In short: The Cisco Cloud Protection Suite is Cisco's licence route to Hybrid Mesh Firewall. Cisco currently offers two packages: Segmentation (Secure Workload SaaS, Hypershield and the Isovalent Enterprise Platform) and Gateway (virtual Secure Firewall and Multicloud Defense), both managed through Security Cloud Control. You can start with one package and add more.
What is the Cloud Protection Suite?
Applications no longer live behind one firewall. They run across an on-premises data centre, virtual machines, Kubernetes clusters and two or three public clouds, and attackers who get in often move sideways between workloads without ever touching the perimeter. Cisco's answer is Hybrid Mesh Firewall: many enforcement points, placed where traffic flows, under one policy.
The Cloud Protection Suite is the commercial wrapper for that idea. Cisco describes it as combining simplicity, flexibility and investment protection, and as the path to Hybrid Mesh Firewall. It groups the relevant products into packages aligned to two jobs: segmenting applications and workloads, and gatewaying traffic in and out of clouds and data centres.
The two packages
Cisco's current Cloud Protection Suite page lists two packages, both at Essentials level:
| Segmentation | Gateway | |
|---|---|---|
| Purpose | Segmenting applications wherever they run, and shielding known vulnerabilities with targeted compensating controls until they are patched | Stopping inbound attacks, data theft and unauthorised movement, with protection against zero-day exploits and malware hidden in encrypted traffic |
| Products | Secure Workload SaaS, Hypershield, Isovalent Enterprise Platform | Secure Firewall virtual firewalls (Threat Defense Virtual), Multicloud Defense |
| Management | Security Cloud Control (Cisco notes Isovalent is not yet managed there) | Security Cloud Control |
| Typical starting point | Data centre microsegmentation, east-west control, Kubernetes security | Public cloud ingress, egress and east-west inspection, virtual firewalls in private cloud |
Older Cisco material and quotes may show different packaging, so we always quote against the current offer.
How each package works
Segmentation combines three enforcement styles. Secure Workload gives visibility of how workloads interact in any environment and turns it into recommended microsegmentation policy; the suite includes the Cisco-managed SaaS version. Hypershield embeds stateful Layer 3 and 4 enforcement in the data centre fabric through Cisco Smart Switches, with policy defined centrally, and Cisco's Hybrid Mesh Firewall material lists it for vulnerability shielding. The Isovalent Enterprise Platform adds eBPF-powered networking and security for Kubernetes.
Gateway covers traffic crossing boundaries. Multicloud Defense protects public and private cloud environments from a single SaaS control plane, with real-time asset discovery and infrastructure-as-code integration. Threat Defense Virtual brings the same security capabilities as physical Secure Firewall to AWS, Microsoft Azure, Google Cloud, Oracle Cloud Infrastructure and private cloud environments.
Security Cloud Control is included with both packages, so one console holds the objects and policy for everything except Isovalent. Cisco now presents it as security in Cisco Cloud Control, its wider cloud management platform.
Add-ons and investment protection
The two packages cover the core of the mesh. Cisco's Hybrid Mesh Firewall page also lists enforcement points and integrations that sit outside them:
- Cisco AI Defense: listed by Cisco as the Hybrid Mesh Firewall enforcement point for AI workloads (AI guardrails), but not part of either Cloud Protection package
- Integrations with zero trust access, Cisco ISE and Splunk, so remote users, network access and logging can share the same policy and visibility
On investment protection, Cisco says there is no rip and replace: you can start with any of the tools, adopt components at your own pace and add enforcement points over time, for example starting with firewalls for zone-based segmentation and adding microsegmentation later. Cisco also says Secure Firewall Threat Defense customers who subscribe to Splunk may be eligible for extra log data at no additional licensing cost. Cisco does not publish a mechanism for moving entitlement freely between products, so we do not assume one; if flexibility over the term matters to you, we confirm the terms in writing before you commit.
Who it suits and how we help
The suite makes most sense for organisations with a real hybrid footprint: a data centre plus public cloud, Kubernetes in production, several firewall estates to rationalise, or audit pressure to prove segmentation. A single office with one internet line is better served by Cisco Secure Firewall on its own.
Forever Systems maps your applications, flows and clouds, then recommends which package to start with and which enforcement point belongs where. We deploy in observe mode first, so policy is tested against real traffic before anything is blocked, then expand. Pricing depends on the packages, workloads, cloud traffic and term, so ask us for a quote. Contact us to discuss your estate.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is included in the Cisco Cloud Protection Suite?
Cisco currently offers two packages. Segmentation includes Secure Workload SaaS, Hypershield and the Isovalent Enterprise Platform. Gateway includes virtual Secure Firewall (Threat Defense Virtual) and Multicloud Defense. Security Cloud Control is included with both.
Is the Cloud Protection Suite the same as Hybrid Mesh Firewall?
Not quite. Hybrid Mesh Firewall is Cisco's architecture for distributed firewalling under one policy. The Cloud Protection Suite is the licensing vehicle Cisco offers for the core products in that architecture.
Does the Cloud Protection Suite include Secure Firewall hardware?
The Gateway package covers Secure Firewall virtual firewalls. Physical Secure Firewall appliances are licensed in the usual way and are managed alongside the suite in Security Cloud Control.
Is AI Defense part of the Cloud Protection Suite?
No. Cisco lists AI Defense as a Hybrid Mesh Firewall enforcement point for AI workloads, but it is not included in the Segmentation or Gateway package, so we quote it separately.
Can I start with just one package?
Yes. Cisco says you can start with any of the tools and adopt components at your own pace. A common approach is to start with Gateway for public cloud or Segmentation for the data centre, then add the other.