For your insurer and auditor
Ransomware spreads by reaching the next machine. Segmenta stops that reach, and gives you a file that shows it: which servers are protected, what can reach your critical systems, and who approved each rule.
The questionnaire
Cyber insurance and audit questionnaires ask the same few things about your internal network. Each answer below is a page of a file the console generates, not a sentence you have to vouch for.
| They ask | What answers it | Where it is |
|---|---|---|
| Is your internal network segmented? | Every server and workload, Protected or still Learning, and every rule published for them. | Evidence pack · Protection, Rules |
| Could one compromised device reach your critical systems or backups? | Each system you rate Critical or High, with every way in named by who may use it, read from the published rules. | Evidence pack · Critical systems |
| Is remote administration restricted? | RDP, SSH or WinRM open to any device is called out on every critical system. Temporary access opens one admin port to one address for at most four hours, after a second factor. | Evidence pack · Critical systems, Approvals |
| Are firewall changes reviewed and approved? | Every change published in the period and who approved it. You can require up to five approvals, and the change history is hash-chained, so an edit after the fact shows. | Evidence pack · Approvals |
| How far could one machine get, and is it improving? | Lateral reach: how many servers could open a session or a share on each one, tracked day by day. | Monthly report · Posture |
| What do you expose to the internet? | Every application the internet can reach through a published rule. | Monthly report · Internet reach |
The evidence pack
A PDF, or one CSV per section. An administrator exports it from Reports for any period, and every export is recorded in the audit log.
Sample data for a made-up organisation. Your pack is generated from your own console.
Every month
The monthly report puts one month on a page: how far a single machine could get and how that moved, your critical systems, the changes published with the history checked, and what the internet can reach. Send it by email on a schedule, or download it when you're asked.
Evidence for, never "compliant"
The report lists the controls its figures are evidence for: ISO/IEC 27001:2022 A.8.22, PCI DSS v4.0 1.2 and 1.3, NIST CSF 2.0 PR.IR-01, CIS Controls v8 12.2 and 13.4, and the Essential Eight's restriction of administrative privileges. It never says a control is met. That's your assessor's call.
An upper bound, said as one
Lateral reach counts what the published rules would let through. Other firewalls in the path can only make it smaller, so the figure never flatters you.
Not certified ourselves, yet
Segmenta has no SOC 2 report. The security model is published at /trust, and you get straight answers to your questionnaire about us, without an NDA.
Questions
No product does. Segmenta gives you evidence that your internal network is segmented and that changes to it are approved, and names the controls that evidence supports. Whether a control is met is for your auditor or insurer to decide.
Yes. It's a PDF your administrator exports from Reports, for whatever period you choose, and it's yours to send. Every export is recorded in your audit log.
The pack exports from the first day of the trial. What it says gets better as you protect servers, one at a time, and the map, the suggested rules and the first protected servers all fit inside the 30-day trial.
The change history is append-only and hash-chained in the database, and the pack carries the result of checking that chain when the file was made. It never claims more than that check showed.
Map your network, protect the servers that matter, and export the evidence, inside a 30-day trial.
No credit card · nothing is enforced until you say so