"How is this different from just VLANs?" → VLANs segment by location (subnet/broadcast domain); Elisity segments by identity. Coarse vs per-device.
Example: A VP's phone in Building A can route to a wired printer in Building B on a different subnet. With VLANs you'd need a hand-maintained inter-VLAN ACL for every subnet pair to stop that. Elisity applies one identity rule — Phones → Printers: deny — everywhere, automatically, and it follows the phone if it moves.
One-liner:"VLANs segment by location; Elisity segments by identity. Same phone, same rule, anywhere on the network."
"Where does classification come from with no agent?" → traffic-flow metadata + integrations (AD, ServiceNow, Medigate, Claroty).
"What's the deployment timeline?" → days per site, first enforced policy in ~2 weeks vs months/years traditionally.
Caution: Percentage stats (65% fewer firewall licenses, 85% less lateral risk, 90% less over-privilege) are Elisity's own marketing figures — present them as vendor claims, not independent benchmarks.