What is network segmentation? Types, benefits, and methods

Why do organizations implement segmentation, and what are the benefits?

Organizations use segmentation to control which users, devices, workloads, and applications can communicate. Effective segmentation supports five core outcomes:

• Enforce least privilege: Allow only necessary communication between segments and workloads based on policy, identity, role, and context.
• Limit blast radius and incident impact: Isolate systems and restrict unauthorized lateral movement so a compromise is less likely to spread.
• Improve incident response: Help security teams contain suspicious activity in a defined segment and focus investigation and remediation without disrupting the entire network.
• Strengthen operational resilience: Enable targeted isolation so critical services outside an affected segment can remain available during an incident.
• Support compliance: Separate sensitive data and systems, apply access controls, and reduce the scope of monitoring and audits.

Why segmentation matters in the age of AI

AI applications and agents often connect to APIs, data, cloud services, and infrastructure. Each connection can become a path for unauthorized access or lateral movement. Segmentation helps enforce least-privilege communication between AI components and the resources they use, limiting the reach of a compromised or overprivileged agent while supporting Zero Trust controls.

How does segmentation work?

Network segmentation controls communication by organizing resources into segments and applying policy at boundaries and workloads. A typical process has four steps:

1. Group resources: Organize users, devices, workloads, applications, or data into logical or physical segments based on business and security needs.
2. Define permitted communication: Specify which segments may communicate, what services or protocols they may use, and under what identity, role, or context.
3. Enforce policy: Apply the rules at network, cloud, host, workload, container, or application enforcement points.
4. Continuously verify: Monitor communication and changes in identity, posture, applications, and infrastructure; then refine policies as the environment evolves.

What are the different types of segmentation?

Macro-segmentation: The most common form of network segmentation, macro-segmentation is the practice of dividing a computer network into distinct segments, or zones, based on broad criteria such as department, function, application, or location. This approach creates high-level boundaries designed to control traffic flow between these areas and enhance overall network security and performance. Macro-segmentation is also referred to as zonal segmentation.

Microsegmentation: This is a highly granular approach where workloads and applications are segmented based on fine-grained attributes such as prior observed communication between individual workloads, administrator-designated labels assigned to individual workloads, or policies assigned by the application owner. Access control policies are applied on the individual workload, making it highly effective at limiting unauthorized lateral movement to prevent the spread of threats.

Macrosegmentation vs microsegmentation

Also referred to as zonal segmentation, macrosegmentation creates high-level boundaries. Microsegmentation applies access control at the individual workload—such as a single application, cloud container, or virtual machine—making it highly effective at limiting the spread of threats.

For deeper detail on workload-level controls, see the microsegmentation page.

What are the implementation methods for segmentation?

A segmentation design starts with two decisions: where to create the boundary and how to define the policy. The next section explains where the resulting policy is enforced.

• Where the boundary is created: Physical boundaries separate infrastructure such as cables, ports, servers, switches, routers, or firewalls. Logical boundaries can be created at Layer 2 with VLANs or VXLANs, at Layer 3 with subnets or VRFs, or closer to a workload, container, or application.
• How policy is defined: Rules can use an IP address or subnet, network zone, user or device identity, role, device posture, workload label or tag, application, or service. The criteria should reflect the communication required for the business process and deny unnecessary access.

How are segmentation policies enforced?

Segmentation separates policy decisions and coordination from policy enforcement.

• Policy engines and orchestrators define, manage, and distribute the intended access rules. For example, Cisco Identity Services Engine (ISE) can use identity, role, device, and posture context to inform network access policy, while Cisco Security Cloud Control can orchestrate consistent policy across supported environments.
• Enforcement points permit or deny traffic according to those rules. They can include physical or virtual firewalls, routers and switches, host or workload controls, cloud security groups and cloud firewalls, and network access controls.

The policy system determines what communication is allowed; the enforcement point applies that decision close to the traffic.

Common questions about network segmentation