Illumio added a cloud security product to its lineup that provides agentless visibility and helps customers build workload policies using cloud-native controls.

The new product is called CloudSecure and it complements Illumio Core, the company’s original agent-based segmentation platform that automates security policy across multicloud, container, hybrid, and on-premises environments. CloudSecure provides real-time visibility and insights on cloud-native application traffic, security policy, usage, access, and risk.

CloudSecure “collects a whole bunch of metadata and flow telemetry out of people’s public cloud accounts,” Illumio CTO and co-founder PJ Kirner said. “Once we’ve collected all that metadata and flow telemetry, we help people build a map of their environment like we do with the Illumio Core product.”

The product initially supports Amazon Web Services (AWS) environments with Microsoft Azure and Google Cloud planned for next year. Its reach spans customers’ cloud-native infrastructure: cloud-managed containers (AWS EKS, AWS ECS, Azure AKS), serverless computing (AWS Lambda), cloud managed database instances (AWS RDS, Azure SQL Database, Azure Database), infrastructure-as-a-service (IaaS) and other platform-as-a-service (PaaS) resources. And it provides insights across these resources in a single interface.

After it maps a customer’s public-cloud resources and shows how different types of infrastructure are communicating with each other, CloudSecure then recommends security controls. “We look at the native security controls in the public cloud to help people understand what risk they have there, provide them recommendation, and program those native security controls using infrastructures as code,” Kirner said.

CloudSecure automates labels and continuously monitors cloud environments, which helps teams diagnose issues and manage their security policy with dynamic controls, he added. The product automatically builds and recommends zero-trust policies across cloud providers and accounts.

Between Illumio Core and now CloudSecure, the combined agent-based and agentless technologies provide a “holistic, single-pane-of-glass view across diverse infrastructure, whether that’s a hybrid environments like public cloud and private cloud, or a multicloud environment,” Kirner said.

Illumio’s new product follows a $225 million Series F funding round this summer that pushed its valuation to $2.75 billion. The late-stage funding brings the segmentation pioneer’s total raised to $557.5 million, and it gives the cybersecurity unicorn plenty of new capital to spread the gospel of zero trust.

CloudSecure continues Illumio’s zero-trust philosophy, according to Kirner. “We started the company well before zero trust,” he said. “Back then, for us it was about least privilege, and it was about explicit trust, about defining a policy explicitly and having a default deny model.”

This philosophy continues as organizations move to public cloud, but when it comes to these environments many customers’ security controls are too broad to enforce a least-privilege approach, Kirner added. “Like, let a whole virtual network have access to this thing,” he said. “They don’t have the visibility in which to achieve a least-privilege model.”

To this end, CloudSecure provides a better understanding of rules and gives recommendations to reduce excessive privileges. “It’s just applying different techniques, agentless rather than agents in the public cloud where we need to do that,” he said. “But we still stick to the spirit of what we’re trying to accomplish for our customers.”