What shipped,
and when.

Signed-in access: a workstation reaches the servers you choose only after its user signs in with Microsoft Entra ID, and loses them when the grant ends. Connecting your organization is an admin consent to Segmenta's own Entra app, with nothing to register.

The workstation package runs on macOS as well as Windows, and updates itself from signed releases.

The evidence pack: one PDF, or one CSV per section, of protection per host and workload, your critical systems, every published rule and the period's approvals. A monthly report puts protection, lateral reach and the month's publishes on one page for clients and boards.

Critical systems: rate an application Critical or High, and Segmenta reads from your published rules which devices can reach it.

The Dashboard puts what needs you first, and leads with lateral reach: how many servers could open an admin session on each other through the rules you've published.

Applications is one page: the list stays on screen, and each application has its own Overview, Traffic, Rules, Suggestions and History.

Taking a host out of protection asks for a reason and a second factor, as opening temporary access does, and raises an alert.

A publish can require up to five approvals. Each approval is a different person, and under separation of duties the person who submitted the change doesn't count.

Canary publishing: a change reaches the hosts you choose first, and every other host keeps its previous rules until you promote it. New blocked connections on the canaries hold the promotion for you to look at.

Your own pre-flight checks. Describe a rule you want flagged (ports, protocol, direction, the Roles at either end) with a severity and a message, and every publish is checked against it.

Outbound rules can name a website by its domain, and Windows agents enforce them as well as Linux. Each host resolves the name itself and admits only the addresses it got back. Suggestions offer names wherever every address had one, and a setting lets you prefer the web by port instead.

The shared “servers may reach the web” rule can be narrowed to the sites your hosts actually use, in two steps, so the broad rule only goes once the named ones are in place. A site that only one application uses moves into that application's own rules.

Google Cloud VMs can be protected without an agent, through VPC firewall rules on a tag of the VM's own, with VPC flow logs read back as evidence.

On AWS, protecting a VM replaces its security groups with Segmenta's, and returning it to Learning puts yours back. A policy too large for a security group is refused whole, so the last one stays in force.

Lock edits to the cloud firewalls Segmenta manages. Segmenta writes the Azure Policy or AWS service control policy for you to apply. A hand edit to a firewall Segmenta manages is put back and recorded in the audit log.

Kubernetes Block rules are now enforced on OpenShift's OVN-Kubernetes (with an opt-in permission), on the Amazon VPC CNI from 1.21.1, and on GKE Dataplane V2 from 1.36, as well as on Cilium and Calico.

Kubernetes workloads can be placed into applications and Roles from their own labels. Accept a proposed application whole, and every workload joins in Learning.

Windows agents record pings by default, so Learning sees the monitoring checks that used to show up only after a host was protected.

A host that refuses the policy it was sent says so on Fleet, with the rules Windows rejected, instead of reading “Updating rules…”.

Fleet has a Health tab for what Segmenta runs on your hosts, including every agent's certificate. Hosts are shown by their short name and can be renamed.

When the Segmenta service moves to a new address, agents are told in advance and prove the new one before letting the old one go, so protected hosts never lose their connection to it.

New Traffic views: Changes shows what moved on the network beside what people changed, Lens shows one host and everything that reaches it, Matrix puts every pair of applications on one screen, and the map groups the estate into zones.

The console works on a phone: every page fits the screen, and the map lets you pick an application and read it.

Block rules are enforced in Kubernetes on Cilium and Calico, as a deny that wins over any allow.

Amazon EKS is supported, with the Amazon VPC CNI enforcing the policies. Workloads protected there still reach each other and the API server through their Services, and an IPv4-only cluster gets no IPv6 addresses in its policies. Turn on the VPC CNI's policy event log in the EKS add-on and Segmenta also shows the connections your policies block. Tested on EKS 1.34.

Kubernetes clusters without Cilium can be connected. On Calico or OpenShift's OVN-Kubernetes, an optional DaemonSet reads each node's connection table, and Segmenta won't protect a cluster where nothing would enforce a NetworkPolicy.

OpenShift is supported. Say so when you create the cluster, and its manifest fits OpenShift's security constraints. Tested on Kubernetes 1.31 to 1.37 and on OKD 4.22.

A protected Kubernetes workload is enforced in both directions. What the cluster itself needs, DNS and the API server, is proposed as a required rule, and a workload can't be protected until it's answered.

Kubernetes workloads are protected one at a time, from Fleet or a staged rollout, rather than a whole cluster at once.

Kubernetes clusters running Cilium can be connected. A connector inside the cluster maps workloads from Hubble, suggests NetworkPolicies, and, once you protect the cluster, enforces a Role’s inbound rules as NetworkPolicy.

Windows domain PCs can be named in rules. A separate, lightweight workstation agent reports which addresses a PC holds, so “Finance workstations may reach the file server” keeps meaning it across DHCP, Wi-Fi and VPN.

Just-in-time access: open one administrative port on one host to one stated address for minutes, behind your second factor, recorded like any other rule and closed on its own.

On protected Windows hosts a Group Policy allow can no longer hold a door open: enforcement is authoritative by default.

Agent certificates renew themselves over the live connection before they expire, so a host never has to be re-enrolled for that.

Ready to protect now means nothing left to decide, not a clean week: traffic you expect to stay blocked can be recorded as such.

Sign-in and signup are email first: enter your address, type the six-digit code, and pick the organisation. A verified email domain can send its people straight to the organisation’s SSO.

Every new organisation starts with a 30-day trial of the whole product, enforcement included, on up to 10 servers and 50 workstations.

The recommender can now be profiled function by function, so a slow board can be traced to the pass responsible instead of guessed at.

Blocked outbound traffic to a destination outside your fleet now becomes a suggestion. Previously an enforced denial to an unmanaged address had no path to a rule at all, and the traffic stayed invisible.

Quarantine is now a Protection status you set from the fleet bulk bar, rather than a separate chip beside a Protection chip that still read “Protected”. Release restores whatever mode the host was in beforehand.

The rules nobody authored — the control-plane allows the agent injects for its own connection — now appear as ordinary rows in the Rules table, so the list matches what is actually on the host.

A blocked flow can now ask what would fix it, and flows are grouped under the rule that would allow them rather than listed one by one.

The map toolbar folds away so the dependency map fits on a phone.

Suggestions can be implemented in batches instead of one at a time, and a role is asked about once rather than once per container.

Every number on the Suggestions tab is now answerable: activity over the window, the hosts a flow actually reached, whether the destination port is listening, and the container behind it.

Rules stopped being suggested for hosts that no longer exist, for destinations nothing in the fleet can reach, and for destinations that never actually receive the traffic.

Email sign-in links added as a second authentication method, and self-serve organisation creation from the marketing site.

The agent now measures its own apply duration and event-loop lag, so a slow host is visible as a number rather than as a hunch.

A whole named network can be allowed in one rule instead of one rule per role inside it — but only where it genuinely collapses three or more rows, so the widen is never offered for its own sake.

Internet-bound traffic gets its own row when the LAN half of a suggestion narrows, instead of being folded away with it.

A reconcile divergence now names its own cause rather than reporting that something, somewhere, differs.

A warning before a server member widens a container-only role's egress — the case where adding one host quietly opens more than intended.