Contain the blast radius
Deny east-west by default and allow only the flows you approved. The intrusion is contained to where it landed instead of becoming a fleet-wide incident.
Enforce
Turn it on without
breaking production.
The fear with segmentation is locking yourself — or an application — out of a box you can't reach. Every part of the rollout is built so you can't.
Protect SRV-FILE-01
Nothing you rely on will stop.
Last 7 days, checked against the policy you're about to switch on.
1,284connections allowed by a rule
2will be blocked, as expected
0left to decide
- ✓SRV-FILE-01→SRV-DC-01tcp/88
- ✓SRV-BKP-01→SRV-FILE-01tcp/445
- ✓SRV-HYP-04→SRV-FILE-01udp/3343
- ✕10.0.40.17→SRV-FILE-01tcp/3389
- ✕SRV-PRN-02→SRV-FILE-01udp/137
ProtectManagement paths go on first. Back to Learning takes a reason and a second factor.
The order matters
Management first. Block-all last.
A host that walls off its own control channel is a host you drive to. Rules are applied in an order that makes that impossible, and the agent and the server agree by hash on exactly what landed.
01
Learning
Watch what the policy would do, with zero impact, for as long as you want. Nothing is blocked.
02
Preview
Read the list of every flow that would stop if you enforced everywhere today. Clear it, or accept it deliberately.
03
Apply
Management paths go on first, then the allows you approved, then block-all. The order is not configurable, on purpose.
04
Confirm
The agent reports what it applied and the server checks the hash. A mismatch is drift, and drift is visible.
When you need it to stop now
Quarantine, without losing the host.
Quarantine hands a host an empty ruleset. Its default action is block, and the agent injects its own control-plane allow — so the host keeps its Segmenta connection and nothing else. You get containment and you keep the ability to release it.
Set from the fleet
Select the hosts and quarantine them together. It takes effect as fast as the agents can apply it.
Released, not rebuilt
Releasing a host restores exactly the mode it was in beforehand — you are not left reconstructing its policy by hand.
Containers included
Ports published from containers on a quarantined host are contained too, rather than quietly surviving as a bypass.
Honest about limits
Cloud-managed hosts are refused rather than shown a green chip: an empty rule set on a cloud security group is the permissive state, not containment.
What teams use it for
Stop lateral movement at the first host.
Least-privilege segmentation means a compromised box can't pivot to the domain controller, the database, or the backups.
Answer the insurance question
"Is your internal network segmented?" stops being a conversation about intentions and becomes a screen you can show someone.
Questions
About enforcing.
The things worth knowing before you protect the first host.
What happens if the agent loses contact with the server?
The host keeps enforcing the last policy it was given. Losing the control plane does not open the firewall, and it does not close it further either.
Can I enforce one host at a time?
Yes, and that is the recommended way. Protection is set per host, so you can start with something forgiving and work up to the domain controllers.
How do I undo it?
Every change is recorded and attributable, and a scope can be rolled back as cleanly as it was rolled out. A host can also be returned to Learning, which stops enforcement without discarding the policy.
Can I open an admin port just for a moment?
Yes, with just-in-time access. It opens one administrative port on one host to one stated address, for minutes rather than days, and asks for your second factor at the moment you ask. It's an ordinary rule, published and withdrawn through the same path as every other, so the history shows who opened what, and it closes on its own.
Will it fight with rules I already have?
On Linux, enforcement is applied as a delta against the existing ruleset rather than a wholesale rewrite. On Windows, protecting a host backs up its own rules and enforces default-deny, so a Group Policy allow can't hold a door open; returning it to Learning restores them.
What about traffic Segmenta has never seen?
Under enforcement it is denied, which is the point — but the enforcement preview exists so you meet that traffic before it is denied rather than afterwards.
Protect the first host this week.
The trial includes enforcement. Turn protection on when the preview is clean, one host at a time.