Tufin is positioning its latest software release to counter the security blind spots created by the rapid, AI-accelerated pace of modern infrastructure changes. By launching the Tufin Orchestration Suite (TOS) 5.4, the company aims to provide a unified governance layer for enterprises struggling with fragmented visibility across multi-vendor environments. As organizations distribute workloads across public clouds, software-defined networks, and on-premises hardware, the difficulty of maintaining a single, accurate view of security policies has intensified. According to a 2026 Cloud Security Alliance survey, 92% of organizations reported challenges in obtaining this unified visibility. Tufin is attempting to bridge these gaps by expanding its platform's reach into critical cloud and hardware ecosystems, targeting the friction between rapid deployment and strict compliance requirements.
Expanding Platform Coverage via Stormshield, VMware, and Fortinet
The TOS 5.4 release introduces native support for three major platforms, specifically targeting environments where manual policy management creates significant risk. The integration of Stormshield Network Security is designed to assist organizations in European government, defense, and critical infrastructure sectors, particularly those needing to reduce manual audit efforts for NIS2 compliance. By incorporating Stormshield SNS firewalls, Tufin enables change tracking and SecureChange access request automation within these highly regulated environments.
Furthermore, Tufin is addressing the migration path for virtualized infrastructure by adding support for Broadcom VMware Cloud Foundation (VCF) with NSX 9.1. This allows enterprises transitioning to VCF to maintain existing policy management, compliance, and automation capabilities without losing visibility during the migration process. To support the shift toward cloud-managed security, the update also includes FortiManager Cloud support. This extension provides FortiGate firewall users with the same topology and compliance capabilities available in on-premises environments, aiming to prevent the introduction of manual, siloed processes as management moves to the cloud. These integrations suggest a strategic focus on maintaining a consistent control plane even as the underlying hardware and management layers shift.
Strengthening Policy Governance and Rule Recertification
Beyond expanding its ecosystem, Tufin is enhancing how security teams audit and optimize existing rules to prevent "policy bloat" and unintended connectivity. The update expands rule recertification workflows to a wide array of cloud and multi-vendor platforms, including AWS Network Firewall, Azure Network Security Groups (NSGs), Google Cloud VPC Firewall, Palo Alto Networks Strata Cloud Manager, Cisco Meraki, and Zscaler ZIA. By centralizing these rules into a common review process, the company intends to help organizations identify obsolete rules and strengthen audit readiness across heterogeneous stacks.
Technical refinements also target the accuracy of policy analysis. For Palo Alto Panorama users, TOS 5.4 incorporates the "Target" field into visibility and shadowing detection, which Tufin claims helps reduce false positives during policy cleanup. Additionally, the release introduces application-specific blocking via Application ID support within its Unified Security Policy (USP). For microsegmentation environments like Akamai Guardicore and Illumio, the platform now evaluates all associated tags—including indirect tags—to improve the detection of compliance violations in workloads with multiple classifications. These updates appear aimed at providing more granular control as network environments become increasingly dynamic.
Key Takeaways
- TOS 5.4 adds native support for Stormshield SNS firewalls, Broadcom VMware Cloud Foundation (VCF) with NSX 9.1, and FortiManager Cloud.
- The update expands rule recertification capabilities to include AWS, Azure, Google Cloud, Cisco Meraki, and Zscaler ZIA.
- New USP compliance features include Application ID support and automated detection of missing Security Profile Groups or Log Forwarding Profiles on next-generation firewalls.
TechInsyte's Take
In our view, Tufin’s move to expand TOS 5.4 is a direct response to the "visibility gap" that emerges when AI-driven automation accelerates network changes faster than human operators can audit them. By targeting specific high-stakes integrations—such as Stormshield for NIS2-regulated sectors and VMware VCF for migrating enterprises—Tufin is moving beyond simple monitoring and into the realm of essential governance orchestration. The emphasis on rule recertification across diverse providers like AWS and Zscaler suggests that the company recognizes the primary threat to enterprise resilience is not just external attackers, but the internal complexity of managing inconsistent policies. If Tufin can successfully maintain its "Unified Control Plane" across these disparate environments, it will provide a critical layer of stability for CIOs attempting to balance rapid cloud adoption with the rigid demands of modern cybersecurity compliance.
Questions & Answers
How does TOS 5.4 assist organizations subject to NIS2 regulations?
Tufin has added native support for Stormshield SNS firewalls, which is widely used in European government and critical infrastructure. This integration is intended to reduce manual audit efforts and allow these environments to be brought under broader network security governance processes, helping to close policy blind spots.
What specific improvements are made to Palo Alto Panorama policy analysis?
The update incorporates the "Target" field into policy visibility, revision comparison, shadowing detection, and traffic path simulation. This allows the platform to model the specific devices to which a rule applies, which Tufin states helps reduce false positives during policy cleanup.
In what way does the update enhance microsegmentation security for Akamai Guardicore and Illumio?
For these environments, USP compliance checks have been updated to evaluate all tags associated with an asset, including indirect tags. This is designed to improve the detection of policy violations involving workloads that carry multiple classifications.
How does the release support enterprises migrating to cloud-based management?
By adding FortiManager Cloud support, Tufin enables Fortinet customers to maintain consistent policy governance, topology, and automation for FortiGate firewalls as they move from on-premises management to cloud-based management.
Source: Tufin
