What Is Network Segmentation for Security?

A 2026 survey of several hundred U.S. network security practitioners found that half of segmentation projects fail in a “Perfect Storm” pattern where every factor goes wrong at once: unclear goals, weak sponsorship, scope creep, unrealistic timelines, and an environment too complex to segment without breaking production. The finding, published in Help Net Security and detailed in an arXiv paper by Cisco’s Rohit Dube, matters because segmentation is the most effective tool a compliance team has for reducing audit scope. Done well, it limits PCI DSS and HIPAA obligations to a small set of systems. Done poorly, it becomes an expensive project that never delivers.

Key Takeaways

Segmentation reduces PCI DSS and HIPAA scope by isolating regulated data into specific zones, so fewer systems require full control sets and audits.
Macro-segmentation (VLANs, firewalls) controls north-south traffic; micro-segmentation controls east-west traffic at the workload level and prevents lateral movement.
Half of segmentation projects fail due to combined project-management and technical issues, with Layer-2 VLAN approaches more often falling into the worst failure category.
Firewall rule sprawl is the most common operational problem: thousands of unreviewed rules weaken the isolation you need to show to an auditor.
PCI DSS Requirement 1 and HIPAA’s proposed 2025 Security Rule updates both move segmentation from “recommended” to “required.”

Why Segmentation Is Scope Control, Not Just Security Control

The compliance case for segmentation is straightforward. PCI DSS applies to every system that stores, processes, or transmits cardholder data. If cardholder data is confined to a single isolated VLAN, only the systems on that VLAN must meet the full control set of PCI DSS 4.0. Marketing workstations, guest Wi-Fi, and HR file servers fall outside the scope. That reduces the audit from hundreds of systems to a dozen.

This is a well-known approach. TechTarget’s PCI DSS guidance lists scope reduction as one of the first steps in any assessment, before testing controls. The same applies under HIPAA, where proposed 2025 HIPAA Security Rule updates would require healthcare organizations to separate clinical from non-clinical workflows through network segmentation.

The financial impact makes this clear. IBM’s 2024 Cost of Data Breach Report, cited by Elisity, estimates the average healthcare breach costs nearly $11 million, the highest among industries. The report also notes that lateral movement occurs in over 70% of successful breaches. Segmentation reduces both the blast radius of a breach and the audit surface regulators examine.

Macro vs. Micro: Choosing the Right Granularity

The difference between these two approaches affects whether your project fails or succeeds. TechTarget’s segmentation comparison explains that traditional network segmentation controls north-south traffic at the network level using VLANs, ACLs, and firewalls, while micro-segmentation controls east-west traffic between individual workloads regardless of VLAN.

A VLAN cannot control server-to-server traffic within the same subnet. If all your app servers share one VLAN, an attacker who compromises one can reach others without crossing a firewall. Micro-segmentation addresses this by enforcing policies on each workload or hypervisor, using Layer 7 firewalls and identity-based rules. Zero trust architectures rely on micro-segmentation to prevent lateral movement, as our zero trust implementation guide explains.

Network switch panel with connected ethernet cables representing segmented network infrastructure — Segmentation is applied at the switch, firewall, or workload, depending on whether you use macro or micro approaches.

The 2026 failure research adds a caution for this choice. Projects using Layer-2 macro-segmentation with VLANs and VXLANs were overrepresented in the “Scope and Visibility Trap” category, where most respondents reported poor asset visibility. Layer-2 zone design depends on knowing exactly what assets exist and where. Without accurate asset inventory, VLAN-based designs rely on guesswork. Micro-segmentation projects were spread evenly across failure types, indicating the approach is neither more nor less risky, but its failure modes differ.

VLAN Design and Firewall Rule Management

Most projects begin with VLAN design, where many get stuck. The process is simple: Turn-Key Technologies’ segmentation guide advises isolating critical systems into dedicated VLANs, segmenting IoT and unmanaged devices, and separating compliance-regulated environments from general IT. Inter-VLAN traffic must route through a Layer 3 gateway, where you place a firewall to enforce allow-lists between zones.

The common failure point is firewall rules controlling traffic between segments. SentinelOne’s segmentation architecture guide identifies the issue: enterprise firewall policies often grow to thousands of rules that become hard to audit and maintain. A rule allowing a temporary vendor connection in 2021 that was never removed becomes a permanent gap in your isolation boundary, and an auditor will find it.

Managing firewall rules for compliance means treating them as a living inventory, not just a config file. Each rule needs an owner, a business justification, and a review date. Legacy rules without documented purpose should be removed or denied. The goal is a default-deny stance between segments, with explicit allow-lists for the protocols and ports that legitimate workflows require. This separates segmentation that passes audits from segmentation that fails when a QSA or OCR investigator asks, “why is this rule here?”

Architecture Patterns for PCI DSS and HIPAA

The architecture that meets both frameworks follows a common pattern. Public-facing systems sit in a DMZ with limited API access to internal services. A boundary firewall or internal segmentation gateway separates the DMZ from regulated zones. The cardholder data environment (CDE) and ePHI systems each occupy isolated segments, with default-deny rules blocking east-west traffic between them and other zones. Management access flows through a dedicated jump host on a management VLAN, never directly from user workstations.

Hospital environment with connected medical devices representing IoMT segmentation — Medical devices such as infusion pumps and imaging systems are the highest-risk assets to segment because they rarely support endpoint security agents.

PCI DSS Requirement 1 requires firewalls and router configurations that control traffic between segmented zones. Requirements 11.3 and 11.4 require penetration testing to verify isolation. A QSA tests the boundary rather than accepting the network diagram on faith. HIPAA’s framework is less detailed, but proposed 2025 rule changes require clear separation between clinical and non-clinical networks.

Network segmentation infrastructure in a data center — Medical devices such as infusion pumps and imaging systems are the highest-risk assets to segment because they rarely support endpoint security agents.

Healthcare environments add complexity that payment environments do not. Elisity’s 15+ segmentation control examples describe a pattern: infusion pumps connect only to infusion management servers, CT and MRI machines connect only to PACS servers, and vital-sign monitors send data only to nurse station systems. Each device class has a deny-by-default policy scoped to its clinical function. This is practical because IoMT devices run legacy software that cannot host endpoint agents, so the network segment is the only enforceable control boundary. Attackers remain in healthcare networks for an average of 280 days before detection, making isolation of these unpatchable devices the main defense against lateral movement.

The table below compares how each segmentation approach fits the two frameworks’ requirements:

Approach	Traffic controlled	Enforcement point	Best compliance fit
Physical segmentation	North-south	Dedicated switches, routers, cabling	OT/IT separation; highest-assurance isolation
Logical (VLAN)	North-south	Layer 3 gateway + firewall	PCI DSS CDE isolation; departmental zones
Firewall-based	North-south	Internal firewalls between zones	DMZ creation; trust-level separation
Micro-segmentation	East-west	Workload/hypervisor agents	HIPAA IoMT isolation; zero trust lateral-movement control

Physical segmentation, which CISA identifies as a foundational method for separating OT from IT networks, provides the strongest isolation but requires dedicated hardware per segment, making it inflexible and costly. Logical VLAN segmentation is more flexible and cost-effective, though misconfigured VLANs can leak traffic through VLAN hopping or trunk-port errors. Micro-segmentation is the most detailed and adaptable, but it requires deploying agents on every workload, which is impossible on legacy infusion pumps.

Implementation Checklist and Audit Timeline

SentinelOne’s guide and CISA’s Zero Trust Maturity Model recommend a phased rollout instead of a big-bang cutover. CISA advises “transitioning portions of your enterprise over time” and starting in monitoring mode before enforcing. A typical sequence for a mid-sized organization looks like this:

Phase 1, asset discovery and baseline (weeks 1-4): Map every workload, application, and data flow. Document which systems handle cardholder data or ePHI. This step directly addresses the “Scope and Visibility Trap” that caused the worst failures.
Phase 2, policy definition (weeks 3-6): Define least-privilege allow-lists between zones. Deploy policies in logging-only mode to measure impact on legitimate traffic before blocking.
Phase 3, enforcement (weeks 6-12): Activate policies gradually, starting with your highest-value assets. Enable default-deny between segments and east-west micro-segmentation for regulated workloads.
Phase 4, continuous validation (ongoing): Conduct penetration tests on boundaries (PCI DSS 11.3 and 11.4 require this), review firewall rules quarterly, and retest isolation after network changes.

The timeline varies based on asset visibility. The 2026 failure research clearly identifies poor asset visibility as the top technical cause of stalled projects. Allocate enough time for discovery; every hour spent inventorying assets before designing VLANs saves multiple hours of rework after enforcement breaks production applications.

Audit preparation happens alongside implementation. For PCI DSS, your QSA will want a network diagram, a firewall rule set with justifications, and penetration test results proving isolation. For HIPAA, an OCR investigator will ask how you separate clinical from administrative systems and whether the separation is documented and enforced, not just described in policy. As our 2026 security audit preparation guide emphasizes, a control that cannot be showed in operation is treated as nonexistent.

The Four Failure Archetypes and How to Avoid Them

The most useful result of the 2026 Cisco study is the failure classification. The surveyed practitioners grouped into four distinct failure patterns, each with a specific, addressable root cause.

Perfect Storm (50.2% of respondents) describes projects where project-management and technical failures combine. Unclear goals, weak sponsorship, scope creep, and an environment too complex to segment all occur together. The solution is governance: a scoped charter, a named decision authority, and realistic timelines agreed on before any switch configuration.

Diffuse Friction (33.5%) describes projects that stalled due to moderate friction across organizational and technical areas. About two-thirds of this group rated technical factors higher than project-management factors, indicating the friction was in policy design and enforcement rather than sponsorship.

Operational Drag (8.5%) is the most relevant for compliance teams. Leadership was supportive and goals clear, but the ongoing effort to build and maintain segmentation policies, combined with reluctance to enforce aggressively for fear of outages, caused failure. Almost no one blamed weak leadership. The fix is policy automation and a clear discussion about acceptable disruption risk.

Scope and Visibility Trap (7.8%) is the most technically specific. Every respondent reported scope creep, and nearly all reported poor asset visibility. This failure type is linked to campus networks and Layer-2 macro-segmentation, which makes sense because VLAN design depends on knowing what assets exist.

The study’s most important behavioral finding is that when asked what they would change if repeating the project, all four groups gave nearly the same answer: about 70% suggested general IT project-management improvements, even in the Operational Drag and Scope and Visibility Trap groups where the proximate cause was clearly technical. The paper concludes that governance is necessary but not enough. A project scoped realistically and resourced well can still fail technically, and technical failure requires a technical fix, not another steering committee.

The practical advice for a CISO or compliance officer is to treat segmentation as two parallel efforts. One is governance: scope, sponsorship, and realistic timelines. The other is technical: asset discovery before VLAN design, policy automation to reduce operational drag, and default-deny enforcement that is actually activated, not just documented. Organizations that manage both efforts together are the ones whose segmentation projects succeed and whose PCI DSS and HIPAA scope shrinks as a result.

For related controls that segmentation supports, see our guides on data loss prevention strategy and end-to-end encryption, both of which build on a properly segmented network.

More in-depth coverage from this blog on closely related topics:

Sources and References

Sources cited while researching and writing this article: