TL;DR<\/h2>\n\n- \ud83d\udd12 68 percent of DACH SMEs have no Zero-Trust network concept (Zscaler, 2025).<\/li>\n
- \ud83d\udcca Lateral movement is the most common attack step after initial access (MITRE ATT&CK, 2025).<\/li>\n
- \u23f1\ufe0f Average dwell time of an attacker in a network: 10 days (Mandiant M-Trends, 2025).<\/li>\n
- \ud83c\udfe2 Siemens has fully separated IT and OT since 2024. A model for industrial companies.<\/li>\n
- \ud83d\udee1\ufe0f Microsegmentation reduces the attack surface by up to 90 percent (Forrester, 2025).<\/li>\n<\/ul>\n
Why Flat Networks Are the Biggest Security Risk<\/h2>\n
In a flat network, every device can communicate with every other. The intern\u2019s laptop talks to the ERP server, the reception printer reaches the production control system<\/a>. For attackers, this is paradise: a single compromised endpoint opens the door to everything.<\/p>\nMITRE ATT&CK documents lateral movement as the most common attack step after initial access. The attacker moves horizontally through the network, escalates privileges, and reaches their real target: data, control systems, or backup infrastructure. Mandiant puts the average dwell time at 10 days – ten days during which the attacker operates undetected.<\/p>\n
\n\u201cMicrosegmentation reduces the blast radius of an attack to a minimum. Instead of compromising the entire network, the attacker remains trapped in an isolated segment.\u201d<\/p>\n
Forrester Research, Zero Trust Microsegmentation Report, 2025<\/cite>\n<\/p><\/blockquote>\nZero Trust Network Segmentation in Three Stages<\/h2>\n
Stage 1: Macrosegmentation (Immediately actionable).<\/strong> Divide your network into large zones: office IT, production OT, guest Wi-Fi, server DMZ. Each zone gets its own VLANs and firewall rules. No communication between zones without explicit approval. Siemens implemented exactly this step in 2024 across all German sites: IT and OT are now physically and logically fully separated.<\/p>\nStage 2: Microsegmentation (3-6 months).<\/strong> Within each zone, individual workloads are isolated. The web server only communicates with the database, not the file server. Tools like Illumio, Guardicore (Akamai), or VMware NSX enable this without hardware changes. Forrester estimates a 90 percent reduction in the attack surface.<\/p>\nStage 3: Identity-based segmentation (6-12 months).<\/strong> Access is no longer determined by the network segment but by the user\u2019s identity and device. Zero Trust Network Access (ZTNA) replaces traditional VPNs. Zscaler, Cloudflare, and Palo Alto offer ZTNA as a cloud service. For companies with remote work and multi-cloud environments, this is the logical next step.<\/p>\n\n\n68 %<\/div>\nof DACH SMEs without Zero-Trust networks (Zscaler)<\/div>\n<\/div>\n\n10 Days<\/div>\naverage dwell time of an attacker in a network (Mandiant)<\/div>\n<\/div>\n\n-90 %<\/div>\nattack surface reduction through microsegmentation (Forrester)<\/div>\n<\/div>\n<\/div>\nThe Counterargument: Segmentation Slows Agility<\/h2>\n
Not every IT leader is enthusiastic. The most common argument against strict segmentation: it slows development. DevOps teams need fast access to different environments. Microsegmentation with rigid rules can slow deployment cycles and cause incidents when legitimate traffic is blocked.<\/p>\n
The solution lies in Policy-as-Code: segmentation rules are not manually configured in firewalls but defined as code, versioned, and automatically deployed. Terraform, Ansible, and the APIs of segmentation platforms make this possible. The initial effort is higher, but long-term agility improves because rule changes are implemented in minutes rather than days.<\/p>\n
Conclusion: Segmentation Is the Most Cost-Effective Security Investment<\/h2>\n
Network segmentation doesn\u2019t require million-euro budgets. Macrosegmentation with existing switches and firewalls can be implemented in weeks. Software-based microsegmentation starts at \u20ac10,000 per year for mid-sized environments. The cost-benefit ratio is unbeatable: 90 percent less attack surface for a fraction of the cost of an EDR platform. The first step: map your network. Who talks to whom? The results will surprise you.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n\nWe have 200 employees and a flat network. Where do we start?<\/strong><\/summary>\nBegin with macrosegmentation: separate at least four zones (office IT, servers, guests, management network). This can be done with existing managed switches (VLAN configuration) and one firewall rule per zone transition. Time required: 2 to 4 days for a network admin. Cost: nearly zero if the hardware supports VLANs.<\/p>\n<\/details>\n\nDoes microsegmentation work in virtualized environments?<\/strong><\/summary>\nYes, and particularly well. VMware NSX, Illumio, and Guardicore operate at the hypervisor level and can isolate individual VMs without hardware changes. In Kubernetes environments<\/a>, Network Policies serve the same function. The advantage over hardware-based segmentation: rules move with the workload when it\u2019s relocated.<\/p>\n<\/details>\n\nHow expensive is microsegmentation for a company with 500 endpoints?<\/strong><\/summary>\nOpen-source options (OPNsense, pfSense with VLANs) cost nothing beyond implementation effort. Commercial software solutions (Illumio, Guardicore) start at around \u20ac10,000 to \u20ac25,000 per year for 500 endpoints. Enterprise platforms (Cisco Secure Workload, Palo Alto Prisma) range from \u20ac30,000 to \u20ac80,000. By comparison, the average ransomware incident costs \u20ac1.8 million (Sophos, 2025).<\/p>\n<\/details>\n\nWe have an OT environment (production). Do different rules apply?<\/strong><\/summary>\nYes. OT segmentation follows the Purdue Model: strict separation between enterprise IT (Levels 4-5) and production networks (Levels 0-3) via a demilitarized zone (DMZ Level 3.5). No direct access from IT to OT. Siemens has implemented this across all German sites and recommends as a minimum standard: separate firewalls between IT and OT, no shared Active Directory domains, and dedicated management networks for SCADA systems.<\/p>\n<\/details>\n\nDoes segmentation disrupt our remote employees\u2019 VPN access?<\/strong><\/summary>\nTraditional site-to-site VPNs do, because they funnel users into a network segment with full access. The solution: Zero Trust Network Access (ZTNA) instead of VPNs. ZTNA grants access to individual applications rather than entire networks. A remote employee can reach their ERP system but not the adjacent backup server. Zscaler, Cloudflare Access, and Palo Alto Prisma Access offer this as a cloud service.<\/p>\n<\/details>\n
Further Reading on Network Security<\/h2>\n\n- \u2192 Hardening Active Directory: 5 Immediate Measures<\/strong><\/a> (SecurityToday)<\/li>\n
- \u2192 NIS2 in Germany: What Companies Need to Know Now<\/strong><\/a> (SecurityToday)<\/li>\n
- \u2192 SAP Patch Day: Critical NetWeaver Vulnerability<\/strong><\/a> (SecurityToday)<\/li>\n<\/ul>\n
<\/p>\n
More from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-tls-zertifikate-2026-warum-200-tage-lauf-6313409.jpg\")
<\/span>cloudmagazin<\/span>TLS Certs 2026: 200-Day Validity Ends Manual Management<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-ai-agents-im-team-warum-nur-jeder-neunte-26403485-250x167.jpg\")
<\/span>MyBusinessFuture<\/span>AI Agents in the Team: Why Only One in Nine Pilots Reaches Production<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"A compromised printer in accounting. Sounds harmless – until the attacker jumps from it to the domain controller via the flat network, then to production control, and three days later encrypts the entire manufacturing line. Network segmentation prevents exactly that. Yet, according to Zscaler, 68 percent of German SMEs have no […]","protected":false},"author":55,"featured_media":5359,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"zero-trust network segmentation","_yoast_wpseo_title":"Zero-Trust Network Segmentation: Why Flat Networks Are the Biggest Security Risk","_yoast_wpseo_metadesc":"Zero-Trust Network Segmentation stops lateral attacks in flat networks\u2014protect critical assets now. Learn how to secure your infrastructure today.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5360"],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-7608","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":5360,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7608"}],"version-history":[{"count":7,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7608\/revisions"}],"predecessor-version":[{"id":21722,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7608\/revisions\/21722"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5359"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Why Flat Networks Are the Biggest Security Risk<\/h2>\n
In a flat network, every device can communicate with every other. The intern\u2019s laptop talks to the ERP server, the reception printer reaches the production control system<\/a>. For attackers, this is paradise: a single compromised endpoint opens the door to everything.<\/p>\n MITRE ATT&CK documents lateral movement as the most common attack step after initial access. The attacker moves horizontally through the network, escalates privileges, and reaches their real target: data, control systems, or backup infrastructure. Mandiant puts the average dwell time at 10 days – ten days during which the attacker operates undetected.<\/p>\n \u201cMicrosegmentation reduces the blast radius of an attack to a minimum. Instead of compromising the entire network, the attacker remains trapped in an isolated segment.\u201d<\/p>\n Forrester Research, Zero Trust Microsegmentation Report, 2025<\/cite>\n<\/p><\/blockquote>\n Stage 1: Macrosegmentation (Immediately actionable).<\/strong> Divide your network into large zones: office IT, production OT, guest Wi-Fi, server DMZ. Each zone gets its own VLANs and firewall rules. No communication between zones without explicit approval. Siemens implemented exactly this step in 2024 across all German sites: IT and OT are now physically and logically fully separated.<\/p>\n Stage 2: Microsegmentation (3-6 months).<\/strong> Within each zone, individual workloads are isolated. The web server only communicates with the database, not the file server. Tools like Illumio, Guardicore (Akamai), or VMware NSX enable this without hardware changes. Forrester estimates a 90 percent reduction in the attack surface.<\/p>\n Stage 3: Identity-based segmentation (6-12 months).<\/strong> Access is no longer determined by the network segment but by the user\u2019s identity and device. Zero Trust Network Access (ZTNA) replaces traditional VPNs. Zscaler, Cloudflare, and Palo Alto offer ZTNA as a cloud service. For companies with remote work and multi-cloud environments, this is the logical next step.<\/p>\n Not every IT leader is enthusiastic. The most common argument against strict segmentation: it slows development. DevOps teams need fast access to different environments. Microsegmentation with rigid rules can slow deployment cycles and cause incidents when legitimate traffic is blocked.<\/p>\n The solution lies in Policy-as-Code: segmentation rules are not manually configured in firewalls but defined as code, versioned, and automatically deployed. Terraform, Ansible, and the APIs of segmentation platforms make this possible. The initial effort is higher, but long-term agility improves because rule changes are implemented in minutes rather than days.<\/p>\n Network segmentation doesn\u2019t require million-euro budgets. Macrosegmentation with existing switches and firewalls can be implemented in weeks. Software-based microsegmentation starts at \u20ac10,000 per year for mid-sized environments. The cost-benefit ratio is unbeatable: 90 percent less attack surface for a fraction of the cost of an EDR platform. The first step: map your network. Who talks to whom? The results will surprise you.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n Begin with macrosegmentation: separate at least four zones (office IT, servers, guests, management network). This can be done with existing managed switches (VLAN configuration) and one firewall rule per zone transition. Time required: 2 to 4 days for a network admin. Cost: nearly zero if the hardware supports VLANs.<\/p>\n<\/details>\n Yes, and particularly well. VMware NSX, Illumio, and Guardicore operate at the hypervisor level and can isolate individual VMs without hardware changes. In Kubernetes environments<\/a>, Network Policies serve the same function. The advantage over hardware-based segmentation: rules move with the workload when it\u2019s relocated.<\/p>\n<\/details>\n Open-source options (OPNsense, pfSense with VLANs) cost nothing beyond implementation effort. Commercial software solutions (Illumio, Guardicore) start at around \u20ac10,000 to \u20ac25,000 per year for 500 endpoints. Enterprise platforms (Cisco Secure Workload, Palo Alto Prisma) range from \u20ac30,000 to \u20ac80,000. By comparison, the average ransomware incident costs \u20ac1.8 million (Sophos, 2025).<\/p>\n<\/details>\n Yes. OT segmentation follows the Purdue Model: strict separation between enterprise IT (Levels 4-5) and production networks (Levels 0-3) via a demilitarized zone (DMZ Level 3.5). No direct access from IT to OT. Siemens has implemented this across all German sites and recommends as a minimum standard: separate firewalls between IT and OT, no shared Active Directory domains, and dedicated management networks for SCADA systems.<\/p>\n<\/details>\n Traditional site-to-site VPNs do, because they funnel users into a network segment with full access. The solution: Zero Trust Network Access (ZTNA) instead of VPNs. ZTNA grants access to individual applications rather than entire networks. A remote employee can reach their ERP system but not the adjacent backup server. Zscaler, Cloudflare Access, and Palo Alto Prisma Access offer this as a cloud service.<\/p>\n<\/details>\n <\/p>\n\n
Zero Trust Network Segmentation in Three Stages<\/h2>\n
The Counterargument: Segmentation Slows Agility<\/h2>\n
Conclusion: Segmentation Is the Most Cost-Effective Security Investment<\/h2>\n
Frequently Asked Questions<\/h2>\n
We have 200 employees and a flat network. Where do we start?<\/strong><\/summary>\n
Does microsegmentation work in virtualized environments?<\/strong><\/summary>\n
How expensive is microsegmentation for a company with 500 endpoints?<\/strong><\/summary>\n
We have an OT environment (production). Do different rules apply?<\/strong><\/summary>\n
Does segmentation disrupt our remote employees\u2019 VPN access?<\/strong><\/summary>\n
Further Reading on Network Security<\/h2>\n
\n
More from the MBF Media Network<\/h3>\n
<\/span>cloudmagazin<\/span>TLS Certs 2026: 200-Day Validity Ends Manual Management<\/span><\/span><\/a><\/span>MyBusinessFuture<\/span>AI Agents in the Team: Why Only One in Nine Pilots Reaches Production<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"A compromised printer in accounting. Sounds harmless – until the attacker jumps from it to the domain controller via the flat network, then to production control, and three days later encrypts the entire manufacturing line. Network segmentation prevents exactly that. Yet, according to Zscaler, 68 percent of German SMEs have no […]","protected":false},"author":55,"featured_media":5359,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"zero-trust network segmentation","_yoast_wpseo_title":"Zero-Trust Network Segmentation: Why Flat Networks Are the Biggest Security Risk","_yoast_wpseo_metadesc":"Zero-Trust Network Segmentation stops lateral attacks in flat networks\u2014protect critical assets now. Learn how to secure your infrastructure today.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-5360"],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-7608","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":5360,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7608"}],"version-history":[{"count":7,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7608\/revisions"}],"predecessor-version":[{"id":21722,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7608\/revisions\/21722"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5359"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}