Welcome everyone. Today I will be talking to you about Cisco's hypershield, a transformative approach to data center securities. As of October 2026, we are redefining how we protect modern network environments by moving beyond traditional centralized.00:04Constraints to a model of hyper distributed autonomous security.00:20To understand where hypershield fits, we 1st look at the prevailing network architectures today. While traditional three tier architectures provided the foundation for campus and other networks for years, the data center industry has shifted toward the two tier spine leaf fabric. This flat high performance design is where Cisco's newest Nexus switches predomi.00:25Permanently operate within, working at the leaf level and providing top of rack connectivity to servers and workloads beneath. And at this leaf level is where Hypershield provides protection.00:45Cisco's hypershield story is centered around the new nexus smart switches. These are silicon one based NXOS switches equipped with dpus or data processing units, which act as high performance programmable packet processing engines.00:57DPUS bridge the gap between software functions running in CPUs and hardware based forwarding in ASICs. They consist of a programmable data plane, memory, specialized acceleration engines, and embedded CPUs for control plane and management.01:14Thus, the new nexus smart switch serves both as a network device and a security device and the nexus 9000 software image includes both the software for the silicon one NPU and the DPU. Here we see the hardware facilitating this innovation, the latest Cisco Nexus smart switches, namely the.01:31N9324 CSE one U Dancebourg, and the N9348Y2C6 DSE one U day shoots. These switches are more than just networking devices. They function as compute capable platforms by integrating AMDDDP uS directly into the switch silicon.01:51This integration guarantees massive throughput along with 128 gb total dedicated DRAM per device enabling line rate security enforcement.02:11Traditionally, security has been a choke point model, where all traffic was routed through centralized firewalls causing latency and performance issues. Hypershield changes this by distributing enforcement to the switch edge, allowing stateful L three and L four segmentation for every flows. This innovative approach offers firewall capabilities on every.02:22Support without needing additional hardware to rack, stack, and manage. This enables organic horizontal growth without the traditional scaling issues and has the added effect of drastically reducing the number of managed appliances in the network stack.02:42Let's talk performance. For the nexus 9300 smart switch, the total latency is comprised of three distinct stages, 2.5 μs during silicon one ingress, 3 μs for DPU security processing, and 2.5 μs during silicon one egress. This results in roughly e.02:588 μs total latency. Now, when you use a traditional firewall, the traffic must be hair pinned, meaning it is physically sent out of the switch through a cable into a separate firewall appliance processed and then sent back to the switch to continue its journey. A typical hardware firewall can introduce 20 to five.03:18Hundred plus microseconds of latency, which spikes further under complex policy loads.03:38With hypershield, moving the firewall logic, the DPU, directly into the switching path, you eliminate the hairpin journey. You are processing the security logic at wire speed within the switch fabric itself, keeping the latency in the low single digit microsecond range.03:44A prevalent challenge from customers is the siloed nature of net ops and netsecops. Hypershield facilitates integrated management through security cloud control and on prem controllers, allowing shared context and unified operations, whether via the Nexus dashboard, NXA PI or CLI. Hypershield.04:02Bridges gaps between infrastructure and security, enhancing collaboration among teams.04:22Our 1st major use case is East West autonomous segmentation at the top of racker. By replacing traditional firewall bottlenecks with DPU enabled switches, we enable synchronized, stateful distributed firewall rules across the fabric, offering agentless support for all workloads and reducing total cost of ownership.04:28This technology transforms operational efficiency and scalability. For zone based firewalling, Hypershield serves as a drop in replacement for expensive L four firewall appliances. It enables the definition of tenant specific policies that are enforced directly at the DPU switch level.04:47This approach ensures a consistent policy architecture and supports future developments where digital twin technology will facilitate stage testing before policy deployments. To close, let's summarize where Hypershield is today.05:07At present using the new Cisco nexus 9300 smart switches, Hypershield provides a layer four segmentation within and across data centers on top of the rack. Hypershield is network policy based. Those policies are streamlined from the Cisco security cloud control, a SaaS, where the policies are defined.05:22And then push down to the switches to be enforced.05:42Hypershield, together with the smart switches, will eliminate the need of ingress and egress data center firewalls being used for L four segmentation and are usually expensive, complex, and a performance bottleneck. The application micro segmentation use case enables control of the lateral movement across workloads, and while enforcing segmentation is fundamental.05:46It can be very hard to implement. Customers have been saying that it takes about 40 days or even more to define the segmentation for a single application.06:05And once applied, the requirements have already changed. The segmentation can also be applied based on application behavior, critical files updates when it shouldn't or based on threat and Intel updates. It's where AI can be leveraged to help security teams to adapt quickly and update the policies.06:14Finally, let's talk about the broader vision of Hypershield over time. Keep in mind that what we are seeing here on this slide is the future vision for Hypershield. The ultimate vision for Hypershield builds upon the foundation established by the zone segmentation use case. By adding EBPF based workload agents, we can enrich the information of.06:33Available to Hypershield enabling more fine grained policies. This opens the application micro segmentation use case where we can push policy enforcement even closer to the workloads and policies can begin to make decisions based on application identity and or context. Building upon the functionality of the workload agents and incorporating application slash.06:53Workload identity and increased telemetry both on the network and runtime side. Hypershield will eventually gain the ability to protect against runtime exploits and have combined runtime plus network protection capabilities.07:13Finally, the vision for Hypershield is to take all the capabilities and extend them to multi cloud environments, leveraging the workload agents to run in VMs, in cloud instances, on Kubernetes, and on bare metal workloads. Thank you for taking the time to learn about Cisco's Hypershield today.07:26We hope you found the information helpful. Please be sure to check out our other videos for a deeper understanding of hypershield's architecture and practical applications. Have a wonderful day and thank you again for your attention.07:44
