// GLOSSARY

Microsegmentation

An approach that brings network isolation down to the host, workload or application level, defining narrow neighborhoods instead of broad trust zones. Traditional network design rested on a few large zones (for example 'internal network' and 'DMZ'); an attacker entering a zone could move freely across all of it. Microsegmentation breaks these broad areas apart to shrink the area lateral movement can reach, that is, the blast radius; it is the network leg of zero-trust architecture. But the critical point is this: a segmentation policy being defined does not mean it is enforced. The boundary drawn on paper and the one that actually holds in traffic are often not the same; a rule may be written too broadly, an exception forgotten, or a path never closed. So its worth is verified by controlled testing, especially in an assumed-breach scenario: the attacker is placed in a segment and where they can move from there is measured. A control's real worth emerges from exactly where it stops the attacker.