01
Map
Know what actually talks to what.
A live dependency map built from real traffic, with the owning process behind every connection.
How the map works →Microsegmentation · Windows · Linux · Docker · Kubernetes · Azure · AWS
Segmentation
with a finish line.
Segmenta maps every flow on your fleet, writes the least-privilege policy for you, and shows you exactly what would break — before anything does.
30-day trial · A$20 / server / month · containers included · no professional services
Getting started
Twenty minutes to your first real answer.
Not a pilot, not a proof of concept, not a scoping call. Install the agent on a handful of hosts and the map starts drawing itself.
0–5 min
01
Install
A signed installer and an enrolment token. The agent claims its own certificate and connects out — no inbound firewall change, no appliance.
5–15 min
02
Watch the map draw
Flows arrive with the process that opened them. Within minutes you are looking at what those hosts actually talk to, rather than what the diagram says.
15–20 min
03
See what would break
Read the list of every flow that would stop if you enforced today. This is the number that decides whether segmentation is a project or a problem.
when you're ready
04
Protect one host
Turn protection on for something forgiving first. The domain controllers can wait until the preview is clean.
Before you enforce
See what would break. Then decide.
Every flow on your fleet is classified against the policy you are about to deploy. Nothing is enforced until you say so — and when you do, management paths go on first and block-all goes on last, so a host can never wall you out of itself.
- Each row becomes a rule, an exception, or a deliberate block
- Learning runs as long as you want, with zero impact
- Roll a scope back as cleanly as you rolled it out
Traffic that would stop today
8,071 flows have no rule
SRV-HYP-04 → SRV-FILE-01 udp/3343 cluster heartbeat
7,394,421 seen
SRV-HYP-08 → SRV-FILE-01 udp/3343 cluster heartbeat
7,028,837 seen
APP-WEB-02 → SRV-SQL-01 tcp/1433 w3wp.exe → sqlservr.exe
3,596,077 seen
docker:mail-api → SRV-DC-01 udp/53 resolver
1,204,882 seen
SRV-BKP-01 → SRV-HYP-04 tcp/902 backup agent
988,140 seen
Reviewed in the console, one scope at a time
168 open decisions
The work, in order
Four steps, and you can stop after any of them.
The console tracks the same four steps you see here. Nothing is enforced until step four, and step four goes one host, one scope or one rollout wave at a time.
Your path to protection
step 3 of 4
1 · See your network
20 devices
2 · Group by app
20 /20 grouped
3 · Approve traffic
20 of 20 ready
4 · Turn on protection
0 /20 protected
Protect devices as they settle — one host, one scope, or the fleet
The problem
One foothold shouldn't reach everything.
Most internal networks are flat: once something is inside, it can talk to almost anything. That's how a single compromised host becomes a fleet-wide incident — lateral movement, unchecked.
Microsegmentation closes those paths. The hard part has never been the firewall — it's knowing which flows are real, and turning hundreds of them into policy without breaking production. That's the part Segmenta does for you.
One phished laptop, a flat network
The hard part, done for you · an example estate
Connections observed · 14 days860,000
Distinct flows1,900
Suggested rules, with evidence26
Left for you to decide2
From traffic to policy
Watch a policy write itself.
Segmenta starts from what your hosts actually do, not from a diagram someone drew. Scroll to watch it go from raw traffic to an enforced policy.
- Map Every host, and every real connection between them.
- Group Hosts become roles: web tier, app, database.
- Decide A rule for each flow you mean, nothing else.
- Enforce Everything outside the rules is blocked.
What it does
Four moves, in order.
You can't govern what you can't see, and you can't claim what you haven't checked. Segmenta observes first, decides second, enforces third, and proves it the whole way.
02
Decide
Policy you don't have to write.
Least-privilege rules proposed from your own traffic, each one carrying the evidence behind it.
How the suggestions work →03
Enforce
Turn it on without breaking production.
Management paths first, block-all last, and a hash agreement on exactly what landed.
How enforcing works →04
Prove
Show the segmentation is real.
Coverage measured per observed flow, so green means a rule is genuinely carrying that traffic.
How coverage works →One policy model, the whole estate.
Same intent model, same audit trail, everywhere it runs.
Windows
Server & desktop
Kernel-level flow capture and Windows Defender Firewall enforcement, with the owning process on every connection.
Linux
Server & VM
nftables enforcement applied as a delta, so a policy change never rewrites a live ruleset out from under you.
Docker
Per-container rules
Containers are inventoried and governed individually — and metered as part of the host they run on, not on top of it.
Kubernetes
Per-workload policy
Workloads join Roles like containers. Their rules become NetworkPolicies, applied by a connector in the cluster.
Azure · AWS
Cloud security groups
Network security groups and security groups provisioned from the same rules, with flow logs read back as evidence.
Un-agented
Legacy & appliances
Boxes you can't install on are fenced by their managed neighbours — no change to the fragile host itself.
Pricing
Per host. Per month. Published.
The same for everyone, with no minimum and nothing to negotiate. Start with a 30-day trial.
Trial
30 days · free
The whole product, on 10 servers, 5 Kubernetes nodes and 50 workstations.
- Full dependency map, process-attributed
- Policy suggested from your traffic
- Enforcement included — protect for real
Business · most teams
A$20 / server / month
A$200 per server per year paid annually. Workstations A$5 a month.
- Everything in the trial, no limit on hosts
- Containers included — not metered separately
- Azure NSGs & AWS security groups
- Founding customers: A$15 a server, A$3 a workstation
Partner · MSP
25% · off the published price
One console, every client tenant.
- Tenants isolated at the database schema
- Billed per host, not per contract
- 25% off every client's price, founding rate included
Safe by design
Enforce without breaking production.
The fear with segmentation is locking yourself — or an application — out of a box you can't reach. Segmenta is built so you can't.
Learn before you enforce
Run in Learning and watch what policy would do, with zero impact, until you're ready to turn it on.
Management rules first
Rules apply in a safe order — management paths first, block-all last — so the agent can never wall off its own control channel.
Compiled and hashed
The agent and server agree on exactly what was applied, by hash. No drift, no surprise rules appearing out of band.
Reversible and audited
Every change is recorded and attributable. Back a policy out as cleanly as you rolled it out.
Who it's for
Three people, one source of truth.
The person who has to keep it running, the person who answers for the risk, and the person doing both for thirty other companies.
The infrastructure lead
You're the one who gets called at 2am.
- See what would break before you enforce, not after
- Roll a scope back as cleanly as you rolled it out
- No appliance, no traffic to reroute, no maintenance window
- The map finds the dependency you forgot about
The security lead
Depth you can verify, not take on faith.
- Process-attributed flows from kernel-level capture
- Per-agent certificates and mTLS, end to end
- Coverage measured per flow, so the number means something
- An attributable record behind every change
The MSP
Segmentation you can actually resell.
- One console across every client tenant
- Tenants isolated at the database schema, not in app code
- Billed per host across your whole book, not per contract
- A report your client will read at the quarterly review
Security model
Safe to put on production servers.
Segmenta is only useful if you trust it inside your fleet. That trust is earned by design, not by policy — and provable to anyone who has to sign off on it.
mTLS everywhere
The agent gateway requires a valid client certificate; nginx closes the connection on any validation failure before the API sees the request. TLS 1.2 / 1.3 only.
Per-agent identity
No shared credential. Each agent carries a certificate issued by the Segmenta CA, with a subject that encodes both the agent and its tenant binding.
Tenant isolation
Tenant data is isolated at the database layer — separate schemas — not merely filtered in application code.
Auditable by default
Enrolment tokens are stored hashed and spent or approved per host; self-updates run from signed MSI packages; every agent action is recorded.
Straight answers
What Segmenta isn't.
We would rather you find these out here than three weeks into an evaluation.
Block rules on Azure's network policy manager
Clusters on Cilium, Calico, OpenShift, EKS, GKE and AKS are mapped and their workloads enforced, inbound and outbound, on Kubernetes 1.31 to 1.37. Block rules are enforced on Cilium, Calico, OpenShift's OVN-Kubernetes, the Amazon VPC CNI and GKE's Dataplane V2. On Azure's network policy manager, a Block rule is shown as not enforced. If you need it there, say so — it moves up the list.
A SOC 2 report
We don't have one, and we're not going to imply we do. What we can give you is the security model in full, published at /trust, and straight answers without an NDA.
Not an EDR or an IDS
Segmenta governs which systems may talk to which. It does not inspect payloads, hunt malware, or replace endpoint detection — it limits where a compromise can go next.
No auto-apply
Every rule waits for a human. A recommender that writes your firewall unattended is one that will eventually take production down at 3am.
Quarantine skips cloud-managed hosts
An empty rule set on a cloud security group is the permissive state, not containment. We refuse the action rather than paint a green chip over a host nothing is holding.
We're early
No logo wall, no analyst placement, no customer count to quote. What we have is a product you can trial on your own network this afternoon and judge yourself.
Questions
The things people ask first.
If yours isn't here, ask us — a real person reads every message.
What is zero trust, in plain terms?
Stop trusting a connection just because it comes from inside your network. Every system-to-system link has to be explicitly allowed, and everything else is denied by default. No implicit “it's on the LAN, so it's fine.”
What is microsegmentation?
Breaking a flat internal network into many small zones, down to a single role or host. If an attacker lands in one, they can't move sideways into the rest — the blast radius stops at the segment instead of spreading fleet-wide.
Why do most segmentation projects stall?
Not because the firewall is hard. Because nobody knows every dependency, and hand-written rules rot the moment the network changes. Segmenta draws the map from live traffic and proposes the policy, so the work that usually kills the project is the part that is automated.
Will it break my production network?
Not unless you tell it to. Learning observes without enforcing for as long as you want, and before you enforce you get a list of every flow that would stop. When you do enforce, management paths are applied first and block-all last.
What does it run on?
Windows and Linux servers, Docker containers governed individually, Kubernetes workloads enforced by NetworkPolicy, and Azure NSGs and AWS security groups provisioned from the same rules. Hosts you can't install on are fenced by their managed neighbours.
How much does it cost?
A$20 per server per month, or A$200 per server per year paid annually, and A$5 a month per workstation. Organisations that subscribe by 30 June 2027 pay a founding rate of A$15 per server per month, or A$150 per server per year paid annually, and A$3 per workstation per month, locked for 24 months. Every organisation starts with a 30-day trial of the whole product on up to 10 servers, 5 Kubernetes nodes and 50 workstations, and a larger estate can ask for a trial sized to it. Containers are included rather than metered separately, and a Kubernetes node counts as one server.
Do I need professional services to deploy it?
No, and we don't sell any. The policy is proposed from your own traffic and the rollout is staged in the console.
Is there an appliance or a traffic redirect?
No. Enforcement happens on the host, in the firewall that is already there. There is nothing to route through and no choke point to size.
What data does the agent send?
Connection metadata — addresses, ports, protocol, the owning process and container, counts and timings — plus the rules it applied and the denials it saw. No packet contents; it is not a capture tool.
Who is it for?
Teams who want segmentation finished rather than scoped. Segmenta is self-serve, priced on the website, and meant to be completed by a small team without outside help. If you're weighing it against writing firewall rules by hand, there's an honest comparison of doing it yourself.
Can I use it across multiple clients as an MSP?
Yes. Segmenta is multi-tenant with isolation at the database schema level, one console across every tenant, and one invoice on your whole book rather than per client contract.
What happens if I stop paying?
Nothing opens. Hosts keep enforcing the policy they already have — we do not open your firewalls to collect an invoice — and the console turns read-only, with the way back to Learning still open. You lose changes, not your segmentation.
Start from what your network actually does.
Stop maintaining firewall rules by hand. Map every flow, compile least-privilege policy, and enforce it safely — on every host.