Service
Making the endpoint layer and the network layer act on each other's findings, automatically, in the seconds that matter.
Most networks let any computer reach any other computer, so one infected laptop can reach everything. We divide the network into compartments and control what may cross between them — then connect it to your security software, so a machine that starts behaving badly is moved into an isolated compartment automatically, in seconds, without waiting for a person.
The single highest-value integration in most estates is also the one most often skipped: when the EDR agent on a laptop sees a breach, the router should move that device into a quarantine VLAN without waiting for a human.
In most organizations the endpoint platform and the network team are separate purchases, separate consoles and separate people. Detection happens on the endpoint; containment happens on the network; and the handoff between them is a human reading an alert.
That handoff is where dwell time is spent. Ransomware does not wait for the ticket to be assigned. If an EDR agent on a laptop — or on an IoT camera — detects a breach, it must be able to tell the router to segment that device into a quarantined VLAN on its own authority.
Automated containment on a production line or a clinical network can cause the outage it was meant to prevent. Every deployment defines asset classes that are never auto-isolated, a confidence threshold that must be met before action, and a manual override that works when the management plane is degraded. We rehearse the release path before enforcement is enabled.
Segmentation projects stall when they begin as a full estate re-architecture. We start at one boundary that measurably reduces blast radius — usually the one between general corporate access and whatever the crown jewels are — prove the automation there, then extend.
The universal failure is authoring policy from an architecture diagram. Diagrams describe intent; networks carry reality. We run an observation phase that records every flow that actually occurs over a full business cycle, derive the allow-list from that, and only then enforce. First enforcement should be uneventful — if it is dramatic, the observation phase was too short.
| Environment | Minimum | Why |
|---|---|---|
| Corporate IT | 30 days | Month-end batch, payroll, reporting cycles |
| Manufacturing | 1 full production cycle | Product changeovers alter traffic completely |
| Healthcare | 45 days | Clinical rotas and on-call patterns vary weekly |
| Finance | 1 quarter | Quarter-end close generates flows seen nowhere else |
| Utilities | 1 seasonal cycle | Demand peaks change control behavior |
A segmentation design that has never been tested from inside each zone is an assumption. Testing is also a PCI DSS requirement where a cardholder data environment is in scope, so it carries commercial weight beyond the engineering.
Starting position: a single flat network carrying corporate, the plant floor, guest wifi and a subsidiary acquired two years earlier. Any host could reach any host. A ransomware incident at a peer company had made the board receptive.
That last number is the only segmentation metric worth reporting to a board. "Seven zones deployed" describes activity; "a compromised laptop now reaches 47 hosts instead of 3,900" describes risk.
| Parameter | Conservative start | After 90 days |
|---|---|---|
| Confidence threshold to auto-isolate | High only | High + corroborated medium |
| Hours of operation | Business hours, staffed | 24/7 |
| Asset classes in scope | Corporate workstations only | + servers, excluding domain controllers |
| Never-isolate | Safety systems, clinical, plant control, DCs | Unchanged — this list never relaxes |
| Auto-release | Never — manual only | Manual only |
Network segmentation divides a network into smaller zones so that traffic between them must pass a policy check. The security value is blast radius: a compromise in one zone does not automatically reach the others. Modern practice goes further into micro-segmentation, where policy is enforced per workload or per device rather than per subnet.
By attempting the traffic that policy says should fail, from inside each zone, and confirming it is actually blocked rather than merely undocumented. We test from a host in each segment against every other segment, verify the deny is logged, and re-test after every firewall or VLAN change. A segmentation design that has never been tested from inside is an assumption, not a control.
Segmentation reduces PCI DSS scope. Systems that cannot reach the cardholder data environment are out of assessment scope, so isolating the CDE cuts both risk and the cost of every future assessment. PCI DSS requires segmentation to be validated by penetration testing, which is why the testing point above matters commercially as well as technically.
Bring us the estate you actually have — mixed OS fleets, ageing routers, unmanaged IoT — and we will tell you what can be unified under one agent and what needs custom work.
