Network segmentation is the practice of dividing a network into smaller zones, such as user workstations, servers, backups, and production systems, and controlling traffic between them. Instead of letting every device talk to every other device, segmentation uses firewalls, VLANs, access control lists, or zero-trust rules to limit communication to what is necessary.
This matters because it reduces lateral movement. If an attacker compromises one laptop or server, segmentation can block them from reaching file shares, domain controllers, point-of-sale systems, or backup repositories. In ransomware cases, weak segmentation often lets malware spread quickly and encrypt more of the environment. Strong segmentation can contain the blast radius, buy time for response, and protect critical services such as ordering, logistics, and email. Defenders also use segmentation to isolate sensitive data and to make suspicious traffic easier to spot during monitoring and incident response.