What Is Microsegmentation?
Microsegmentation applies security policy at the finest grain — down to individual workloads — rather than to broad network zones. Where traditional segmentation draws a few big boundaries, microsegmentation isolates each workload so that even two servers on the same segment cannot communicate unless explicitly permitted. It is one of the strongest counters to lateral movement and a pillar of zero trust.
How is it different from traditional segmentation?#
| Traditional segmentation | Microsegmentation | |
|---|---|---|
| Granularity | A few broad zones | Per-workload / per-app |
| Same-zone traffic | Usually unrestricted | Restricted by default |
| Lateral movement | Contained between zones | Contained between workloads |
| Model | Perimeter-ish | Zero trust |
The key difference is what happens inside a zone. In a traditional design, once an attacker is in a segment, they can often reach everything in it. Microsegmentation removes that free movement: every connection between workloads is a policy decision.
Why it enables zero trust#
Zero trust says “never trust, always verify” — including on the internal network. Microsegmentation is how that principle becomes real at the network layer: by default, workloads cannot talk, and each allowed path is explicit, minimal, and logged. An attacker who compromises one workload finds it can reach almost nothing else without crossing a boundary you control.
Microsegmentation is segmentation taken to the workload level. More at the Defense & Hardening hub.
Frequently asked questions#
What is microsegmentation?
Microsegmentation is a fine-grained approach to network segmentation that applies security policy down to individual workloads or applications, rather than broad network zones. Each workload can be restricted to communicate only with the specific others it needs, so even systems on the same network segment cannot talk freely — sharply limiting lateral movement.
How does microsegmentation differ from traditional segmentation?
Traditional segmentation divides a network into a handful of broad zones (like DMZ, internal, and management). Microsegmentation goes far finer, enforcing per-workload policies so that even two servers in the same zone are isolated unless explicitly allowed to communicate. It is a key enabler of zero-trust networking.