In short
Network segmentation vs microsegmentation is a matter of granularity. Network segmentation divides the network into zones (VLANs, subnets, firewall zones) so traffic between zones can be controlled. Microsegmentation applies least-privilege rules to each host or workload, so even machines in the same zone can only talk to what they need. ZTNA controls user-to-app access; segmentation limits lateral movement.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
Definitions
Network segmentation divides a network into separate zones, usually with VLANs and IP subnets, and puts a firewall or access control lists at the boundaries. Staff devices, servers, guests, printers and OT equipment each get their own zone, and rules decide what crosses between them.
Microsegmentation pushes the boundary down to the individual machine or workload. Each server or workstation gets its own least-privilege rules, typically enforced by the host's own firewall, an agent, or the cloud platform's security groups, so a device can only reach the specific systems and ports it genuinely uses. Two servers on the same subnet cannot talk to each other unless a rule says so.
Segmentation and microsegmentation compared
| Network segmentation | Microsegmentation | |
|---|---|---|
| Unit of control | Zone, VLAN or subnet | Individual host, workload or identity |
| Where it is enforced | Firewalls, routers and switch ACLs at zone boundaries | Host firewalls, agents, cloud security groups, or switch ACLs per device |
| Traffic it controls | Mostly north-south and between zones | East-west, including within a zone |
| Rule basis | IP ranges and ports | Observed traffic, workload labels, user and service identity |
| Inside a segment | Devices can usually talk freely | Only what policy allows |
| Effort to build | Network redesign, readdressing and cabling or VLAN changes | Rule discovery and change management; little or no readdressing |
| Stops | Spread between zones (for example user VLAN to OT) | Spread between machines (for example workstation to workstation over SMB or RDP) |
They are not alternatives. Most organisations need sensible zones and finer rules inside the zones that matter most.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
Microsegmentation vs VLAN
A VLAN is a layer 2 broadcast domain. On its own it isolates nothing between VLANs unless the traffic is forced through a firewall or ACL when it is routed, and it does nothing at all to traffic between devices on the same VLAN. That is why ransomware so often spreads across a flat user VLAN: every workstation can reach every other workstation's file sharing and remote management ports.
Microsegmentation closes that gap without carving the network into hundreds of tiny VLANs. Each workstation's host firewall can be told to refuse inbound SMB, RDP or WinRM from other workstations, while still allowing the management servers that genuinely need it.
Microsegmentation vs zero trust
Microsegmentation is one technique that supports a zero trust architecture; it is not the same thing. Zero trust is the overall approach of verifying every request explicitly and trusting no network by default. The NCSC's design principles include "Don't trust any network, including your own", and its ZTNA guidance makes Limit the impact of compromise one of eight design requirements. That requirement explicitly calls for network segmentation, grouping applications by risk or business criticality, treats large, flat networks without segmentation as an anti-pattern, and reminds readers that ZTNA does not remove the need for local controls such as firewalls and access control lists (NCSC: How to implement ZTNA).
So the relationship is:
- ZTNA controls which users reach which applications, from anywhere.
- Network segmentation limits how far trouble spreads between zones.
- Microsegmentation limits how far it spreads between individual machines and accounts.
Weighing up the options?
We can compare them against your own requirements and give you a straight answer.
How ZTNA and segmentation work together
| Attack path | What ZTNA does | What segmentation does |
|---|---|---|
| Stolen password used remotely | Requires a managed, healthy device and MFA; limits access to allowed apps | Limits what those apps' servers can reach next |
| Phished user's laptop on the office LAN | With on-site enforcement, still limits app access | Stops the laptop scanning or connecting to other workstations and servers |
| Ransomware spreading over SMB, RDP or WinRM | Little effect inside the network | Blocks machine-to-machine admin protocols that are not needed |
| Stolen admin credentials | Can require stronger authentication for admin apps | Identity-based rules restrict where admin accounts can log on, with MFA before admin ports open |
| Supplier or contractor access | Per-app access, often clientless | Keeps their reachable systems isolated |
ZTNA without segmentation risks the NCSC's 'walled garden' anti-pattern in a new form: tight front door, open house. Segmentation without ZTNA leaves remote access as the weak point. See ZTNA vs NAC for how on-site device admission fits in.
Product examples we supply
Zero Networks automates microsegmentation without agents. It learns real network connections over a learning period of around 30 days, proposes least-privilege rules that can be modelled against live traffic before enforcement, and applies them through the host-based firewalls already built into your devices. Privileged ports such as RDP, SMB and WinRM stay closed until the user passes just-in-time MFA. Identity Segmentation restricts admin and service accounts to the machines and logon types they need, and OT and IoT devices that cannot be touched are protected with ACLs on the switches they connect to. Remote users connecting through Zero Networks Connect fall under the same segmentation policy. Read more about Zero Networks on our cloud security site and Zero Networks Connect here.
Todyl LAN ZeroTrust and Internal Segmentation is an option for Todyl SASE that blocks device-to-device traffic on the local network by default, to stop lateral movement, using the same agent as the rest of the Todyl platform. It is included in Todyl's Advanced and Complete packages. See Todyl SASE.
Other routes include Cisco ISE TrustSec security group tags for group-based segmentation on Cisco networks, Cisco Secure Workload for workload microsegmentation in the data centre and cloud, and NordLayer's Cloud Firewall on its Premium plan for segmenting what remote users can reach.
Where to start
Microsegmentation projects stall when they try to do everything at once. A more reliable order:
- Map traffic first. Observe real connections before writing rules; guesses about what talks to what are usually wrong.
- Protect the crown jewels. Domain controllers and critical servers are where lateral movement does the most harm.
- Close admin protocols between workstations. Workstation-to-workstation SMB, RDP and WinRM are rarely needed and commonly abused.
- Put MFA in front of privileged access so stolen admin credentials alone are not enough.
- Enforce in stages, reviewing exceptions, then extend to remaining servers, workstations and OT.
- Add ZTNA for remote access under the same policy, and remove legacy routes that bypass it.
How Forever Systems helps
We can review how flat your network is today, where segmentation exists only on paper, and which approach fits: zone redesign, agentless microsegmentation, agent-based options or a mix. We supply the licences and can run the learning, rule review and staged enforcement with you. Scope and timescales are confirmed at quote; ask us for a quote. Contact us to talk about stopping lateral movement in your network.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is the difference between network segmentation and microsegmentation?
Network segmentation divides a network into zones such as VLANs and subnets and controls traffic between them. Microsegmentation applies least-privilege rules to each individual host or workload, so machines in the same zone cannot talk to each other unless policy allows it.
Is microsegmentation better than VLANs?
They do different jobs. VLANs create zones; microsegmentation controls traffic within and between them at host level. VLANs alone do not stop devices on the same VLAN reaching each other, which is how ransomware often spreads.
Is microsegmentation the same as zero trust?
No. Microsegmentation is a technique that supports a zero trust architecture by limiting lateral movement. Zero trust also needs strong identity, device checks, per-request policy such as ZTNA, and monitoring.
Does ZTNA replace microsegmentation?
No. ZTNA controls which users reach which applications. Microsegmentation limits what machines and accounts can reach inside the network once something is compromised. The NCSC's ZTNA guidance says ZTNA does not remove the need for segmentation and local controls.
Does microsegmentation need agents?
Not always. Some products use agents on each host. Zero Networks is agentless and enforces rules through each machine's built-in host firewall, with switch ACLs for devices that cannot be touched.
Where should microsegmentation start?
Usually with domain controllers and critical servers, then admin protocols between workstations, with rules based on observed traffic and enforced in stages.
Still deciding?
Ask us and a member of our team will reply by email with a straight answer.
More zero trust access guides
Zero Networks ConnectRemote access with no open ports: MFA before any port opens, only for the authenticated user, under your segmentation policy.ZTNA vs NACNetwork access control on the LAN compared with per-app zero trust access from anywhere.ZTNA vs VPNPer-app zero trust access compared with network-level VPN access, and when a VPN still makes sense.
Todyl SASETodyl's SASE module: ZTNA, secure web gateway, secure DNS and cloud NGFW through one agent and the Todyl SGN.