Log in Request a demo

Glossary

Network Segmentation.

Also called segmentation, network segregation, network separation

In Short

Network segmentation is the practice of splitting a network into separate parts, so that a problem in one part does not spread freely to the others. CISA says proper segmentation can stop an intruder from moving around an internal network. It can be done with physical devices or with virtual separation.

Last updated October 9, 2026
Profile MapGlossary Term
  1. Also Called3other namessegmentation · network segregation · network separation
  2. Related Terms3linked entriesLateral movement · Zero trust · Attack surface

What is network segmentation?

Network segmentation means dividing a network into smaller segments and controlling what can pass between them. CISA recommends separating sensitive information into distinct zones, so that sensitive systems sit apart from everyday user machines.

How does it work?

CISA describes two ways to do it. Physical separation uses traditional devices such as routers. Virtual separation uses private VLANs and virtual routing and forwarding (VRF), which give logical isolation on shared equipment. NSA and CISA also recommend next-generation firewalls, engineering segments to isolate critical systems, and properly configured access control lists, DMZs and, in virtualized environments, micro-segmentation.

CISA advises applying least privilege when designing the segments. In plain terms, a segment should only be reachable by those who have a reason to use it.

A simple illustration: a network where office computers, production systems and critical systems each sit in their own segment, with rules deciding what may talk to what.

Why does it matter?

CISA says proper segmentation is an effective mechanism to prevent an intruder from propagating exploits or moving laterally inside an internal network. NSA and CISA also list lack of network segmentation among the most common misconfigurations, noting it leaves no security boundaries between user, production and critical system networks. Reasoning from this, one compromised machine in a flat network can often reach far more than it should.

How can you check and improve it?

  • Separate user, production and critical system networks.
  • Place firewalls and access control lists between the segments.
  • Use VLANs or other virtual separation where physical separation is not practical.
  • Design each segment with least privilege in mind, and consider host-based firewall rules that deny traffic from other hosts.
  • Monitor and maintain the segments. NSA and CISA say assessment teams found supposedly air-gapped OT networks reachable through forgotten or accidental connections to IT systems.

Is network segmentation the same as zero trust?

No. Segmentation is one technical control. Zero trust is a wider approach to access. The two are often discussed together, but they are not the same thing.

Is network segmentation the same as a firewall?

No. A firewall is one tool used to enforce the rules between segments. Segmentation is the design of the segments themselves.

See also lateral movement, zero trust and attack surface.

Sources

  • CISA: CISA on segmentation: containing intruders, least privilege, physical and virtual separation.
  • CISA: NSA and CISA name lack of network segmentation as a top misconfiguration and recommend firewalls, VLANs and ACLs.

Also Called.

  • Namesegmentation
  • Namenetwork segregation
  • Namenetwork separation

Questions.

  • What is network segmentation?

    Network segmentation means dividing a network into smaller segments and controlling what can pass between them. CISA recommends separating sensitive information into distinct zones, so sensitive systems sit apart from everyday user machines.

  • How does network segmentation work?

    CISA describes two ways. Physical separation uses traditional devices such as routers. Virtual separation uses private VLANs and virtual routing and forwarding (VRF). CISA advises applying least privilege when designing the segments, so each segment is reachable only by those who need it.

  • Why is network segmentation important?

    CISA says proper segmentation is an effective mechanism to prevent an intruder from propagating exploits or moving laterally inside an internal network. NSA and CISA also list lack of segmentation among the most common misconfigurations.

  • Is network segmentation the same as a firewall?

    No. A firewall is one tool used to enforce the rules between segments. Segmentation is the design of the segments themselves, and it is also not the same as zero trust, which is a wider approach to access.

In Our Research

  1. 1 Carding forums and sites explained: how card data is sold October 2026
  2. 2 Agentic Ransomware: What Happens When Malware Doesn’t Need a Human Operator to Decide Who to Hit Next? September 2026
  3. 3 AI Gateway Exploitation: How Attackers Are Targeting LiteLLM, RAGFlow, and Kestra to Steal Your Model Provider Keys August 2026
  4. 4 No Patch Exists Yet: Who Owns the Pre-Disclosure Window? August 2026
  5. 5 Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026
  6. 6 The Executive Cyber Threat: Personal Email, Home Networks, and Family Members as Attack Vectors July 2026

Keep Exploring.

Knowledge Hub
Article From Disclosure To Exploit: How Fast Are Threat Actors Weaponizing New CVEs? The disclosure to exploit window keeps shrinking. See what drives it, how AI and automation help attackers and why early threat intelligence matters. Open Article Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using Vulnerability exploitation trends in H1 2026: how threat actors use zero-day and n-day flaws, which technologies and sectors are hit, and what to fix. Open Glossary term Least Privilege Least privilege is a security principle that gives each user, process or system only the access it needs to do its job, and no more. Open Glossary term Security Misconfiguration Security misconfiguration is a weakness caused by systems, software or cloud services being set up in an unsafe way. Open

Browse The Library.