What Is Microsegmentation? An Independent Guide to Tools and Zero Trust Segmentation
Microsegmentation divides a network into small segments, sometimes as small as one workload, and allows only the connections each segment needs. CISA describes the benefit as a smaller attack surface, less room for lateral movement and better visibility. It builds on traditional network segmentation, and it does not replace other defenses.
Choosing a product? Start with the microsegmentation vendor finder or our comparison of the best microsegmentation tools. This site is independent: vendors don’t pay for placement, and we haven’t lab tested the products. Our facts come from public documentation and are dated.
How does microsegmentation work?
Microsegmentation works by mapping which systems talk to each other, writing rules that allow only those connections, and enforcing the rules close to each workload. CISA recommends repeating four steps instead of attempting one large project:
- Identify candidate resources. CISA suggests that ease of transition may matter most at first, with critical assets later.
- Identify their dependencies, both what they rely on and what relies on them.
- Determine the segmentation policies, involving stakeholders and users.
- Deploy the policies. Test first, for example in a permissive mode that flags violations, so that missed dependencies appear before anything breaks.
If you have flow logs, the flow log policy drafter turns them into a first draft of the allow rules, inside your browser.
Where can microsegmentation be enforced?
Microsegmentation can be enforced at the network, the endpoint, the container layer, the hypervisor or the cloud platform. CISA lists these five types, and says most enterprises will need to combine several of them.
| Enforcement point | Typical form | Main trade-off |
|---|---|---|
| Network | Switches, routers, firewalls, gateways | Works for devices that can’t run software, but rules are usually tied to network location |
| Endpoint or host | Agent, or the operating system firewall | Fine-grained, but agents may not run on appliances, IoT, OT or legacy systems |
| Container | Kubernetes network policies and plugins | Natural for cloud-native teams, but may be framework-specific |
| Hypervisor | A firewall in the virtualization layer | No guest software, but limited to that platform |
| Cloud | Security groups and native controls | Built in, but may be vendor-specific |
Container teams can start with our guide to Kubernetes microsegmentation. VMware teams can read about microsegmentation with NSX and vDefend.
Why does microsegmentation matter?
Microsegmentation matters because attackers rarely stop at the first system they reach. NIST SP 800-207 warns that once a perimeter is breached, further lateral movement is unhindered on a network that trusts everything inside it. CrowdStrike’s own 2026 threat report puts average eCrime breakout time at 29 minutes in 2025, which leaves defenders little time to respond by hand.
Learn how it happens in our guide to lateral movement. If you need to reduce audit scope, read about PCI DSS network segmentation.
How is microsegmentation different from network segmentation?
Microsegmentation is a finer form of network segmentation. Traditional segmentation creates large zones such as production and development. Microsegmentation divides those zones further, often with rules based on workload or identity instead of IP address. Our microsegmentation vs network segmentation comparison explains when each one is enough, and the network segmentation best practices guide covers the principles behind both.
Sources
- NIST SP 800-207, Zero Trust Architecture, August 2020, sections 1 and 3.1.2: doi.org/10.6028/NIST.SP.800-207
- CISA, Microsegmentation in Zero Trust, Part One: Introduction and Planning, version 1.0, July 2025: cisa.gov/resources-tools/resources/microsegmentation-zero-trust-part-one-introduction-and-planning
- CrowdStrike, 2026 Global Threat Report press release, February 2026 (vendor data): crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report
Frequently asked questions
What is microsegmentation in simple terms?
It splits a network into very small protected zones, sometimes down to one workload, and allows only the connections each zone needs. An attacker who compromises one system then has far fewer paths to other systems.
Is microsegmentation the same as zero trust?
No. NIST SP 800-207 presents micro-segmentation as one of three approaches to a zero trust architecture, and CISA treats it as one part of a wider program. It also needs identity governance to work fully.
Does microsegmentation replace firewalls?
No. CISA says microsegmentation augments defense in depth instead of replacing it. Perimeter firewalls still control traffic entering and leaving the network, while microsegmentation controls traffic between systems inside it.
Do I need an agent for microsegmentation?
Not always. Enforcement can sit in a host agent, the operating system firewall, the hypervisor, switches, or cloud security groups. OT, IoT and legacy devices often need network-based enforcement because agents may not be available.