What Is Network Segmentation?
Network segmentation divides a network into zones with controlled boundaries, so that a breach in one area cannot spread freely to the rest. It is one of the highest-leverage architectural defenses available: the difference between an incident contained to a single segment and a breach that walks across a flat network touching everything.
Why does segmentation matter so much?#
Because it directly attacks lateral movement — the phase where an intruder spreads from their initial foothold to real targets. On a flat network, one compromised laptop can reach the database, the backups, and the domain controller. Segmentation forces that traffic across boundaries you can filter, log, and block:
| Flat network | Segmented network |
|---|---|
| One breach reaches everything | Breach contained to its zone |
| Lateral movement is invisible | Cross-zone traffic is inspected |
| Blast radius = whole network | Blast radius = one segment |
Common zones include a DMZ for internet-facing services, separate internal tiers, and an isolated management network.
How far should you segment?#
As far as the value justifies. Traditional segmentation uses broad zones; microsegmentation applies policy down to individual workloads, so even neighbors cannot talk without permission — the network expression of zero trust.
Segmentation is how you contain breaches by design. More at the Network Security hub.
Frequently asked questions#
What is network segmentation?
Network segmentation divides a network into separate zones with controlled boundaries between them, so that traffic between zones must pass through — and can be filtered by — a security control. It limits how far an attacker who compromises one part can move, containing breaches instead of letting them spread across a flat network.
What is the difference between segmentation and microsegmentation?
Traditional segmentation splits a network into a handful of broad zones (such as DMZ, internal, and management). Microsegmentation goes much finer, applying policy down to individual workloads or applications, so even devices in the same zone cannot freely talk. Microsegmentation is a key enabler of zero trust.