Network Segmentation: How Far Can an Attacker Get After That One Infected Laptop?
Network Segmentation: How Far Can an Attacker Get After That One Infected Laptop?
An employee clicks on a link, and his laptop becomes infected. From that moment on, one thing determines how big the problem will become: what that laptop can access. In most networks, the answer is virtually everything, because workstations, file servers, printers, and management ports are all in the same zone. That’s how it evolved over time, and since then, there has never been a quiet moment to reconfigure it differently.
Network segmentation is the answer to that problem, though it’s rarely presented that way. Search for it, and you’ll find articles about VLANs, subnets, access control lists, and a six- or seven-step implementation. All of that is correct, and it turns it into a design question. Design questions end up on the IT department’s to-do pile and stay there because they compete with work that needs to be done today.
There’s another way to approach this. Start by asking how far someone gets after that first step. Then segmentation becomes a matter of distance. That’s a question a CEO can ask without understanding a single VLAN. In this blog, you’ll learn what network segmentation is, how it differs from microsegmentation, how to implement it without shutting down production, and how to verify that it’s working.
What is network segmentation?
Network segmentation is the division of a network into separate zones, such that traffic between those zones is allowed only if a rule permits it. Without segmentation, any device can reach any other device.
Traditionally, this is done using VLANs and subnets, with a firewall or access lists at the boundaries. For example, you create a separate zone for workstations, one for servers, and one for managing your network equipment. Traffic within a zone flows freely, while traffic between zones is subject to a rule.
Segmentation doesn’t keep anyone out. That first step comes via a phishing email, a vulnerable system connected to the internet, or a stolen password. A network zone is separate from that. What determines segmentation is what that first step results in: access to a single zone or access to the entire network.
What is lateral movement in a network?
Lateral movement is the step in which an attacker moves from the first infected system to other systems on the same network. That infected laptop is rarely the target; it is the starting point. The stored passwords, mapped network drives, and active sessions on that laptop determine the next step.
CrowdStrike measures how long that step takes and refers to it as “breakout time”: the time between initial access and the first move to another system. In the Global Threat Report dated February 24, 2026, the average breakout time for 2025 was 29 minutes. The fastest observed breakout time was 27 seconds.
Compare that to your own response time. A notification has to come in, someone has to review it, someone has to decide what to do, and then something has to be shut down or disconnected. In most organizations, that takes longer than 29 minutes—even when the system is well-organized, and certainly outside of business hours.
Horizon3 explains why this won’t get better on its own. AI is changing how vulnerabilities are discovered. It doesn’t change how breaches happen: there will always be another vulnerability and another way in. The distance someone can travel after that first step is therefore the part of the problem you can address in advance.
What is the difference between network segmentation and microsegmentation?
The difference lies in the size of the unit you’re isolating. Network segmentation works with zones that contain multiple devices. Microsegmentation treats the device itself as the unit.
Traditional segmentation: zones based on VLANs and subnets
You divide the network into a handful of zones and set rules for the transitions between them. Within a zone, everything remains interconnected. This means that an infection in the workstation zone can still reach every other workstation in that same zone.
This works with the equipment you already have, and it’s a familiar technique for any network administrator. The problem lies in practice: any exception that can’t be resolved immediately is resolved by making the zone slightly larger. After a few years, there are more devices connected than were intended in the original design.
Microsegmentation: a separate segment for each device
Each device is assigned its own segment and a list of what it is allowed to access. A pump communicates with its control system and no one else. A printer accepts print jobs and has no reason whatsoever to access a file server.
An infected device therefore has access only to what it needs during normal use. The attacker may be inside the system, but he cannot go any further than that single device allows.
For most organizations, this isn’t a choice between two options. Zones provide a broad classification, while microsegmentation offers a more granular one. You can start with zones and then isolate the devices that have the greatest impact.
What is Zero Trust, and how does segmentation fit into it?
Zero Trust is based on the principle that a user or device is not granted access privileges based on their location. Whether someone is at the office or at home, every access request is evaluated individually.
The older model was based on an external boundary: you were considered trusted within the network and not outside of it. That worked as long as everything was located in a single place. With remote work, cloud services, and suppliers remotely accessing the network using their own equipment, that boundary can no longer be clearly defined.
Segmentation is the aspect of Zero Trust that takes place within the network itself. Without segmentation, the basic principle remains just a rule on paper: you verify who is coming in, and after that, that device can still access everything. Microsegmentation makes the rule enforceable, because it defines exactly what each device is allowed to do.
In addition, there is ZTNA, which stands for Zero Trust Network Access. It applies the same principle to external access: a user connects only to the one application they need. With a traditional VPN, they gain access to the entire network. In that context, segmentation is the foundation of Zero Trust, and ZTNA is the component that sits on the outside.
How do you implement microsegmentation without halting production?
Two concerns prevent most organizations from doing this. Both are valid. You can’t install software on a pump, a PLC, or a camera because the device isn’t designed for it, and the vendor often doesn’t allow it. Additionally, you can’t shut down production to reconfigure the network.
An agentless approach eliminates the first concern. Segmentation is enforced at the network level, so no software is installed on the device and no additional hardware is required. As far as the device itself is concerned, nothing changes in how it operates.
You can resolve the second objection by addressing the order. You start by figuring out what’s there and who it’s communicating with. That assessment is a step in itself and comes before everything else, because a rule for a device that no one has identified will never be established. Our blog post explains how to do that in an environment with equipment that can’t be scanned: Assessing OT Security.
Next, set the rules to “view-only” mode. The system records what normally crosses the line and shows which traffic it would block. This way, before closing the road, you can see which traffic would be affected, including traffic that nobody knew was there. Only once that picture is accurate should you activate enforcement.
This breaks the rollout down into a series of small steps. You start with one group of devices, make sure everything keeps running, and then move on to the next group. There’s no need for a maintenance window, and there’s never a moment when the entire network goes down at once.
Which devices will be the first to get their own segment?
The order is determined by two characteristics of the device: how far it can reach and what other measurements it can take. A device that can reach far and for which no other measurements apply is listed at the top.
- Devices that you can’t install software on. Pumps, PLCs, cameras, building management systems, and medical equipment. Endpoint protection doesn’t work on these devices, and patches can often only be applied during a scheduled shutdown. Segmentation is therefore the only measure left.
- Systems that communicate with many other systems. File servers, management servers, and backup environments. By definition, they’re connected to everything, so anyone who gains access to them has the widest reach of all.
- Everything a supplier focuses on. Maintenance access points are almost always wider than necessary because they were designed for situations where something needed to be fixed quickly.
- Workplaces for people with broad rights. Administrators and application administrators have the passwords that an attacker is looking for. An infection there immediately skips a few steps.
- Devices that no one can install. An inventory always reveals a residual category of equipment that communicates but that no one can identify. As long as you don’t know what it is, you also don’t know what it’s allowed to do.
This is the same approach used for vulnerabilities, where you first filter based on what is actually accessible before assessing the technical severity. You can read about how this works in the blog post on Which vulnerability do you address first?.
How do you check whether your network segmentation is working?
A segment you’ve created but never tested is an assumption. That’s a practical consideration, because segmentation tends to drift over time. A new vendor joins and needs access. A rule is relaxed for a project that was supposed to last three months. Additional equipment is added and ends up in the default zone simply because that was the quickest option. Each step is justifiable on its own, and together they restore the zone to its original size.
Checking the configuration helps only to a limited extent, because it shows what was intended. Whether it actually works that way only becomes clear when someone tries it from a workstation.
That’s what an autonomous penetration test does. You deploy it on a workstation as if there were an infection there and see how far it gets: which systems it can access, which login credentials it picks up along the way, and where it ultimately ends up. What you get back are the paths that are currently open. How that works is explained in From 8 hours to 10 minutes: Why Your Next Penetration Tester Will Be an AI.
This turns verification into a recurring process. You identify what could go wrong, fix the top-priority issues, and then verify that the path to failure has actually been eliminated. Without that third step, you only know that something has been changed.
The logical time to retest is after every change that affects the network. If not much changes on your end, a regular quarterly check is enough to see if the data is still accurate.
Where do you start with network segmentation?
Segmentation starts with knowing what’s there. As long as some of your devices aren’t accounted for, you’re writing rules for devices whose normal behavior you don’t know. Every rule is then a guess.
Next comes the order. Start with the equipment that cannot be controlled by any other measure and with the systems that are connected to everything else. First, set the rules to “view-only” mode so you can see what traffic would be affected before you block anything. Then, enable enforcement on a per-group basis.
The third step is the one that’s most often overlooked. After the initial infection, an attacker takes an average of 29 minutes to move on to the next system. So the security measures you’ve put in place need to work when the time comes. You won’t know if they do until someone has tried to break through.
Want to know how far someone in your network can reach from a single workstation? You can test that.
Go to netboss.nl
