Segmentation tends to be owned by the network team, budgeted as a networking project and justified on performance grounds. It is more usefully understood as a security control — arguably the highest-leverage one most organizations have not fully implemented.
Why flat networks fail badly
In an unsegmented environment, any compromised device can reach any other. That converts a single infected endpoint into access to the server estate, the backup infrastructure, the building management system and the surveillance network.
This is precisely the movement phase that determines ransomware severity. Segmentation does not prevent initial compromise. It changes the outcome from an enterprise incident to a contained one, which is the difference that matters operationally.
A pragmatic sequence
Full micro-segmentation is a large programme and a common reason nothing gets done. A staged approach delivers most of the benefit early.
Start by separating the classes of device that have no business reaching each other: user endpoints, servers, and operational or embedded systems. Cameras, access controllers, building management, printers and point-of-sale hardware belong in their own segments — they are rarely patched, frequently run default credentials, and are a favoured foothold.
Then isolate the backup infrastructure and restrict management interfaces to a dedicated administrative path. Those two steps alone remove the most damaging pivots.
Then separate server tiers from each other, so a compromised web tier does not have open access to the database tier.
What makes it stick
Documented intent. A segmentation design without a written policy of what should communicate with what will erode within a year, because every exception request looks reasonable in isolation.
Default deny between segments, with explicit permits. The reverse — permit with explicit denies — degrades into a flat network wearing a VLAN structure.
Periodic review of the permit set. Rules added for a migration that finished eighteen months ago are still there, and each one is a path.
The work is unglamorous and mostly configuration rather than capital. It is also the control most likely to determine how bad the next incident is.