Network segmentation means dividing a network into smaller, separated zones. A device or account compromised in one zone cannot automatically reach everything else. Controlled checkpoints decide what traffic may cross. Segmentation may not prevent the first breach, but it can stop that breach from becoming the whole network's problem.
Click to load the YouTube player. Watch on YouTube ↗
- 01Segmentation reduces the blast radius of malware, ransomware and stolen credentials.
- 02Physical separation, VLANs, firewall zones and microsegmentation provide increasing levels of granularity.
- 03VLANs organise devices; firewall rules provide the enforcement that makes the boundary meaningful.
- 04Zero trust adds identity and device checks to every request rather than replacing segmentation.
- 05If resources are limited, isolate backups, user devices, servers and guest or IoT equipment first.
Why a flat network is more dangerous than it looks
Small and mid-sized networks often become flat by accident. A laptop joins the office Wi-Fi, a server is connected to the same switching environment and a smart device is added without anyone deciding where a security boundary should sit. Everything works, but once an attacker controls one device there may be little technical separation between that foothold and a file server, domain controller or backup system.
Modern ransomware operations are built to exploit that freedom of movement. CrowdStrike's 2025 threat reporting describes average eCrime breakout times of less than an hour and an observed fastest breakout measured in under a minute. Breakout time is the period between the first compromised system and an attacker beginning to move into the wider environment. Segmentation directly addresses that critical moment.
A flat network gives an intruder a highway. A segmented network gives every attempted move another checkpoint.
One laptop, two outcomes
The infected laptop can attempt connections to file shares, identity systems, finance applications and backups. The incident expands because internal reach is assumed rather than verified.
The user-device zone can reach the internet and a small set of approved services. Servers and backups sit behind separate controls. The team still has an incident, but its blast radius is much smaller.
The four main approaches
Most organisations layer these approaches. VLANs provide broad grouping, a firewall controls traffic between groups and microsegmentation can protect a small set of critical workloads such as backups, identity services or finance systems.
Where zero trust fits
NIST Special Publication 800-207 describes zero trust as a move away from granting confidence simply because a request originates inside a network perimeter. Traditional segmentation asks which zone a connection comes from. Zero trust also asks whether this particular identity, device and request should be allowed right now.
The two controls reinforce each other. Segmentation limits where traffic can travel. Zero trust evaluates whether the individual request deserves access. This is especially useful when staff, applications and data no longer sit inside one traditional office network. The identity layer is explored further in Passkeys vs Authenticator Apps in 2026.
Where to start if you cannot segment everything
- Isolate backups firstRestrict access to backup and recovery infrastructure. Do not let ordinary user credentials or endpoints reach it directly.
- Separate users from serversMost employee devices never need direct access to databases, domain controllers or management interfaces.
- Protect operational technologyManufacturing, building, medical and other physical-process systems should not share unrestricted access with office IT.
- Move guest and IoT devicesGuest Wi-Fi, cameras, printers and smart devices need a separate zone with tightly limited access.
- Test every boundaryConfirm that forbidden routes really fail and review the rules whenever systems or business processes change.
Common segmentation mistakes
- VLANs without enforcementA VLAN that can still communicate freely with every other VLAN is neat organisation, not an effective security boundary.
- Rules that are never retestedNew services and exceptions create drift. A boundary that worked last year may have quiet holes today.
- Backups left on the production pathIf compromised user credentials can also administer backups, the recovery route remains exposed to the attacker.
- Blocking without observingLog and review denied traffic. It can reveal broken workflows, misconfiguration or attempted lateral movement that needs SOC alert triage.
See segmentation change the outcome
These games turn architecture, firewall and layered-control decisions into visible attack paths.
PRIMARY PRACTICE
PERIMETER CONTROL
DEFENCE DESIGNQuestions people ask
Is network segmentation the same thing as a firewall?+
No. A firewall is one tool that can enforce a boundary between network zones. Segmentation is the wider architectural decision about which systems belong together, which systems must be separated and what traffic may cross between them.
Do small businesses need network segmentation?+
Yes. Even a small office benefits from separating guest Wi-Fi, employee devices, servers, backups and smart devices. Many business routers and managed switches already include the VLAN and firewall features needed for a practical first step.
How is microsegmentation different from regular segmentation?+
Regular segmentation normally separates groups of devices using VLANs, subnets and firewall zones. Microsegmentation applies policy to individual workloads or applications, which provides finer control but requires more planning and maintenance.
Does network segmentation slow down legitimate work?+
Poorly designed rules can. Well-planned segmentation is largely invisible because it permits the communication that business systems genuinely need and blocks connections that should never happen.
What should a business segment first?+
Backup and recovery infrastructure is often the highest-value starting point. Ransomware operators actively look for backups, and isolating them can preserve the organisation's route to recovery.