Managed IT
Most business networks are one big room. The laptop in reception, the security camera in the parking lot, the finance server, the printer nobody has updated since 2019. All of them can reach each other, because nothing was ever set up to stop them. Segmentation is the work of putting walls in that room. This is what it does, where it helps, and the point at which a VLAN stops being a security control.
Nobody decides to run a flat network. It is what you get by default: switches arrive, devices get plugged in, everything works, and the question of what should be able to talk to what never comes up. The network is doing exactly what it was asked to do. It was just never asked to do anything else.
What a flat network actually means
Flat means every device shares one broadcast domain. A laptop in the lobby and the server holding payroll are peers on the same network, and any device can attempt a connection to any other. The Ponemon Institute puts 67% of small and mid-sized businesses as having no network segmentation at all, which makes this the normal state rather than an unusual failure.
That matters because of what attackers do after they get in. Initial access is rarely the interesting part: a phished credential, a compromised vendor laptop, an internet-exposed camera with a default password. What determines whether that becomes an incident or a catastrophe is what the attacker can reach next. CrowdStrike's data has attackers moving from initial access to critical systems in under 24 hours on an unsegmented network, and on a flat network the path is not a technique so much as a straight line.
Lateral movement is the whole game
Segmentation does not stop the first compromise. Nothing at the switch layer will. What it changes is the blast radius: a camera VLAN that can reach the internet and nothing else means a compromised camera is a compromised camera, not a foothold. The value is entirely in what does not happen next.
This is also why segmentation shows up on cyber insurance applications and compliance questionnaires. It is one of the few controls where the benefit is structural rather than behavioral. It keeps working when somebody clicks the link anyway.
You cannot segment what you cannot see
The practical blocker is almost never the VLAN configuration. It is that nobody has a current list of what is connected. Unmanaged switches offer no port-level visibility, which is part of why 82% of network outages in unmanaged environments are discovered by end users rather than by IT, per EMA Research. A device inventory is the prerequisite, and building one usually surfaces two or three things nobody knew were on the network.
The three zones to build first
Where To Start
Segmentation projects stall when they start with a diagram of the ideal end state. Most of the benefit arrives with the first three separations, and each one is defensible on its own if the project stops there.
Start here
Guest: devices you don't own
Internet only · No client isolation exceptions · Separate SSID · Own DHCP scope
The easiest zone to justify and the easiest to build, because nothing in the business depends on it. Guest traffic goes out to the internet and has no route to anything internal. The common mistake is putting guests on a separate wireless SSID and assuming that is segmentation. If both SSIDs land on the same VLAN, you have separated the login and not the network. Worth testing rather than assuming: connect to guest and try to reach an internal address. It either fails or you have found your first project.
This zone also quietly absorbs personal phones and staff tablets, which is where a lot of unmanaged devices live.
Highest return
Devices: cameras, printers, building systems
Outbound rules only · No inbound from user zones · Patch status tracked · Default creds removed
This is the zone that pays for the project. Cameras, badge readers, thermostats, door controllers, printers and whatever the vending machine came with are all full network hosts running software somebody else maintains on a schedule you do not control. Many ship with default credentials, few get firmware updates, and several will outlive the vendor that made them.
None of them need to reach a file server. Putting them in their own zone with tightly scoped outbound rules means a compromised camera stays a compromised camera. The exceptions are worth spending real time on: printers that need to be reachable from user devices, and cameras with an on-premise recorder. Both are solvable with specific rules rather than by giving the whole zone a route inward.
Most scrutiny
Core: servers, finance, anything regulated
Reachable from user zone only · Admin access restricted · Logged · Documented exceptions
The zone with the systems worth protecting, and the one where segmentation gets politically difficult, because tightening it is the first time anyone notices. Access should come from the user zone and management interfaces should be reachable from fewer places still.
Two things make this survivable. Start in monitor mode and watch what actually connects before enforcing anything, because the traffic is almost never what the documentation says it is. And record every exception with a reason and an owner, because exceptions granted in a hurry and never revisited are how a segmented network drifts back toward flat.
Why this order
Guest first because it is low-risk and proves the mechanism works. Devices second because that is where the return is highest relative to effort. Core last because it needs the most observation before enforcement, and by then the team has done it twice.
Where a VLAN stops being a security control
VLANs get described as though the separation is the security. It is closer to say a VLAN creates a boundary and something else has to decide what crosses it. Several environments have segmentation on the diagram and none of it in practice, for reasons that are worth knowing before you start.
Inter-VLAN routing without rules
The most common one. VLANs are created, a layer 3 switch or firewall routes between them so everything keeps working, and no access control lists are ever applied. Traffic now takes one extra hop and reaches exactly what it reached before. The network is segmented in the configuration and flat in behavior. If nobody can tell you which rules govern traffic between two VLANs, assume there are none.
Trunk ports and the access layer
A VLAN is only a boundary if a device cannot simply place itself in another one. That means access ports assigned to a single VLAN, unused ports shut down rather than left live in the default VLAN, and trunk ports carrying only the VLANs they need. A live wall port in a public area that trunks everything is a segmentation problem with a physical solution.
Wireless that lands in the wrong place
Covered above but worth stating separately, because it is so common: separate SSIDs are not separate networks unless they map to separate VLANs. This is a five-minute test and it fails more often than people expect.
Segmentation drifts
A network segmented well in 2022 is not necessarily segmented now. New devices get plugged into whatever port was free, an integration needs a temporary rule that becomes permanent, a project adds a route that outlives it. This is the same drift that produces firewall rule sprawl, and it responds to the same treatment: a scheduled review that asks what each exception is still for, with removals recorded. A review that never removes anything is difficult to distinguish from no review at all.
What it is reasonable to expect
Done properly, segmentation contains lateral movement, shrinks what has to be investigated after an incident, makes network problems faster to isolate, and answers a question that appears on nearly every insurance application and compliance questionnaire. It will not prevent a breach, and any description that suggests otherwise is selling something. Containment is the point.
Network Readiness Checklist
The Checklist
Fifteen questions across segmentation, visibility, hardware age and documentation. Tick the ones you can answer without going and asking someone, and the score updates as you go. Use it yourself or share it with your team.
Tick what you can answer without checking. The blanks are the gaps.
Segmentation Design
How many VLANs are in use, and what is each one for?
A count is easy. A purpose for each is the question that finds the ones nobody remembers creating.
Can a guest device reach an internal address right now?
A five-minute test. Separate SSIDs are not separate networks unless they map to separate VLANs.
Are cameras, printers and building systems on their own zone?
Equipment running software you don't patch, on a schedule you don't control.
What rules govern traffic between VLANs?
If nobody can name them, routing is probably passing everything and segmentation exists only on the diagram.
Traffic Visibility
Do you know what is plugged into every port?
Unmanaged switches offer no port-level view, so rogue devices simply do not appear anywhere.
Are unused ports shut down or live in the default VLAN?
A live wall port in a public area is a segmentation problem with a physical fix.
Would a new unauthorized device on the network generate an alert?
Or would it just work, quietly, until somebody happened to look?
Who finds out first when a link fails, IT or the users?
EMA puts 82% of outages in unmanaged environments as user-reported. Most teams guess wrong on this one.
Switch Age & Support
How old is the oldest switch still carrying production traffic?
Usually in a closet at a branch office, usually older than whoever answers.
Are any switches past vendor end-of-support?
They keep forwarding packets perfectly while no longer receiving security fixes at all.
Do all sites run switches capable of VLANs and monitoring?
One consumer-grade switch at a small site sets the ceiling for the whole design.
When was switch firmware last updated?
A date. Switch firmware is deferred even more reliably than firewall firmware, because nothing prompts it.
Network Documentation
Is there a current network diagram, and when was it last accurate?
Most diagrams describe the network as designed rather than the one running today.
Are switch configurations backed up somewhere you could restore from?
Replacing a failed switch is quick. Rebuilding its config from memory is not.
Could somebody outside your team pick this up tomorrow?
If the network only makes sense to one person, that is a single point of failure with a commute.
Frequently asked questions
Network segmentation is the practice of dividing one network into separate zones so that devices in one zone cannot freely reach devices in another. On a flat network every device shares a single broadcast domain, which means a laptop in the lobby and the server holding payroll are peers and either can attempt a connection to the other. Segmentation puts boundaries between those groups and decides deliberately what is allowed to cross. It is a containment control rather than a prevention control.
It does not stop the initial compromise, and nothing at the switch layer will. What it changes is what an attacker can reach afterwards. On a flat network the path from a compromised device to critical systems is a straight line, and CrowdStrike's data has attackers covering it in under 24 hours. When a camera sits in a zone that can reach the internet and nothing else, a compromised camera stays a compromised camera instead of becoming a foothold. The value is entirely in what does not happen next.
Three separations deliver most of the benefit. Guest first, covering visitors, contractors and personal phones, which get internet access and no internal route. Devices second, covering cameras, printers, badge readers and building systems that need a network connection but never need a file server. Core last, covering servers, finance and anything regulated. Guest is low-risk and proves the mechanism works, devices returns the most for the effort involved, and core needs the most observation before anything is enforced.
Only if the guest SSID maps to its own VLAN. A separate SSID with its own password that lands on the same VLAN as everything else has separated the login and not the network, and this is one of the more common gaps in otherwise reasonable setups. It takes about five minutes to check: connect a device to the guest network and try to reach an internal address. It either fails, or you have found your first segmentation project.
Yes, and it happens often. VLANs get created, a layer 3 switch or firewall routes between them so that everything keeps working, and no access control lists are ever applied to that routing. Traffic then takes one extra hop and reaches exactly what it reached before. The network is segmented in the configuration and flat in behavior. If nobody can tell you which rules govern traffic between two VLANs, it is safe to assume there are none.
This is usually the zone with the highest return. Cameras, badge readers, thermostats, door controllers and printers are full network hosts running software somebody else maintains on a schedule you do not control. Many ship with default credentials, few receive firmware updates, and some will outlive the vendor that built them. None of them need to reach a file server. Genuine exceptions such as a printer reachable from user devices are better solved with specific rules than by giving the whole zone a route inward.
Often enough that it does not drift, which for most organizations means a scheduled review rather than one triggered by an audit. Segmentation degrades quietly: new devices get plugged into whatever port was free, an integration needs a temporary rule that becomes permanent, a project adds a route that outlives it. The review should ask what each exception is still for and record what was removed, since a review that never removes anything is difficult to distinguish from no review at all.
No. An unmanaged switch forwards traffic between whatever is plugged into it, with no VLAN support, no port-level visibility and no way to apply policy. That also means no view of what is connected, which is part of why EMA Research finds 82% of outages in unmanaged environments are discovered by end users rather than by IT. A single consumer-grade switch at a small site sets the ceiling for the whole design, so an inventory of what the existing hardware can actually do usually comes before any segmentation planning.
Not sure how flat your network is?
Get a free network assessment. We'll inventory what's connected, test whether the zones you think exist actually hold, and show you where the boundaries should go.
