Our use of cookies 
What is network segmentation and how does it work?
Network segmentation is the practice of dividing a network into smaller, isolated subnetworks with controlled boundaries between them.
It is one of the most effective controls to contain threats, isolate traffic, and give administrators a structured environment to manage.
This guide covers what it is, why it matters, the main types, how it works, common business examples and the best practices behind it.
Contents:
- What is network segmentation?
- Why is network segmentation important?
- Types of network segmentation
- How network segmentation works
- How businesses use network segmentation
- Network segmentation best practices
What is network segmentation?
Network segmentation is the practice of dividing a network into smaller, isolated subnetworks with controlled boundaries between them.
The split is rarely just physical or geographical. Segments can be created through software rather than physical separation, can cover office and cloud environments, and can be applied to different users, devices or applications across the network.
Common applications of segmentation include isolating guest WiFi from internal systems, isolating a network of IoT devices, or ring-fencing a payment system.
It is an essential discipline for any network architect or administrator, underpinning the security posture, performance and manageability of the network it sits within.
Why is network segmentation important?
Segmenting a flat network at various layers of the stack delivers meaningful gains across security, performance, resilience and day-to-day manageability.
Security
Segmentation introduces physical and logical control points across the network, and with them, tangible security outcomes for the business:
- Ransomware and malware containment: Boundaries limit how far malicious code can move once inside the environment. Segmentation does not prevent initial compromise, but it significantly reduces the blast radius.
- Insider threats: Controlled zones limit what any single user or device can reach, reducing the risk of deliberate or accidental misuse from within an organisation.
- Protection of critical systems: High-value assets such as business data backups, domain services, privileged access management (PAM) interfaces, finance systems and cloud management paths are isolated from general traffic and unreachable by default.
- Compliance posture: Under GDPR, organisations must implement appropriate technical and organisational measures to protect personal data, and network segmentation can be one appropriate control depending on the risk.
- Zero trust enablement: Segmentation underpins zero trust architecture, replacing implicit internal trust with explicit, policy-driven access controls enforced at the network level.
Performance
Segmentation introduces dedicated traffic boundaries, and with them, more consistent performance for critical and real-time applications:
- Traffic isolation: Each segment can contain its own broadcast domain, keeping irrelevant traffic away from systems that do not need to see it. A CCTV system or busy guest network can be isolated from critical services.
- Quality of service: QoS policies can be applied per subnetwork, ensuring latency-sensitive applications such as business VoIP phone systems, video conferencing and cloud services receive consistent priority regardless of wider network activity.
Resilience
Segmentation contains failures within defined boundaries, and with them, keeps the wider network running when something goes wrong:
- Fault containment: A broadcast storm, misconfigured device or rogue DHCP server affects only its own segment, rather than degrading the entire network.
- Failure isolation: An outage on a guest, IoT or non-critical segment does not propagate to production systems, so the business continues to operate on what matters most.
- Safer change management: Upgrades, patching and maintenance can be carried out segment by segment, reducing the need for full-network outage windows.
- Business continuity: Critical segments such as finance, voice and core line-of-business systems remain available even when other parts of the network are degraded or offline.
Manageability
Segmentation creates a structured network architecture, and with it, an environment that is significantly easier to operate, maintain and grow:
- Monitoring and visibility: Each segment has a defined scope, making it easier to observe traffic patterns, identify anomalies and trace issues back to their source.
- Troubleshooting: Faults and performance issues can be isolated to a specific segment, reducing the time needed to diagnose and resolve them. An administrator does not need to comb through the entire network to find a misbehaving business broadband router or faulty full fibre business broadband connection.
- Access control: Permissions and policies are applied at the segment level, reducing the complexity of managing access across a flat environment. Offboarding a contractor, for example, means removing access from one defined segment rather than auditing the whole network.
- Scalability: A new office, team or device type slots into its own segment without touching the rest of the architecture, making growth a contained and predictable operation rather than a disruptive one.
Types of network segmentation
Network segmentation isn’t a single technology but a combination of methods deployed across different layers and scales.
Most real-world segmentation strategies layer several of the following types together, with each handling a different part of the problem:
VLAN-based segmentation
Virtual Local Area Networks (VLANs) separate traffic at the switch level by grouping devices into distinct broadcast domains, regardless of physical location.
Effective for organising traffic within a local area network, but only security-relevant when paired with controlled routing and firewall rules at segment boundaries. They are extendable across a wide area network through technologies like VXLAN.
Firewall-based segmentation
Firewalls sit between zones to allow, deny, log or inspect traffic crossing segmented network boundaries.
Types of firewalls include physical appliances on a LAN, virtual firewalls in cloud environments, and web application firewalls inspecting at the app layer. Modern Next-Generation Firewalls (NGFWs) extend this further with deep packet inspection, intrusion prevention, application awareness and identity security controls.
ACL-based segmentation
Access Control Lists (ACLs) are rule sets applied at the router or switch level to permit or deny traffic into a network based on IP address, port or protocol. This method is simpler than a full firewall, making them a common first layer in smaller environments or a complement to more advanced controls.
WAN segmentation
Segmentation across multiple sites, regions or countries through technologies like MPLS, VPNs, private Business Ethernet circuits, and site-to-site tunnels.
Business SD-WAN solutions are the modern approach, applying policy-based separation that routes different traffic types through different paths based on application, identity or security requirements.
Cloud segmentation
Segmentation within public cloud environments using cloud-native tooling such as virtual networks, subnets, security groups and Network Access Control Lists (NACLs)
Mirrors on-premises segmentation principles but is enforced through the cloud provider’s infrastructure rather than physical hardware.
OT/ICS segmentation
OT/ICS segmentation isolates Operational Technology and Industrial Control Systems (the systems running factory machinery, power grids and similar physical infrastructure) from standard IT.
This involves physical separation or air-gapping, as a breach crossing this boundary can have real-world physical consequences beyond data loss.
Microsegmentation
Microsegmentation is the most granular method of network segmentation, applying controls at the individual workload, service or identity level.
Policy travels with the workload regardless of where it sits physically, making it particularly effective in virtualised, containerised and cloud environments. It is identity and application-aware rather than purely an aspect of network topology.
Zero trust segmentation
A security policy model that intrinsically requires network segmentation. Access is granted based on continuous verification of identity, device posture and behaviour, regardless of whether the request originates inside or outside the network.
It contrasts with traditional perimeter-based segmentation, where everything inside the boundary (e.g., a firewall) is trusted by default.
How network segmentation works
Regardless of the architecture, method or environment, network segmentation follows the same underlying logic.
A network is divided into zones, access to those zones is controlled, traffic within them flows freely, and boundaries enforce what can cross between them.
Here is how that works in practice:
1. Defining the zones
Before any segmentation can be enforced, the network must be mapped into distinct zones based on function, risk level, user type or device type. This is the design step, and it is the most important one, as segmentation is only as effective as the thinking behind it.
Typical zone definitions include:
- Function-based zones: Grouping devices and systems by what they do, such as separating finance systems, HR applications and general staff devices into distinct segments.
- Risk-based zones: Separating high-value or sensitive assets (backups, domain controllers, payment systems) from lower-risk general traffic.
- User-based zones: Defining segments by who accesses them, such as staff, contractors, guests or administrators.
- Device-based zones: Isolating device types that carry different risk profiles, such as IoT sensors, CCTV systems or OT infrastructure, from the core network.
2. Controlling access
Once zones are defined, access controls determine which users, devices and applications can enter each one. This is the first enforcement point in a segmented network.
- Authentication: Users and devices are verified against credentials, certificates, multi-factor authentication checks or an identity provider before being granted entry to a segment, particularly in zero trust or identity-aware designs.
- Device posture assessment: Access controls evaluate whether a device meets defined security requirements, such as patch level, disk encryption or endpoint protection, before granting entry.
- Role-based access: Users are placed into segments based on their role, location or identity, ensuring they can only reach what they need.
- Physical access controls: In physically segmented environments, access is restricted at the hardware level through dedicated switch ports, interfaces or cabling.
3. Permitting traffic inside the zone
Once inside a subnetwork, communication between endpoints is typically more direct, which is what makes segmentation a performance tool as well as a security one.
Zero trust and identity-aware designs may still re-verify identity or device posture for individual requests within the segment, but the segment itself becomes a trusted operating area.
- Broadcast containment: Because broadcast traffic is contained within the segment, internal communication stays efficient even as the wider network scales.
- Local policy enforcement: Segment-specific rules can govern how devices within the zone communicate, adding a further layer of control without impacting other segments.
4. Enforcing boundaries
When traffic is destined outside the subnetwork, it hits an enforcement point where the network evaluates whether that traffic is permitted to cross. If it matches a permitted rule, it is allowed through; if not, it is blocked. The main boundary enforcement mechanisms are:
- Firewalls and ACLs: Allow, block, log or inspect traffic crossing between zones.
- Layer-3 (IP) switching and inter-VLAN routing: Route or restrict traffic between segments at the network layer, often with ACLs applied at the switch.
- SD-WAN policies: Separate and prioritise traffic between sites, extending segmentation across the WAN.
- Zero trust policy engines: Evaluate every request against identity, device posture and context before permitting access.
- Quality of service: QoS policies can be applied per subnetwork to prioritise latency-sensitive applications such as voice and video.
How businesses use network segmentation
The following examples illustrate how network segmentation is applied in real business environments through combining various technologies and policies:
Guest WiFi
Guest devices are placed on a dedicated wireless segment, kept entirely separate from corporate systems, internal servers and staff devices.
Visitors get internet access without ever touching the production network, and a compromised guest device has nowhere to pivot to.
This is usually the first segment a business implements, as unmanaged devices sitting on the same network as company data are a risk.
VoIP phone systems
Voice traffic is isolated on its own segment with QoS policies applied locally and across sites, supporting consistent VoIP call quality even when other network activity is high.
Separating voice from data also makes troubleshooting call quality issues considerably easier, as voice traffic can be observed and measured without the noise of general LAN activity.
CCTV and IoT devices
Cameras, sensors and smart devices are isolated from the core IT network, limiting the risk of a compromised device reaching business-critical systems.
IoT devices are notoriously difficult to patch and frequently ship with weak default security, so containing them in their own segment with restricted outbound rules is the realistic way to manage that risk without removing the devices themselves.
Finance and POS systems
Payment and financial systems are placed in a tightly controlled segment across all sites, supporting PCI-DSS compliance and limiting exposure of sensitive data whether traffic stays local or crosses the WAN. Access is typically restricted to specific users and devices, and traffic in and out of the segment is inspected and logged.
For multi-site businesses, the same segment is extended across the wide area network so that finance traffic is treated consistently wherever it originates.
Domain controllers and Active Directory
Identity and authentication infrastructure is isolated from general traffic locally and across sites, protecting the systems that govern access to the entire network.
A compromise of a domain controller is effectively a compromise of everything that depends on it, so this segment is usually one of the most tightly controlled in the environment, with strict rules on which systems and administrators can reach it and from where.
OT and industrial systems
Operational technology such as PLCs (Programmable Logic Controllers), building management systems and manufacturing equipment is separated from the IT network, containing the impact of a compromise and preventing IT-side changes from disrupting production.
OT systems often run on legacy protocols and cannot be patched on the same cadence as IT systems, which makes segmentation less of a best practice and more of a baseline requirement in any environment where they are in use.
Network segmentation best practices
Successful network segmentation comes down to thorough preparation, careful deployment and disciplined maintenance. The practices below cover each stage of that lifecycle.
- Start with discovery: Inventory every device, system, user, cloud service, admin path and traffic flow on the network before designing any subnetworks. Segmentation is only as good as the picture of what it is segmenting.
- Map dependencies: DNS, authentication services, printers, business VoIP phone systems, VPNs, line-of-business software and cloud services all have traffic dependencies that segmentation can inadvertently break. Mapping these in advance prevents disruption later.
- Classify systems by risk and business role: Not all systems carry the same risk or serve the same function. Classifying assets by sensitivity and criticality informs which segments are needed and how tightly each should be controlled.
- Phase the rollout: Start with simpler separations such as guest WiFi, IoT, CCTV, VoIP, backups and management interfaces. Once these are stable, move on to higher-sensitivity areas such as finance, domain services, cloud workloads and administrative controls, which require more careful design.
- Default to allow-list rules: Permitting only the traffic that is explicitly required is more secure and easier to audit than trying to block every unwanted path. Every rule should be deliberate and documented.
- Test, then enforce, with a rollback ready: Apply rules in a monitoring or simulated mode first to confirm required traffic still flows, and keep a clear rollback plan for every change so the network can be restored quickly if something breaks.
- Monitor cross-segment traffic: Visibility between zones is essential for detecting anomalies, confirming rules are working as intended and catching unexpected communication early. Network monitoring tools should be configured to report on inter-segment activity, not just internet-facing traffic.
- Avoid over-segmentation: Too many zones create management complexity and operational risk without proportionate security gain. The design should be as simple as the risk profile allows.
Network segmentation FAQs
Our business networking experts answer commonly asked questions regarding network segmentation in businesses.
Can network segmentation stop ransomware from reaching backups?
Yes, when implemented correctly. Modern ransomware actively hunts for backup repositories, knowing that intact backups remove the incentive to pay.
Placing backups in their own tightly controlled network zone, and using offline, immutable or otherwise isolated backup controls where appropriate, makes it much harder for compromised endpoints to reach or destroy them.
Should printers be on a separate network segment?
Yes, particularly in larger environments. Printers run full operating systems, cache documents, often hold cached credentials for scan-to-email or directory services, and rarely receive timely firmware updates, making them a common foothold for lateral movement.
A dedicated VLAN with allow-list rules covering only print and management traffic limits this exposure.
Does GDPR require network segmentation?
Not explicitly, but it is a reasonable expectation in practice. Article 32 requires “appropriate technical and organisational measures” proportionate to the risk, and the ICO’s guidance points to access control, limiting data exposure and resilience against attack.
Segmentation supports all three, and its absence can be difficult to defend following a breach involving personal data, particularly for larger organisations or those handling sensitive categories.
Find out more in our guide to GDPR rules for business cybersecurity.
Back to blog
