Smaller Incidents
A device contained early has less time to reach other systems.
Threat containmentDevice isolation
Stop one compromised device from spreading through the network
Customer problem
Detection Alone Does Not Contain
An alert is information. It does not change what a compromised device can reach. Until someone acts, an infected laptop keeps its normal access to file shares, servers and other devices.
Between alert and action, someone has to triage, find the device, choose the control and make the change, often through another team or a ticket.
The time between detection and containment is where incidents grow.
- Alerts that sit among many others
- Working out which device and user an IP belongs to
- Unclear ownership of switch, firewall and host controls
- Changes that need tickets or approvals out of hours
- Infected devices that keep scanning and connecting
- No quick way to confirm a device is contained
THE COSGRID SOLUTION
Layered Containment, Closer to Detection
COSGrid brings detection and enforcement closer together. NetShield NDR is designed to detect suspicious internal activity, ZT-NAC can quarantine a device through its host firewall, and NexusShield can restrict traffic between zones.
With COSGrid, organisations can
- Spot suspicious internal activity with NetShield NDR
- Quarantine a device through its host firewall with ZT-NAC
- Restrict agentless systems at the NexusShield firewall
- Contain devices without switch or VLAN changes
- Restore normal access once the device is cleared
How It Works
Detect
NetShield NDR is designed to flag a device showing signs of compromise. ZT-NAC separately detects devices that fail posture checks.
Identify and Decide
The alert is tied to a specific device, and the right action is chosen for its type: host quarantine or firewall restriction.
Contain
ZT-NAC quarantines agent-running devices through the host firewall. NexusShield restricts other devices or whole zones.
Restore
Access stays restricted while the team investigates. Once the issue is fixed, access returns under normal policy.
Key Benefits
Fewer Hand-Offs
Detection and enforcement are designed to work together instead of through separate teams and tickets.
No Network Redesign
Host-firewall quarantine needs no switch or VLAN changes.
Agentless Coverage
NexusShield can restrict servers and appliances that cannot run an agent.
Encrypted Traffic Insight
NetShield NDR is designed to use flow and handshake metadata without decrypting traffic.
Clear Containment Model
Your team knows which control acts on which kind of device.
Traditional Isolation vs Layered Containment
Traditional Isolation
- Alert reviewed, then a ticket raised
- Device found by IP and switch port
- Isolation at the switch or VLAN
- Agentless systems handled case by case
- Containment depends on who is on shift
- Network changes needed to isolate
Layered Containment
- Detection and enforcement designed to work together
- Device identified for the control that will act on it
- Quarantine on the device through its host firewall
- Agentless systems restricted at the firewall
- Policy-driven where configured
- No switch or VLAN changes with ZT-NAC
Use cases
Built for every access scenario
Contain devices showing ransomware-like behaviour
A device showing ransomware-like behaviour can be quarantined so it stops reaching file shares and servers.
Respond to incidents outside working hours
Where an automatic path is configured and validated, containment can begin without waiting for an analyst.
Quarantine devices that fail compliance checks
A device that falls out of compliance can be quarantined by ZT-NAC until it is cleared.
Contain systems that cannot run an agent
A server or appliance that cannot run an agent can be restricted at the NexusShield firewall.
Who Is This For
Need secure third-party application access? See "Agentless access for contractors and partners"
- SOC Teams
- CISOs
- IT Operations Teams
- Security Architects
- Multi-Branch Organisations
FAQs
Have a question about COSGrid and lateral movement protection?
Can COSGrid prevent lateral movement?
COSGrid reduces lateral movement opportunities by limiting each device and user to the resources their policy allows. No single control prevents every form of lateral movement, which is why COSGrid also offers network detection and response.
What is identity-based microsegmentation? Instead of separating traffic by IP address or VLAN, each host enforces rules based on the verified identity of whoever is connecting. In MicroZAccess, each agent-running host only accepts traffic from certificate identities in groups that policy permits.
Do we need all three products? No. MicroZAccess alone limits what managed devices and agent-running servers can reach. ZT-NAC adds admission control on office networks. NexusShield adds network-zone enforcement for devices that cannot run an agent.
