The flat network problem

Most small and mid-sized networks are flat. Every device — the receptionist's PC, the point-of-sale terminal, the server holding your accounts, the smart TV in the conference room — sits on the same network and can, in principle, talk to every other. It is the default, it is easy to set up, and it is exactly what an attacker hopes to find.

Why flat is dangerous

Attackers rarely land where they want to end up. They get in through the easiest door — a phished login, a vulnerable device, a laptop that picked something up on a home network — and then move sideways toward the data that matters. On a flat network there is nothing to slow that movement. The first foothold and the crown jewels are one hop apart.

What segmentation does

Segmentation divides the network into zones and controls what may cross between them. Guest Wi-Fi cannot reach the finance server. The point-of-sale system talks only to what it must. The cameras and smart devices — notoriously hard to patch — live somewhere they cannot be used as a launch pad. A compromise in one zone stays in that zone instead of becoming a company-wide event.

It is less work than it sounds

You do not need to re-cable the office. Most business-grade network equipment already supports the VLANs and firewall rules this requires; the work is in designing sensible zones, writing the rules, and testing that legitimate traffic still flows. It is a project measured in days, not months, and it pays for itself the first time it turns what would have been a breach into a contained nuisance.

The principle underneath is the same one behind watertight compartments on a ship. You do not assume nothing will ever go wrong. You design so that when something does, it does not sink everything.