In short: Cisco Hybrid Mesh Firewall is a distributed firewall fabric rather than a single product. It joins Secure Firewall appliances, virtual and cloud firewalls, Hypershield in Cisco Smart Switches, Multicloud Defense, Secure Workload, Isovalent and AI Defense under Security Cloud Control, with the core licensed through the Cisco Cloud Protection Suite.
What is Cisco Hybrid Mesh Firewall?
A traditional firewall guards one boundary. Most organisations now run applications in an on-premises data centre, in two or three public clouds, in Kubernetes clusters and increasingly in AI services, while users connect from offices, homes and branches. Putting a big appliance at "the edge" no longer covers all the paths an attacker can take, especially lateral movement between workloads that never cross the perimeter.
Cisco's answer is Hybrid Mesh Firewall: a solution that places enforcement wherever traffic actually flows and manages all of it centrally. Security teams express intent once (who or what may talk to which application) and the management layer pushes the right rules to the right enforcement point, whether that is a hardware firewall, a switch in the data centre fabric, a cloud gateway or a Kubernetes node.
It is not a box you can order on its own. It is an architecture built from products Cisco already sells, plus a licensing vehicle for the core of it (the Cisco Cloud Protection Suite).
The building blocks
Cisco names these components on its current Hybrid Mesh Firewall solution page:
| Component | Role in the mesh |
|---|---|
| Cisco Secure Firewall (also branded Cisco Firewall) | Next-generation firewalling and IPS at the perimeter, data centre and branch, with encrypted visibility, SnortML and Talos intelligence; hardware, virtual and public cloud forms |
| Cisco Hypershield | Stateful segmentation enforced inside the data centre fabric on Cisco Smart Switches, which Cisco also positions for shielding vulnerable systems with compensating controls |
| Cisco Multicloud Defense | Cloud firewalling across public clouds from a SaaS controller that deploys, scales and heals the gateways for you |
| Cisco Secure Workload | Identity-aware macro and microsegmentation for servers, virtual machines and containers, with or without agents |
| Isovalent Enterprise Platform | eBPF-based runtime security and visibility inside Kubernetes clusters, from Cisco-owned Isovalent, the company behind the open-source Cilium project |
| Cisco AI Defense | Guardrails, red teaming and supply chain scanning for AI models, applications, agents and MCP servers |
| Cisco Security Cloud Control | The cloud console that holds policy and orchestrates every enforcement point |
Around the core, Cisco integrates Zero Trust Access (user policy enforced on the mesh so users reach sensitive applications directly) and Cisco ISE (identity and device context, including IoT and OT devices, for finer segmentation). Cisco's solution page also lists third-party firewalls as enforcement points the mesh can orchestrate.
Remote users and small branches are a separate problem. Cisco Secure Access, Cisco's security service edge platform, covers them from the cloud and sits alongside the mesh rather than inside the Cloud Protection Suite packages.
How single management works
Security Cloud Control, formerly Cisco Defense Orchestrator, is the management plane. Cisco's product pages now also present it as Cisco Cloud Control, a unified, intent-based console. Its jobs in the mesh are to:
- Hold shared objects and intent-based policy, then translate it for each enforcement point
- Run the cloud-delivered version of the Secure Firewall Management Center, so Secure Firewall Threat Defense devices are managed alongside cloud and fabric enforcement
- Run AgenticOps, Cisco's AI operations layer: during 2026 Cisco added a Policy Change Impact Analyzer that assesses pending access control changes before deployment, a Compliance Posture check of firewall configuration against PCI DSS 4.0.1, a Capacity and Trend Analyzer, and an Agent Workforce of specialist agents for firewall insight, site-to-site VPN troubleshooting and high-bandwidth (elephant) flows
- Bring Cisco and third-party enforcement points under one policy experience: Cisco lists third-party firewall orchestration, so we confirm support for your vendor and software version during design rather than assume it
Organisations still running an on-premises Management Center can keep it. Since July 2026, AgenticOps features such as the Software Upgrade Planner and Capacity and Trend Analyzer also work for Threat Defense devices managed by an on-premises Management Center connected to Cisco Security Cloud, and Cisco provides a savings calculator and a migration path for moving to cloud management when you are ready. Some of these features are limited to particular cloud regions (Cisco lists US, EU and Australia for the newest ones), which we check for UK tenants.
What problems it solves
- Lateral movement: segmentation from the zone level down to individual workloads and Kubernetes pods, so a compromised server cannot reach everything else
- Inconsistent cloud security: the same intent applied across AWS, Microsoft Azure, Google Cloud and Oracle Cloud instead of separate native rule sets in each
- Unpatched vulnerabilities: compensating controls in the fabric that shield a known-vulnerable system until the patch lands
- Encrypted and zero-day threats: Cisco's Encrypted Visibility Engine inspects encrypted traffic without decrypting everything, and SnortML with Talos intelligence targets new exploits
- AI applications and agents: runtime guardrails and model scanning for new attack surfaces such as prompt injection
- Hairpinning: traffic no longer has to be dragged back to a central appliance just to be inspected
Licensing and how to start
Cisco makes the core technologies available through the Cisco Cloud Protection Suite, which currently has two packages: Segmentation (Secure Workload SaaS, Hypershield and the Isovalent Enterprise Platform) and Gateway (Secure Firewall and Multicloud Defense), each with Security Cloud Control. You can begin with one component and add more over time. A typical journey looks like this:
- Move existing Secure Firewall Threat Defense devices under Security Cloud Control (cloud-delivered Management Center).
- Extend the same policy model to public cloud with Multicloud Defense or Threat Defense Virtual.
- Add zone-based segmentation in the data centre, then microsegmentation with Secure Workload or Hypershield where the value is highest.
- Bring Kubernetes and AI workloads in with Isovalent and AI Defense.
- Add Secure Access for remote users and branches if you want security delivered from the cloud.
AI Defense and Secure Access are not part of the two Cloud Protection Suite packages, so we quote them separately.
Cisco also says eligible Secure Firewall Threat Defense customers who subscribe to Splunk may receive extra firewall log ingestion without additional licence cost; we check eligibility as part of the design. For the wider picture of tiers and metrics, see Cisco security licensing. Pricing depends on the mix of components and term, so ask us for a quote.
Who it suits and how we help
Hybrid Mesh Firewall makes most sense for organisations with a real hybrid footprint: a data centre plus public cloud, several firewall estates to rationalise, Kubernetes in production, or AI applications moving from pilot to service. A single-site business with one internet connection is usually better served by Cisco Secure Firewall on its own, or by Meraki MX.
Forever Systems maps your current firewalls, clouds and application flows, decides which enforcement point belongs where, and plans the order of adoption so nothing breaks. We then deploy, migrate policy from ASA or older Firepower estates (see our ASA to Threat Defense migration guide) and support the result. Contact us to discuss your estate.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is a hybrid mesh firewall?
A hybrid mesh firewall is a set of firewall enforcement points spread across on-premises networks, data centres, public clouds and workloads, all managed through one console and one policy model. Industry analysts use the term for a category of product; Cisco Hybrid Mesh Firewall is Cisco's implementation, managed through Security Cloud Control.
Is Cisco Hybrid Mesh Firewall a separate product?
No. It is a solution made of existing Cisco products (Secure Firewall, Hypershield, Multicloud Defense, Secure Workload, Isovalent and AI Defense) under Security Cloud Control. Cisco licenses the core through the Cloud Protection Suite, and you can start with one component.
Do I need to replace my existing Cisco firewalls?
No. Current Secure Firewall Threat Defense hardware and virtual firewalls become enforcement points in the mesh. Older ASA hardware generations that have reached end of support should be refreshed or migrated first.
Does Hybrid Mesh Firewall work with other vendors' firewalls?
Cisco's solution pages say the mesh can orchestrate policy for Cisco and third-party firewalls. Support depends on the vendor and version, so we confirm it during design rather than assume it.
How is Cisco Hybrid Mesh Firewall licensed?
The core is licensed through the Cisco Cloud Protection Suite, which has a Segmentation package (Secure Workload SaaS, Hypershield, Isovalent) and a Gateway package (Secure Firewall and Multicloud Defense). AI Defense and Secure Access are bought separately. Pricing depends on components and term, so ask us for a quote.