An enterprise wants to segment its network so that a compromised application server cannot reach the database directly. What does segmentation actually buy, and what commonly undermines it?

What segmentation buys

Time and constraint on lateral movement. An attacker with a foothold in one segment must find a path to the next, which takes effort, generates activity, and creates detection opportunities. Segmentation rarely prevents a determined attacker; it slows them down and makes them noisy.

It also bounds the blast radius of a non-targeted compromise — a vulnerable component in one segment does not expose everything.

And it provides enforcement points: places where traffic can be inspected, logged and constrained, which is where detection actually happens.

What commonly undermines it

1. Flat internal networks behind a hard perimeter. Once inside, everything is reachable. This is the model segmentation is meant to replace and it persists because it is easier to operate.

2. Overly permissive rules that accumulate. Every rule was added to solve a real problem, nobody can safely delete any because nothing records who depends on them, and the policy grows monotonically until segmentation is nominal. A security control nobody understands is not a security control.

3. Shared services that span segments. Identity, monitoring, backup, configuration management and deployment tooling reach everywhere by design, and each is a path between segments. These are the most valuable targets precisely because they are the exceptions to the segmentation.

4. Credentials that work across segments. Segmentation constrains network reachability, not authorisation. If the same credential works in every segment, an attacker who obtains it moves freely regardless of the network. This is why segmentation without identity-based controls has limited value.

5. Management interfaces on a flat management network, which is frequently the least segmented and most privileged part of the estate.

What makes it effective

• Identity-based rules rather than address-based ones, so policy reads as intent and survives address changes.
• Default deny with explicit allow, expressed as code, reviewed and versioned.
• Flow logs to prove usage, so unused rules can be removed with evidence rather than courage.
• Segment by trust boundary — internet-facing, application, data, management — with fine-grained rules only inside the boundaries that matter. Full per-service micro-segmentation is expensive to maintain and usually unnecessary.
• Egress control, not just ingress. Blocking outbound connections to unknown destinations breaks the exfiltration and command-and-control steps, which is where segmentation delivers its clearest value.

The honest framing

Segmentation is defence in depth, not prevention. It is valuable because it converts a single compromise into a multi-step operation, and each step is an opportunity to detect. Organisations that expect it to prevent compromise are disappointed; those that pair it with detection at the boundaries get most of the value.