Most small and mid-sized offices run a flat network. Everything — laptops, the accounts machine, the file server, the CCTV recorder, the guest Wi-Fi, the smart TV in the meeting room — sits in one broadcast domain, on one subnet, able to reach everything else.
This is not a configuration choice anyone made. It is what happens when a network grows one device at a time and nobody is paid to think about the shape of it.
Why it matters
Assume one laptop gets compromised. Someone opens the wrong attachment; it happens to competent people. On a flat network, the attacker's position is now: every device you own, on the same layer-2 segment, reachable directly.
That includes the machine your accountant uses. It includes the NAS holding seven years of records. It includes an IP camera running firmware from 2019 that nobody has ever patched and that quite possibly has a hard-coded password.
The initial compromise is rarely the expensive part. Lateral movement is. Segmentation is the control that makes lateral movement expensive.
What good looks like at this size
You do not need a zero-trust architecture programme. For a 30–80 person office, four or five segments does most of the work:
- Servers and storage — reachable only on the specific ports the business needs
- Staff endpoints — general workstations
- Finance and privileged workstations — a small segment with tighter egress rules
- IoT, cameras and building systems — no internet access unless a device genuinely requires it, and no route to anything else
- Guest Wi-Fi — internet only, fully isolated, with client isolation on
The rule between segments is deny-by-default. You then open the specific flows the business actually uses, and you write down why each one exists.
The part people skip
Three things, all of which are the difference between a segmented network and a network with VLANs in it:
Egress filtering. Segmentation stops east–west movement. It does not stop a compromised device from calling out to a command-and-control server. The camera VLAN should not be able to reach the internet at all.
Management plane separation. If switch, firewall and hypervisor admin interfaces are reachable from the staff VLAN, an attacker who lands on a laptop is one credential away from your entire infrastructure.
Logging you would actually read. A firewall that denies a connection and tells no one has prevented one attempt and taught you nothing. Deny events between segments are the highest-signal log line a small network produces.
What it costs
For most offices this is a managed switch or two, a firewall you probably already own, a weekend of planning and a weekend of cutover — plus the honest part: two or three weeks of small breakages while you discover the flows nobody documented. That discovery is the value. It is the first accurate map of your own network anyone has ever had.
Compare that with the cost of a ransomware event: the recovery, the downtime, the client notifications, and the conversation with your largest customer about why their data was on a machine reachable from a compromised TV.
Where to start
If you do nothing else this quarter, do these two:
- Move cameras, printers and building systems onto their own VLAN with no internet egress and no route to your servers.
- Put your finance workstations somewhere an ordinary staff laptop cannot reach.
That is an afternoon of work and it removes the two most common paths we see in incident post-mortems.