In short: Cisco Hypershield is distributed security that runs inside the data centre network. It enforces stateful Layer 3 and Layer 4 segmentation on Cisco Smart Switches, takes policy from Cisco Cloud Control, shows observed flows so you can test rules before enforcing, and forms part of Cisco Hybrid Mesh Firewall.
What is Cisco Hypershield?
Hypershield is Cisco's distributed security fabric for the data centre. Instead of sending east-west traffic back to a central firewall for inspection (the "hairpin"), it enforces policy in the network fabric itself, close to where traffic starts. The enforcement runs on Cisco Smart Switches, data centre switches with a built-in data processing unit (DPU) that applies security policy alongside normal switching.
Cisco's support listings show Hypershield as an available product, with version 10.0.0 release notes and user documentation published in August 2026. It is one of the enforcement points in Cisco Hybrid Mesh Firewall and is licensed through the Segmentation package of the Cisco Cloud Protection Suite.
How it works
A Hypershield deployment has three parts:
- Enforcement in the switch: the DPU in each Cisco Smart Switch applies stateful Layer 3 and Layer 4 policy to unicast traffic as it passes. Paired switches keep connection state in sync, so traffic carries on if one fails, though Cisco notes that failover can take several seconds and some connections may drop
- Controllers: a leader controller, deployed as an on-premises virtual appliance, holds the authoritative policy; follower controllers distribute it to the switches and report status, and can be spread across data centres. A deployment appliance automates controller set-up through your hypervisor's management interface, and backup and restore protects controller state and policy
- Management: Cisco Cloud Control is where policy, visibility, logs and lifecycle operations come together. Administrators can also use the browser interface on the controller, sign-in uses your OIDC identity provider with role-based access, and versioned REST APIs are available for automation
Policy is written against network object groups that make sense to both security and network teams: labels, VLANs, VRFs, address ranges, ports and protocols. Security defines the segmentation intent; the network team keeps running the fabric as before. Switches send flow records over IPFIX and audit and enforcement events over syslog, so your SIEM, including Splunk Enterprise Security, sees what Hypershield allowed and blocked.
A few design details matter. Broadcast, unknown-unicast and multicast traffic is not inspected by the DPU, so normal switch controls still apply to it. VLAN-based objects only match when source and destination share a VLAN, so traffic between VLANs is better segmented with VRF-based objects. After a power cycle, a switch stays fail-closed until its policy is restored, which we account for in maintenance planning.
Switches can sit at the top of each rack or provide a shared security service for the fabric, and enforcement grows as you add racks.
Key capabilities
- Distributed stateful segmentation at Layer 3 and Layer 4, stopping lateral movement between racks, tenants and application tiers
- Test before you enforce: observed flow data shows what a proposed rule would allow or block before it goes live, which takes much of the fear out of segmentation projects
- Compensating controls: Cisco positions Hypershield to shield known-vulnerable systems with segmentation while patches are developed or scheduled
- Less hairpinning: east-west traffic no longer has to travel to a central firewall and back
- Shared management with the rest of the mesh through Cloud Control, so the same objects and intent apply to Secure Firewall and cloud enforcement
Hypershield, Secure Firewall and Secure Workload compared
Hypershield does not replace your perimeter firewall. The three tools overlap but suit different jobs:
| Cisco Hypershield | Cisco Secure Firewall | Cisco Secure Workload | |
|---|---|---|---|
| Where it enforces | In the data centre fabric, on Cisco Smart Switches | On a firewall appliance, virtual machine or cloud instance | On the workload (agent) or through firewalls, cloud security groups and load balancers |
| Traffic it suits | East-west traffic inside the data centre | North-south traffic and inspection between zones | Application-to-application flows on any workload |
| Inspection depth | Stateful Layer 3 and Layer 4 | Full NGFW: Snort 3 IPS, application control, URL filtering, malware defence | Allow and deny policy with process and vulnerability context |
| Needs agents? | No | No | Optional |
| Management | Cisco Cloud Control | Management Center or Security Cloud Control | Secure Workload console (SaaS via Security Cloud Control, or on-premises) |
Many data centres use all three: Secure Firewall at the edge and between major zones, Hypershield for fast fabric segmentation without agents, and Secure Workload where you need per-workload policy or cover servers outside the Smart Switch fabric.
Who Hypershield suits
Hypershield is aimed at organisations that run their own data centre networks and are refreshing or extending them: hosting and service providers, public sector and regulated organisations, and enterprises with large virtualised or private cloud estates. It is most attractive when you are buying new data centre switching anyway, because the enforcement runs on the Smart Switches you would be installing.
If you do not run a data centre fabric of your own, look instead at Multicloud Defense for public cloud and Secure Workload for server-level segmentation. Hypershield is licensed through the Segmentation package of the Cloud Protection Suite, alongside Secure Workload SaaS and Isovalent; ask us for a quote.
How we help
We start with flow discovery: what actually talks to what in your data centre. From that we design segmentation zones, map them to Hypershield objects, run policies in observation until they match reality, then enforce in stages, highest-risk systems first. We also plan the switching side (rack layout, pairing and controller placement) and connect logging to your SIEM. Contact us to talk through a data centre refresh or segmentation project.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Cisco Hypershield do?
Hypershield enforces stateful Layer 3 and Layer 4 segmentation inside the data centre network on Cisco Smart Switches. It limits lateral movement, avoids sending east-west traffic to a central firewall, lets you test policy against observed flows, and can apply compensating controls while vulnerabilities await patches.
Does Hypershield need agents on servers?
No. Enforcement happens in the Smart Switches, so servers and virtual machines need no software. For per-workload policy with process context, Cisco Secure Workload adds optional agents.
Does Hypershield replace a firewall?
No. It complements central firewalls. Cisco Secure Firewall still handles perimeter and inter-zone inspection such as IPS, application control and URL filtering, while Hypershield handles fast segmentation inside the fabric.
How is Hypershield managed?
Through Cisco Cloud Control, alongside the other Hybrid Mesh Firewall enforcement points. Hypershield leader and follower controllers run as virtual appliances in your own environment, and versioned REST APIs are available for automation.
What are Cisco Smart Switches?
Cisco Smart Switches are data centre switches with a built-in data processing unit (DPU) that runs security services such as Hypershield alongside normal switching, so segmentation is enforced in the network fabric rather than on a separate appliance.