Cylera identifies. Cisco enforces.
Cylera passively identifies every connected medical device and shares the clinical context with Cisco ISE and Catalyst Center, so your Cisco network can segment, locate and protect it.
- Cisco Security Technical Alliance partner
- Passive, out-of-band. No agents on medical devices.
- Cyber Innovation Award, Scottish Cyber Awards 2026
Policy is only as good as identity.
Most connected medical devices cannot run an agent and cannot be scanned in the usual way. A network policy engine can only enforce what it can classify. Cylera supplies the classification. Cisco supplies the enforcement.
See every device
Cylera listens to network traffic and identifies connected medical, IoT and building systems devices, known and unknown, without touching them.
Know what it means
Each device carries clinical context: what it is, where it sits, how it is used and how much risk it brings, ranked by clinical impact.
Enforce on the network you run
Cisco ISE and Catalyst Center turn that identity into segmentation, access control and a shared inventory, using integrations Cylera has published.
From a mirrored packet to an enforced policy.
Cylera listens passively to traffic from your Cisco switching, identifies each device, and shares what it knows with the Cisco tools that already run your network.
- 01
Observe
A passive Cylera sensor takes mirrored traffic from your Cisco switching. Nothing is installed on a medical device.
- 02
Identify
Cylera classifies each device and adds model, firmware, vulnerabilities, usage and clinical context.
- 03
Share
Device attributes flow into Cisco ISE through pxGrid and ERS APIs, and into Catalyst Center through built-in APIs.
- 04
Segment
ISE builds policy on real device identity. Cylera can sync dACL and TrustSec policy to ISE for review and approval.
- 05
Monitor
Device activity and new risks go to Splunk, so the SOC sees medical devices with the rest of the estate.
Mechanics follow the Cisco Community guide Integrate Cisco ISE with Cylera.
What each integration gives you.
Features say what the integration does. Benefits say what changes for your team. Outcomes say what you can show for it.
Cisco ISE
pxGrid + ERSRisk-based segmentation for connected medical devices.
Device type, class, vendor, model, operating system and Cylera group arrive in ISE as endpoint attributes. Segmentation policy can be synced from Cylera to ISE for review and approval.
ISE can profile and segment medical devices it could not classify before, and policy starts from how each device really behaves.
Cisco Catalyst Center
Built-in APIsOne inventory that IT, security and clinical engineering share.
Standards-based APIs enrich the network inventory with device type, manufacturer, firmware, location, risk and usage. No professional services are needed.
Find any device on the network, see what it needs, and act faster on vulnerabilities.
Cisco switching
Catalyst and NexusCoverage that grows with the network.
Sensors take mirrored traffic from the switching you already run. Packet brokers extend coverage where a network is hard to tap.
Visibility without agents or a network redesign.
Splunk
Add-on in developmentFaster investigation and response, on the Splunk investment already in place.
Cylera sends discovered device data and newly identified risks to Splunk, a Cisco company.
The SOC and NOC see connected medical devices alongside the rest of the estate, with alerts when new risks appear.
Outcomes by team
Security
Segment the riskiest devices first, with evidence for each decision.
Clinical engineering
Utilization and lifecycle on the same inventory.
IT and network
One device identity in ISE and Catalyst Center.
Compliance
Evidence built to support frameworks such as HIPAA and, in the UK, DSPT and the NCSC CAF.
Cylera is a Cisco Security Technical Alliance partner, with published integrations across Cisco ISE and Catalyst Center.
A pump starts behaving differently.
How the two systems work together, step by step, in a scenario built from the published integrations.
Illustrative
- 01
A new conversation
An infusion pump starts talking to something it has never talked to before.
- 02
Cylera spots it
It compares the pump with its behavioral baseline and ranks the risk by clinical impact.
- 03
Cisco hears about it
The pump's attributes and Cylera group are in ISE, so policy can act on what the device is.
- 04
Policy contains it
ISE policy can contain the pump. The SOC sees the new risk in Splunk.
Start with one VLAN.
We deploy a pre-configured sensor and you open one VLAN to passive monitoring. Sensor live on day 1, a baseline review in week 2, full report and executive readout on day 30.
Connected medical devices, in the SOC.
Splunk, a Cisco company, is where many security teams already investigate. Cylera collects data from the devices on your network and sends it to Splunk for analysis, so connected medical devices sit alongside the rest of the estate.
What Cylera sends
Data from the devices Cylera discovers on your network, sent to Splunk for analysis.
What the SOC and NOC get
Connected medical devices in the tool they already use, next to the rest of the estate.
What changes
Threats identified and responded to more quickly, on the Splunk investment already in place.
- Patient monitor, Ward 4Normal activity
- Infusion pump, Ward 4New activity: a connection it has never made.
- MRI scanner, ImagingNormal activity
- Nurse call, Ward 2Normal activity
IoT Command Centre.
With Cisco and the Abertay cyberQuarter, Cylera built the Digital Healthcare Demo Suite in Dundee, a healthcare innovation lab for protecting connected clinical devices. Cylera Scotland is at the cyberQuarter, Abertay University's cybersecurity hub in Dundee.
Cylera and Cisco won the Cyber Innovation Award at the Scottish Cyber Awards 2026. See the winners list.
Guides, briefs and voices from the people running it.
Technical guides from the Cisco Community, solution briefs from Cylera, and the work Cisco, Splunk and our partners are doing together.
Integrate Cisco ISE with Cylera
A step-by-step guide: enable pxGrid, create the Cylera endpoint attributes, then push device attributes and sync dACL and TrustSec policy from Cylera to ISE.
Read From CiscoCisco Security and Cylera
Cisco's own listing of the Cylera integration with Cisco ISE over pxGrid, bringing medical IoT visibility into ISE.
Read Solution briefCylera and Cisco ISE
How Cylera's asset intelligence and Cisco ISE network access control work together to segment connected medical devices.
Read Solution briefCylera and Cisco Catalyst Center and Prime
How device attributes from the Cisco network management platform help locate connected medical devices and speed remediation.
Read Solution briefCylera and Splunk
How device data and newly identified risks flow from Cylera into Splunk for the SOC and NOC.
Read BlogCylera and Cisco integrations and their value
What the ISE, Catalyst Center and Prime integrations do, and why risk-based segmentation depends on clinical context.
Read AwardScottish Cyber Awards 2026: the winners
Cisco and Cylera won the Cyber Innovation Award.
Read PartnerCylera at the Abertay cyberQuarter
Abertay's page on Cylera as a cyberQuarter partner and its connected medical device testbed.
Read Press releaseCylera and Cisco increase healthcare IoT and medical device security
The announcement of the Cylera and Cisco ISE integration.
Read Add yoursRunning Cisco and Cylera together?
Written a guide, recorded a walkthrough or presented a session? Send it to us and we will review it for the wall.
Send it to usCisco and Cylera, answered.
Does Cylera integrate with Cisco ISE?
Yes. Cylera is a Cisco Security Technical Alliance partner. Device type, class, vendor, model, operating system and Cylera group reach Cisco ISE as endpoint attributes through pxGrid and ERS APIs. Cylera can also sync dACL and TrustSec segmentation policy to ISE for review and approval.
How does Cylera work with Cisco Catalyst Center?
Cylera uses Catalyst Center's built-in, standards-based APIs to enrich the network inventory with device type, manufacturer, firmware, location, risk and usage. IT, security and clinical engineering then work from one shared inventory.
Does Cylera install agents on medical devices?
No. A passive Cylera sensor takes mirrored traffic from the Cisco Catalyst or Nexus switching a hospital already runs. Nothing is installed on a medical device, and packet brokers extend coverage where a network is hard to tap.
Does Cylera send data to Splunk?
Yes. Cylera sends discovered device data and newly identified risks to Splunk, so the SOC and NOC see connected medical devices in the tool they already use. The Cylera add-on for Splunk is in development.
How can a hospital try Cylera on its Cisco network?
Cylera runs a 30-day proof of value on one VLAN. Cylera deploys a pre-configured sensor, and the hospital opens one VLAN or segment to passive monitoring. The sensor goes live on day 1, the team reviews the devices found in week 2, and Cylera delivers a full report and executive readout on day 30.
See it on your network.
A 30-day proof of value, on one VLAN, on the Cisco network you already run. Your risk, visible.
Start a 30-day proof of value
We deploy a pre-configured sensor. You open one VLAN or segment to passive monitoring. We report in full.
- Day 1Sensor live on one VLAN
- Week 2Baseline review of the devices found
- Day 30Full report and executive readout
For Cisco account teams and partners
Walk through the joint story, the integration mechanics and how a proof of value fits your account plan.