Most networks are flat in the places that matter. Once an attacker has one machine, they can usually reach thousands of others, because internal traffic was never restricted.
Segmentation limits that. Microsegmentation takes it to the level of individual workloads rather than broad zones.
Why Lateral Movement Is the Whole Problem
Attackers rarely land on the system they want. They land on a laptop or a low value server, then move toward what they are after.
That movement depends on being able to reach things. If the compromised host can open a connection to file servers, domain controllers, databases, and other workstations, movement is easy. If it can reach only what its job requires, movement becomes slow and noisy.
Slow and noisy is the goal. Segmentation rarely stops a determined attacker outright, and it reliably increases the time and the number of attempts, which is what gives detection a chance to work.
Segmentation Versus Microsegmentation
Traditional segmentation splits the network into zones with a firewall between them: corporate, guest, servers, card data. It is coarse and it is genuinely valuable, and most organizations should do this first because it is achievable.
The gap is that traffic inside a zone is unrestricted. A hundred servers in one segment can all talk to each other freely.
Microsegmentation applies policy between individual workloads, so a web server can reach its database on one port and nothing else, including the other web servers beside it.
The Approaches
Host based enforcement uses an agent on each workload to apply policy locally. It follows the workload anywhere, including across cloud providers, and it does not depend on network topology. It requires an agent everywhere, which is a real limitation for appliances and legacy systems.
Hypervisor based enforcement applies policy in the virtual switch, which avoids agents inside guests. It works well in a virtualized data center and does not extend to physical or cloud native workloads.
Network based enforcement uses the switching and routing fabric with VLANs, access lists, or identity tags. It covers everything on the network including devices that cannot run agents, and it is the least granular.
Cloud native enforcement uses security groups and network policies, which are already microsegmentation if they are written tightly. In Kubernetes, the default is that every pod can reach every other pod, and network policies are what fix that.
The Products
Illumio and Akamai Guardicore are the best known host based platforms. VMware NSX is the standard hypervisor based option, and Cisco covers the network based approach.
In Kubernetes, Cilium and Calico are the common enforcement layers. And on a single Linux host, nftables and firewalld already do this if you write the rules.
Visibility Comes First
Nearly every product in this space leads with mapping rather than enforcement, and that is not a sales trick. You cannot write policy for traffic you have never observed.
The first phase is watching: which workloads talk to which, on what ports, how often. That map is valuable on its own, and it routinely surprises people. Undocumented dependencies, test systems talking to production, and connections nobody can explain are standard findings.
Only after the map is trusted does policy get written, and it should run in alert mode before it runs in block mode.
A Rollout That Does Not Cause an Outage
Start with the crown jewels. Put a tight policy around the few systems that matter most rather than trying to segment everything.
Segment by environment first, meaning stop production and development from reaching each other, which is usually easy to justify and easy to define.
Then segment by tier within an application: web to application to database, each allowed only what it needs.
Handle the shared services carefully. Directory services, DNS, patching, monitoring, and backup need to reach nearly everything, and getting these wrong is what causes the outages people remember.
Move in alert mode for weeks before enforcing, and keep a documented and tested way to roll back quickly.
Where It Connects
Microsegmentation is the assume breach half of zero trust. Identity controls who gets in, segmentation controls how far a compromise can spread.
It also pairs with NAC, which is usually the right tool for the unmanaged and IoT devices that cannot run an agent. Putting every camera and printer in a segment that reaches only its management server is one of the highest value moves available.
Learn This at HackRange
Week 9 of the mentorship shows why this matters. An attacker who can reach everything is much harder to catch than one who has to keep trying doors.