Microsegmentation

Microsegmentation is a network security method that splits an environment into small, isolated zones. The boundary sits at the level of an individual workload — an application, virtual machine, container or process — and each one gets its own access policy. Traditional segmentation relies on subnets and VLANs. Microsegmentation goes deeper and mainly controls east–west traffic, meaning the communication between systems inside the network. Here the rules are written around workload identity and attributes, not around an IP address or a physical location in the infrastructure.

How does microsegmentation work?

Microsegmentation puts the principle of least privilege (only as much access as is genuinely needed) and the Zero Trust model into practice in the workload-to-workload communication layer. By default it blocks all traffic (deny by default) and lets through only the connections that policy explicitly allows. A rollout usually goes through a few steps:

1. Application dependency mapping — first you gather flow telemetry: which workloads talk to which, on what ports and protocols. From that you build a dependency map. Skip this step and you write rules blind.
2. Policy definition — allowed connections are described through identity and labels (e.g. application role, environment, owner) instead of fixed IP addresses.
3. Enforcement — the rules take effect through host agents, network mechanisms or the cloud’s built-in controls.
4. Monitoring and tuning — you first watch traffic without blocking it (reporting mode), catch the connections that break policy, and gradually tighten the rules until you can switch them to enforcement.

Rules are tied to workload identity. So when an application is moved, scaled or recreated elsewhere, its policies follow it automatically, with no manual re-addressing.

What are the microsegmentation deployment models?

Three core approaches show up in practice. In hybrid environments they are often combined:

• Agent-based (host-based) — an agent runs in the workload’s operating system and programs the local firewall (e.g. iptables/nftables on Linux, or the Windows Filtering Platform). It gives the deepest view into processes and works independently of the network and the cloud. The trade-off is having to deploy and maintain agents.
• Network-based — the infrastructure itself enforces the rules: switches, software-defined networking (SDN), load balancers, internal firewalls. No agents are needed here, but it is harder to push isolation down to a single workload.
• Hypervisor-based and cloud-native — control happens at the hypervisor layer (e.g. distributed virtual firewalls) or through the cloud’s built-in mechanisms, such as security groups and access control lists (NACLs). Convenient in virtualized and cloud environments, but they only work within a given platform.

How does microsegmentation differ from VLANs and traditional firewalls?

Classic network segmentation (VLANs, subnets, perimeter firewalls) mainly watches north–south traffic — between client and server or at the network edge. It drops hosts into broad zones. Inside such a zone, systems usually talk to each other freely, which makes it easier for an attacker to move sideways.

• Level of detail: a VLAN isolates whole subnets. Microsegmentation reaches down to a single workload, or even a specific application or service on a host.
• What the rules are based on: traditional firewalls look at IP addresses and ports. Microsegmentation ties policy to identity and labels, so a change of address does not break the rules.
• Traffic direction: a perimeter firewall guards the boundary, while microsegmentation guards the interior (east–west), where traditional controls see nothing.
• Management scale: writing VLAN/ACL rules by hand for hundreds of applications is unworkable. Microsegmentation draws its rules from the dependency map.

Why does microsegmentation limit lateral movement?

Once an attacker is inside the network (e.g. through phishing, a stolen password or a vulnerability), they try to move sideways — known as lateral movement. They scout the surroundings and abuse protocols such as SMB (port 445), RDP (3389), SSH (22), WinRM or WMI to get from one compromised host to the next. In a flat network where everyone can talk to everyone, that traffic is hard to tell apart from normal system activity.

Microsegmentation shrinks the so-called blast radius — how far the damage can spread after a break-in. Since only the connections written into policy are allowed, an attempt to reach workload B from workload A with no matching rule simply does not go through. The attacker stays boxed into one compromised segment, and the rejected connection itself becomes a lead worth investigating.

What does microsegmentation mean for detection and monitoring?

For a security operations team (SOC, Security Operations Center) and NDR tooling (Network Detection and Response, which spots threats in network traffic), microsegmentation is not just preventive protection. It is also a valuable source of data about the network:

• East–west visibility: dependency mapping and continuous flow logging surface communication that edge monitoring cannot see — including connections to old or forgotten systems.
• A rejected connection as an alert: in a default-deny model, every rejected connection is a clear anomaly signal. A workload is trying something the policy does not anticipate, which can point to network reconnaissance or an attack spreading.
• More context: policy-enforcement logs (identity, label, port, decision) lined up with flow data (NetFlow/IPFIX) and events from a SIEM system make it faster to tell legitimate work from lateral movement.
• Response support: during an incident, policies can be tightened on the fly to isolate an affected workload without touching the rest of the environment.

Microsegmentation and monitoring complement each other. Segmentation limits what is possible in the first place. The telemetry it produces narrows the area you have to watch and makes every alert mean more.

Where is microsegmentation used?

• Environment isolation: separating production from test and development environments so that traffic from less-trusted zones cannot reach production data.
• Regulatory compliance: carving out scopes covered by standards (e.g. PCI DSS, HIPAA, GDPR) and shrinking the area that has to be audited.
• Protecting critical assets: wrapping strict policy around database servers, domain controllers or industrial systems (OT/ICS).
• Cloud and container environments: enforcing policy between microservices, where IP addresses change constantly but workload identity stays the same.

Learn more

• North-South vs East-West Traffic — Microsegmentation mainly controls east-west traffic between internal workloads.
• Zero Trust architecture – the role of network visibility and microsegmentation in security — This page explains how microsegmentation supports Zero Trust by limiting lateral movement.
• Secure Access Service Edge (SASE) — SASE can complement microsegmentation by enforcing security for distributed access.