Segmentation

Segmentation is about how far something can travel once it is already inside.

A flat network is a building where every internal door is open: one compromised laptop reaches the finance system, the backups and the building controls. A segmented one makes an attacker work for every step, and every step is another chance to be noticed. It is the difference between an incident affecting one team and an incident affecting everything, and it is decided long before the incident, by how the network was drawn.