For the audit
Segmentation you can demonstrate rather than assert, with an attributable trail behind every change and a coverage figure that means something.
Prove
Show the segmentation
is real.
Written-down rules are not evidence. Segmenta classifies every observed flow against live policy, so green means a rule is genuinely carrying that traffic — verified, not assumed.
CoverageFinance app · last 7 days
97%of observed flows carried by a rule
Allowed 97%Blocked 2%Ignored 1%
- Web tier100%
- Database100%
- Directory99%
- Files88%
Green means a rule carried the traffic, not just that one exists.
Coverage
Green means it's actually carrying the flow.
Coverage is measured per observed flow, not per rule written. A rule that looks correct but matches nothing does not move the number — which is exactly the failure a segmentation audit is supposed to catch.
- Every flow classified: allowed, would be blocked, blocked, or ignored
- Coverage per application, so you can see where the work is
- Traffic that would stop under enforcement, listed by volume
- Denials rolled up from enforcing hosts, so blocks are visible too
Where the work is
11 scopes · 20 hosts
Exchange5%
Directory8%
Platform56%
Backup91%
Web tier98%
Coverage — flows a live rule actually carries
32% fleet-wide
The record
Every change, attributable.
Who changed what, when, and what the agent actually applied as a result. Not a log of intentions — a record of effects.
Policy history
Every rule added, changed, published or withdrawn, with the person who did it and the moment it happened.
Applied, not just intended
The agent reports back what it put in place and the server checks it by hash, so the record reflects the host's real state.
Denials from the field
Blocks observed by enforcing hosts are rolled up, so you can see what segmentation is actually stopping.
Exportable
Take the evidence out of the console when someone needs it in a document rather than on a screen.
What teams use it for
Evidence an auditor can actually read.
Show which flows are allowed, which are blocked, and that the rules are genuinely carrying the traffic.
For the board
One number that moves: how much of the estate is genuinely governed, and what it would take to move it further.
Questions
About the evidence.
What coverage means, and what it deliberately doesn't.
What does the coverage percentage actually measure?
The share of observed flows that a deployed rule genuinely matches. Writing more rules does not raise it; writing rules that carry real traffic does.
Why isn't my coverage 100% after I approved everything?
Because coverage counts flows, not approvals. Traffic that arrived after your last review, or that nothing you approved matches, keeps the number honest.
Does it show me what is being blocked?
Yes. Denials seen by enforcing hosts are rolled up, so you can tell the difference between a segment that is quiet and a segment that is stopping things.
Can I get this out for a report?
Yes. Reports → Evidence pack exports one PDF, or one CSV per section: protection per host and workload, your critical systems and what can reach them, every published rule, and every approval in the period, with a check that the change history hasn't been altered. Every export is recorded in the audit log.
Find out what your coverage is today.
The trial measures it: thirty days, and a real number at the end of it.