What is Microsegmentation?

Microsegmentation is a network security technique that divides a network into small, isolated segments and enforces granular access policy between them, based on identity, device posture, or workload rather than network location, so a breach in one segment cannot spread laterally into the rest of the network.

Key takeaways

• Microsegmentation isolates resources into small, policy-controlled zones.
• It replaces perimeter-only defense with per-segment access control.
• Policy can match identity, device posture, or workload, not just IP.
• It limits lateral movement, containing breaches to a single segment.
• Versa applies it across its ZTNA, SD-LAN, and IoT Security lines.

On this page: Why it matters · How it works · Types · Microsegmentation & Versa · FAQ

Why is microsegmentation important?

Perimeter-based defenses assume traffic that clears the firewall can be trusted – a model that fails once an attacker gets past the edge, whether through phishing, a compromised IoT device, or a stolen credential. On a flat network, that single foothold reaches almost anything: file servers, domain controllers, other endpoints. Most breach damage comes not from the intrusion itself but from what follows – an attacker moving laterally, hunting for high-value targets.

Microsegmentation removes that freedom of movement. Wrapping granular policy around individual resources or device classes instead of the network as a whole confines an attacker, or a compromised device, to the segment it entered. An infected laptop or an unpatched IoT sensor can be quarantined without taking down the rest of the network. It also supports compliance rules for isolating regulated data, and lets security teams enforce Zero Trust – verify every connection, trust nothing by default – inside the network, not only at its edge.

What is microsegmentation?

To create a microsegment, an administrator defines match criteria – the attributes that place a user, device, or workload into that segment – then writes policy restricting or permitting traffic between segments. Criteria can be network attributes (IP, MAC address, VLAN) or security attributes: identity, device posture, fingerprinting, or a continuously computed risk score. Enforcement happens where traffic crosses a segment boundary, typically through a next-generation firewall rule that inspects traffic and applies policy for that pair of segments.

What separates microsegmentation from VLAN-only segmentation is granularity. A VLAN groups devices by network location and is largely static; microsegmentation can group by identity or real-time posture and reassign a device the moment its risk profile changes – moving an endpoint with out-of-date antivirus into a restricted segment until remediated, then returning it once compliant.

Types of microsegmentation

Approaches differ mainly in what they use to define a segment’s boundary. Network-based segmentation groups traffic using conventional attributes such as IP subnet, VLAN, or MAC address – familiar, but static and blind to what’s happening on the device. Identity- and posture-based segmentation places a user, device, or workload into a segment based on who or what it is and its current security state, independent of where it physically connects. Workload- or host-based segmentation, common in data centers and cloud environments, enforces policy at the individual server or virtual machine, often through an agent or hypervisor hook, so policy travels with the workload as it moves. Adaptive (dynamic) microsegmentation layers continuous monitoring on top of any of these, moving a device between segments as its risk score changes, rather than assigning it once at connection time.

Microsegmentation & Versa

Versa Operating System (VOS) implements microsegmentation for both client-based and headless devices. Endpoint devices running the Versa SASE client are placed into microsegments using endpoint information profiles (EIPs) – periodic posture updates such as patch level and antivirus status; see Configure EIP-Based Microsegmentation for SD-LAN. Headless IoT devices are placed by device fingerprinting instead. Rules classify matched traffic with a scalable group tag (SGT), which NPU and NGFW policies then match to enforce access – see Configure Microsegmentation.

On the SD-LAN side, Versa’s Zero Trust LAN (ZT-LAN) architecture embeds a next-generation firewall directly in the campus switch, avoiding a hairpin to a cloud point of presence. Adaptive microsegmentation continuously reassesses device risk score, moving a non-compliant device into a quarantined segment, as detailed in Configure Microsegmentation for SD-LAN.

Frequently asked questions

What is the difference between microsegmentation and VLANs?

A VLAN segments a network by physical or logical location and is configured once, largely statically. Microsegmentation adds identity- and posture-based policy on top, matching users, devices, or workloads directly and, in adaptive implementations, moving them between segments automatically as risk or posture changes.

How does microsegmentation stop lateral movement?

By enforcing access policy at every segment boundary, not only at the perimeter, microsegmentation forces an attacker or compromised device to pass an inspection point to reach any other resource. A foothold in one segment stays contained instead of spreading freely across the network.

Is microsegmentation the same as Zero Trust?

No. Zero Trust is the broader security model – verify every connection, trust nothing by default. Microsegmentation is one way to implement it, by shrinking the area any single verified connection can reach. Zero Trust also covers identity, device, and application controls beyond segmentation.

What is adaptive microsegmentation?

Adaptive, or dynamic, microsegmentation continuously reassesses a device’s posture after it’s already placed in a segment, rather than evaluating it once at connection time. If posture degrades – outdated antivirus, a newly discovered vulnerability – the device is automatically moved to a more restrictive segment until remediated.

Does microsegmentation require an agent on every device?

Not necessarily. Devices that can run a client, such as laptops using the Versa SASE client, report posture directly through it. Headless devices that can’t run an agent, such as IoT sensors, are instead identified and placed into segments using device fingerprinting.

More on Microsegmentation

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about microsegmentation, these are worth looking at next.