systems increases. The enforcement point, a centralised firewall, also becomes a bottleneck for east-west traffic that must traverse it. Endpoint agents can extend identity-aware enforcement to individual devices, but they cannot be installed on unmanaged devices: IoT sensors, building management systems, medical equipment, and OT devices that represent a significant portion of devices on most enterprise networks and cannot be enrolled in an agent deployment. An attacker who has compromised one unmanaged device on a flat segment can reach all other devices on that segment without encountering any enforcement.

Arista's zero trust fabric integrates Multi-domain Segmentation Services (MSS), AGNI (Guardian for Network Identity), and Network Detection and Response (NDR) into the EOS and CloudVision platform to enforce identity-aware segmentation at the switch ASIC, at wire speed, at every port, covering every device connected to the network regardless of whether it can run an endpoint agent. MSS runs as part of EOS on each switch and enforces segmentation policies at the forwarding plane rather than through an out-of-path appliance, meaning enforcement latency is wire-speed and there is no central bottleneck. AGNI provides identity context for network-connected devices without requiring agents, profiling devices through network behaviour and supplying that identity context to MSS policy enforcement. NDR detects lateral movement attempts by monitoring east-west traffic for anomalous patterns, providing the detection layer that operates alongside the prevention layer of MSS. The 7260X3 with UFT Mode 3 supports 104,000 IPv4 host routes, providing the route table scale for large deployments with fine-grained per-host segmentation policies.