WABBALABS
Network Security Policy Management

Orchestrate, govern and keep your security devices running

Wabba-Sego turns your flow requests into compliant rules, calculates what each change will cut before writing anything, and proves your compliance. First module: microsegmentation with Illumio Core.

Request a demonstration Discover Wabba-Sego
  • On your premises, offline
  • No write without a dry run
  • Your guardrails checked everywhere
Change plan pay-app-01 moves from Paris to London loc: PARloc: LON
  1. PrepareOne label changes, entered on screen.
  2. Dry run and impact3 flows would be cut: 3 rules proposed to keep them.
  3. ApproveReviewed by a second person.
  4. ApplyThe rules first, then the label.
  5. TracePlan report, audit and exchange logs.
3
3
0
The challenge

Microsegmentation is hard to adopt and to govern

  • Business teams think in IPs

    For application owners, moving from IP addresses to labels makes flows harder to read and opening requests harder to write.

  • Rules that are hard to read

    Many rulesets, labels across several dimensions: knowing what a rule really opens takes an expert.

  • Label groups get complex

    Catalogue, naming, label groups and their members: without a reference model, it all drifts out of line quickly.

  • Conventions nobody checks

    Allowed flows between environments or tiers, forbidden ports: checked by hand, or not at all.

  • Changes made blind

    A label, a mode or a rule that changes alters the flows: outages are discovered in production.

A frequent consequence: microsegmentation projects that stay in visibility only, because the risk of a change cannot be measured.

Wabba-Sego

One platform, three jobs

Installed on your premises, between your teams and your security devices, Wabba-Sego acts directly on their consoles, starting with the Illumio Core PCE, one change at a time or in bulk.

  • Orchestrate

    • One plan per change: dry run on the live state, approval if you require it, application in order.
    • One at a time or in bulk, on screen or from a file.
    • Wabba-Sego never writes outside a plan.

  • Govern

    • Your labelling model and your guardrails, checked wherever a rule is created.
    • Exceptions with expiry dates, rule recertification.
    • Compliance that is measured and proven.

  • Maintain

    • PCE and VEN fleet health, every day.
    • Deviations detected at every synchronisation.
    • Remediation designed not to cut anything.

Hardly anything changes in your processes: the request stays the same.

Orchestrate

One single path to write: the plan

Every write to a device goes through a plan, simulated on the live state before it is applied. No exceptions, no workaround scripts.

  1. Prepare

    On screen or from a file; every row checked.

  2. Dry run

    Reads the live state of the PCE; shows every change and its impact.

  3. Approve

    By another person, if your organisation requires it.

  4. Apply

    Reads the PCE again just before, writes in the plan's order, provisions.

  5. Trace

    Plan report, audit log and exchange log.

Outdated plan: nothing is written. If what it would write, or its impact, has changed on the PCE, or if its validity (24 hours by default) has passed, the plan is not applied, and it says why.

Prevent incidents

Before writing, you know which flows will be cut

pay-app-01 moves from Paris to London: a simple label change. Wabba-Sego reads the production policy, calculates the flows cut and opened, then proposes the rules that keep them, following your conventions and your guardrails.

  • With observed traffic analysis: observed flows are critical, those with immediate effect flagged.
  • Proposed rules are written and provisioned before the rest of the plan.
  • Recalculated with them: no flow cut any more.
  • For every plan: labels, modes, rules, objects, corrections.
Flows cut by the change: three critical flows, two with immediate effect
The calculation: three flows cut, two with immediate effect.
Three proposed rules, one per flow cut, in the rulesets of your conventions
The solution: one proposed rule per flow cut.
Fit into your processes

IP-by-IP requests, label-based rules

Application owners ask just as they would for a firewall: a source, a destination, a port. Wabba-Sego resolves each address into a workload and its labels, checks whether the flow is already open, deny rules included, then builds the rule following your conventions and checks it against your guardrails.

  • Ruleset and rule type derived from your conventions; actors given by labels.
  • Up to 100 flows checked at once, grouped by rule.
  • A summary ready for the ticket, and a request file that can be re-imported as it is.
Rule to create in RS_PAYMENTS_PROD_PAR, extra-scope, with a guardrail alert
The rule as built, with the guardrail alert: WEB to DB, refused.
Govern

Guardrails checked wherever a rule is created

Allowed flow matrices on your label types and tags, forbidden ports and protocols, forbidden label combinations: checked at flow check, at import, on proposed rules, at remediation, then again at the dry run. A non-compliant rule is written only with an exception that is dated and traced.

See every feature

Tiers allowed flow matrix: WEB to DB not allowed
Tiers matrix, on the TIER tag: on hover, WEB → DB is refused.
What sets us apart

Six strengths with no known equivalent*

  • UNIQUE*

    A labelling model that drives everything

    Naming, catalogue, forbidden combinations: checked across the whole PCE, corrected through plans.

  • UNIQUE*

    Your IP-by-IP requests, label-based rules

    Built following your conventions, checked against your guardrails, applied through a plan.

  • UNIQUE*

    Guardrails built on your model

    Flow matrices on your types and tags, forbidden combinations, forbidden ports; checked wherever a rule is created.

  • UNIQUE*

    The impact, before writing

    Of a label or an object as well as a rule: flows cut and opened, calculated from the policy, immediate effect included; criticality from traffic, on request.

  • UNIQUE*

    Change and remediate without losing flows

    Proposed rules, on request, to keep the flows a change would cut; a write order designed not to cut anything.

  • UNIQUE*

    A policy kept in shape over time

    Unused rules found even with no traffic: no hits, or no workload left; recertification, rules too broad or duplicated.

* An approach we have not found in the public documentation of Illumio Core, of other microsegmentation solutions or of the tools that manage them (October 2026).

Benefits

What everyone gains

  • CISOs and management

    • Compliance that is measured and proven: report, registers, logs.
    • Your guardrails checked wherever a rule is created; every exception dated and traced.

  • Network and security teams

    • Requests handled with hardly any change to your processes: rules built and checked.
    • Fewer incidents: impact calculated and rules proposed before writing.

  • Integrators and MSSPs

    • One platform for all your customers, kept apart.
    • Each customer's governance, applied in a repeatable way.

Gains to measure together during the pilot: request handling time, incidents avoided, enforcement progress.

Platform

For enterprises and MSSPs, installed on your premises

  • Separate tenants

    Each customer's accounts, instances and data, kept apart.

  • Several PCEs

    Production, pre-production, subsidiaries… in a single tenant.

  • Roles and approval

    Built-in or custom roles; four-eyes approval, optional.

  • English or French

    Interface chosen by each user; reports and files in English.

  • On premises, offline

    Signed bundle; virtual appliance (OVA, VHDX) or Linux containers.

  • Protected access

    Two-factor authentication, rights checked on the server, HTTPS.

  • Encrypted secrets

    PCE credentials encrypted (AES-256-GCM), never displayed or logged.

  • Backups

    Every night and before every update; restore tested with every release.

Prerequisites: Illumio Core, on premises or SaaS; an API key with a global role and no scope (Global Administrator or Owner to write; a read-only key is also possible, plans then being run by hand). PCE health: on-premises PCE. Rules with no hits: Rule Hit Count enabled (PCE 23.5.10 or later on premises, 24.2 or later in SaaS; VEN 23.2.30 or later). Deny rules in rulesets: PCE 24.2 or later. Machine: 2 CPUs and 4 GB of memory at least (4 and 8 GB recommended), 40 GB of disk; no internet access needed.

See how the product is secured

NSPM

A different approach to network security policy management

NSPM tools analyse rules and support change requests, mostly on firewalls. Wabba-Sego acts directly on the devices, in bulk and within guardrails, starting with microsegmentation.

Understand NSPM and where Wabba-Sego fits
Roadmap

What comes next

  1. Priority

    ITSM integration

    ServiceNow first

    • Flow opening requests received from the ServiceNow service catalogue; rules built and checked by Wabba-Sego.
    • Each plan linked to its change request; approval in ServiceNow or in Wabba-Sego.
    • Closure with the plan report.
  2. Next

    Firewalls module

    Governed just like microsegmentation

    • Object model, conventions, guardrails and exceptions.
    • Flow check and opening, impact, plans.
    • Recertification and remediation of non-compliant rules.
  3. Later

    And beyond

    Other devices

    • Other microsegmentation vendors.
    • Proxy and SASE/SSE.
    • Connection to the corporate directory (SSO) and a SaaS offering.

Indicative roadmap, not contractual.

Try Wabba-Sego on your infrastructure

  1. Demonstration

    On your use cases, with your conventions.

  2. 90-day pilot

    Installed on your premises, offline, connected to your PCE: a pilot on a real scope.

  3. Pilot review

    From the labelling model to enforcement: objectives set at the start, measured at the end.

Request a demonstration Start a 90-day pilot