A demilitarized zone, or DMZ, is a buffer network placed between an organization’s internal systems and less trusted networks such as the internet or partner connections. It exposes only the services that must be reachable from outside, while keeping sensitive assets on deeper internal segments.
In cyber security, a DMZ reduces the blast radius of compromise. If an attacker gains a foothold on a public-facing server, the DMZ helps prevent direct movement to controllers, databases, or other critical systems. In OT and ICS environments, it is often used to separate business IT from operational networks, support remote access gateways, patch servers, and monitoring tools. A well-designed DMZ uses strict firewall rules, limited trust, and logging so defenders can spot unusual traffic and contain intrusion attempts before they reach high-value assets.