Vendor lineage

Illumio

Assumed the attacker is already inside, and made the whole product about what happens next.

Andrew Rubin and PJ Kirner founded Illumio on 23 January 2013 in Sunnyvale, having both left Cymtec the month before. They had met through a mutual friend's introduction over lunch, which Kirner has described as feeling like a blind date. Rubin took the commercial side, Kirner the technical - he had been a distinguished engineer in the security CTO office at Juniper Networks, which appears on this site as a career chapter of its own.

The founding thesis was unfashionable in 2013 and is now close to consensus: perimeter security alone is not enough, breaches are inevitable, and the useful question is what an attacker can reach once inside. Most security spending at the time went on keeping people out. Illumio's argument was that the containment problem deserved its own product.

The technical decision that follows is the interesting one. Segmentation had historically been a network problem - VLANs, zones, firewalls between them - which means the policy lives in the topology, and a workload's security depends on where it happens to sit. Illumio put enforcement at the workload instead, with policy computed centrally and pushed to hosts, so the rule travels with the application rather than with the wiring. That is why it works in a cloud where you do not own the network, and it is the reason a software-first approach could do what hardware segmentation could not keep up with.

And then the part everyone underestimates, which the company has been honest about. You cannot enforce a rule that nothing talks unless it has a reason to until you know what actually talks to what. In a data centre of any age, nobody does. So the first product problem was not enforcement at all but real-time dependency mapping - working out the actual conversation graph of a running estate - and the name comes from illuminate for exactly that reason.

That is also why the company spent twenty-two months in stealth before showing anything. It raised $12.5M from Andreessen Horowitz and General Catalyst in early 2013, emerged in October 2014 with a $30.2M Series B, and had Morgan Stanley and Plantronics as customers in the first year. A $100M round in 2015 took it past a billion.

Today the framing is zero-trust segmentation and breach containment, and the numbers reported are $557M raised, a $2.75B valuation, revenue past $100M a year, and roughly a fifth of the Fortune 100. Kirner stepped down as chief technology officer in May 2023 after a decade, staying on as an adviser.

Read next to two other entries here, it completes a picture of how the perimeter dissolved. Zscaler moved inspection out to where the users went. Netskope tackled what people were doing inside applications nobody had approved. Illumio addressed the inside of the data centre itself, on the assumption that the other two would sometimes fail. Three companies, three different pieces of the same admission: the boundary that security was organised around had stopped describing anything real.

Founding stories

2013

Illumio

Sunnyvale, California · Founders: Andrew Rubin, PJ Kirner

Founded on 23 January by a commercial founder and a distinguished engineer from Juniper's security office, a month after both left Cymtec. The name comes from illuminate, which describes the first problem rather than the product: before anything can be contained, somebody has to know what talks to what.

The timeline

Founded, and immediately quiet
January, then nearly two years of building before anything was shown - because the first problem was mapping, and a map of nothing demonstrates nothing.
Out of stealth
October, with enterprise references already in place - unusual for a company nobody had heard of a year earlier.
Agentless, using somebody else's telemetry
In February the company shipped visibility built from Check Point and Fortinet firewall telemetry rather than from its own agent - reading the traffic map out of infrastructure the customer already has. For a company whose entire architecture was agent-based, that is a notable admission that the agent is a means rather than the point.

Flagship products and solutions

The PCE and the VENA Policy Compute Engine that calculates what every workload should be allowed to do, and a Virtual Enforcement Node on each host that receives the result. The split matters: the thinking is central, the enforcement is local.
IlluminationThe live dependency map - the visual answer to what actually talks to what, which is the artefact customers usually buy before they enforce anything.
Illumio CoreSegmentation for servers and data centre workloads, the original product and still the centre of the business.
CloudSecure and EndpointThe same policy model extended to cloud-native workloads and to laptops, where the containment question is what a compromised endpoint can reach rather than what reaches it.
Illumio InsightsObservability and detection over the traffic graph, and from 2026 able to build that graph from third-party firewall telemetry with no agent deployed at all.

Key innovations

Enforcement handed to the operating systemThe agent does not sit in the traffic path. It programs the firewall the operating system already has - iptables on Linux, the Windows Filtering Platform on Windows - and then gets out of the way. The company calls it enforcement-for-hire, and the code doing the work has been in production since 1998 on one side and around 2007 on the other.
What happens when the agent diesThis is the consequence worth understanding, because every security agent has to answer it. An inline agent that fails either opens the host or blocks it, and both are outages. Here the operating system keeps enforcing the last policy it was given, so a dead agent means policy stops updating rather than stops applying. Competitors that install their own firewall accept a heavier failure mode and an operating system upgrade problem in exchange for more control.
Labels instead of addressesPolicy is written against four dimensions - role, application, environment, location - and never against a VLAN, subnet or IP. A workload that moves, or is rebuilt at a new address, keeps its rules because the rules were never about where it was. This is the whole argument against topology-based segmentation, expressed as a data model.
Four enforcement modes, deployed in orderIdle, then visibility-only, then selective, then full. That progression exists because the honest failure mode of segmentation is not being bypassed - it is breaking a production application nobody documented. Being able to run in production seeing exactly what would have been blocked, before blocking anything, is what makes the project survivable.

Main markets

Large enterprises with data centres old enough that nobody has a current map of them: financial services, healthcare, government, and the operators of estates where an application's dependencies are folklore rather than documentation.

It competes with the other microsegmentation specialists, with the platform vendors adding segmentation to broader suites, and with the argument that cloud-native security groups are already good enough - which is true for estates built after 2015 and not for the ones that were not.

Analyst standing

A Leader in Forrester's microsegmentation assessment and a Customers' Choice in Gartner's 2026 peer review for network security microsegmentation, which is a different signal: it reflects the people who deployed it rather than the analysts who evaluated it.
The category's own difficulty is worth stating. Microsegmentation has been three years from mainstream for about a decade, because the technology has rarely been the obstacle - mapping an undocumented estate and getting permission to enforce anything in it are organisational problems, and no product solves those. The agentless direction of 2026 reads as an answer to the first half of that.

Illumio ↗

From the company

Sources