Contrail Security is a simple, open, fully distributed cloud security solution that allows users to protect applications running in any virtual environment. It enhances the security framework by providing critical insights into traffic flows, establishing a new security paradigm that reduces the overall number of policies, simplifies enforcement, and provides greater visibility into—and manageability across— hybrid cloud environments.

1. Intent-driven policy: Contrail Security allows tenants and administrators to express security requirements in plain English, without relying on network coordinates to write policies.
2. Tag workloads and expressions: Policy statements are written using tag expressions that describe application attributes, replacing the traditional method of using network coordinates.
3. Redirect to L7 firewall: Contrail Security provides the ability to subject select traffic to L7 firewalls in a completely dynamic and programmatic fashion.