For industrial organizations, gaining visibility into the operational technology (OT) network is a critical first step. But visibility alone doesn’t stop threats. The real challenge is taking that insight and turning it into actionable security policies—without disrupting critical production processes.
In this moment of frontier AI models, network segmentation for OT environments is fast becoming an essential and urgent security control to mitigate the threat of autonomous, high-speed lateral movement. In the absence of segmentation, threat actors can wreak havoc across flat OT networks.
With the release of Cisco Cyber Vision 5.6, we are starting to bridge the gap between seeing your network and securing it with OT segmentation enabled by Cisco’s Industrial Ethernet switches. This major update introduces foundational zone segmentation simulation capabilities and a new user experience, giving your security and operations teams the tools they need to protect industrial environments with confidence.
This product milestone in Cyber Vision allows organizations to start to implement a defense-in-depth strategy that is perfectly aligned with modern mandates, such as the IEC 62443 standard, CISA recommendations for Zero Trust, and the European Union’s NIS2 directive. Cyber Vision essentially shifts the burden of OT security from bolting on disparate, complex appliances to embedding it within the switch itself. The switch becomes an enforcement point, not just a connection point, giving customers an in-network defense layer without bolting on separate security appliances.
A Practical Path to OT Segmentation, Starting with Simulation
We know OT segmentation requires careful planning. That is why we are rolling out this capability in phases. Starting with Cyber Vision 5.6, policy simulation is now generally available. In early 2027, we will add full policy enforcement, enabling industrial teams to transition from flat networks to a secure, policy-driven ‘assume breach’ architecture.
The segmentation workflow has three steps, and OT teams stay involved throughout.
- AI-assisted asset grouping and policy recommendations (SHIPPING): Cyber Vision analyzes observed assets and communication flows. It recommends logical zones and segmentation policy based on how the plant actually operates.
- Simulation before enforcement (SHIPPING): The team reviews the recommendation and simulates it against live traffic. They can see which flows would be allowed or blocked and confirm the policy will not disrupt production.
- Turn enforcement on (*EARLY 2027): Once the policy is approved, enforcement is enabled on the supported Cisco Industrial Ethernet switches. The network begins restricting unauthorized communication and containing movement between zones.
The Outcome: A direct, safe path from visibility to protection. You now have a tool that can make sense of all OT network activities and streamline a network segmentation project to completion in weeks instead of years—a vital capability in the frontier AI model era.
A Brand New and Unified User Experience
Cyber Vision 5.6 comes with a brand-new user interface that offers a familiar Cisco product user experience, bringing all your critical security operations into a single, consistent view.
- Global Communications Map: See exactly how assets interact across your entire OT environment. Advanced zone filtering in-line with the IEC 62443 zones and conduits model, lets you cut through the noise and focus on what matters, directly aligning observed traffic with the segmentation policies you are building.
- Rich Asset Context: A revamped asset summary page consolidates vulnerabilities, alerts, and communications. You no longer need to piece together investigations from multiple screens; everything you need is in one place.
- OT Activity Timelines: Move beyond static inventory records. New timeline views show the exact sequence of OT actions detected by sensors, allowing you to understand an asset’s behavior, identify anomalous activities, and streamline investigations.
Smarter Detection for Improved Security Efficiency
When an alert fires, context is everything. Cyber Vision 5.6 enhances your ability to detect and investigate anomalies quickly, speaking the language of both industrial operations and IT security.
- MITRE ATT&CK Alignment: Snort signatures now map directly to MITRE ATT&CK tactics and techniques. This translates OT alerts into a familiar framework, bridging the communication gap between OT operators and IT Security Operations Centers (SOCs).
- Risk-based Vulnerability Scoring: The Cisco Security Score highlights vulnerabilities that bad actors are actively exploiting so you can now prioritize patching based on real life insights instead of CVSS scores alone.
- Advanced Scan Detection: An enhanced threat detection engine identifies both horizontal and vertical network scans, providing crucial early warnings of reconnaissance activity before an attack escalates.
- Custom Alert Rules: A new rule engines enables users to define alerts for what they really care about, eliminating noise and alert fatigue. For instance, if an asset’s risk score reaches a certain threshold. Or on communications to/from a forbidden country or domain.
- Enhanced Profiling: By leveraging DHCP profiling and integrating with Cisco Identity Services Engine (ISE) profile databases, Cyber Vision enriches asset context. This means your team spends less time sorting through disconnected signals and more time addressing real risks.
Simple deployment at scale, even for a non-Cisco network
Deploying OT security at scale shouldn’t be a burden. Because the Cyber Vision sensor runs within Cisco switches and routers, our customers love how fast, simple, and cost efficient it is to deploy at scale. Customers running non-Cisco industrial networks have always been able to use SPAN collection infrastructures. Release 5.6 comes with new Docker and VM sensors giving customers the option to gain visibility using the edge compute platforms of their choice.
What Cyber Vision 5.6 Means for Your Business
Cyber Vision 5.6 is about moving past the “visibility phase” and taking concrete steps toward a secure, segmented OT environment. It empowers your teams with an intuitive OT security platform built for scale and that simplifies daily operations, accelerates threat investigations, and provides a practical, safe way to design and test security policies with segmentation simulation.
Cisco Cyber Vision 5.6 is available now and is included with Cisco IE3500 and IE9300 Rugged Series switches at no additional charge. If your team is ready to move from OT visibility to protection, it’s time to take the next step.
Explore Cisco Industrial IoT
Improve business outcomes with our end-to-end Industrial IoT solutions. Securely connect assets, applications, and data in real time to apply transformative business changes.
