IT integration takes months. In the interim, acquirers inherit connectivity they don't fully understand and can't safely lock down. We’ll walk through strategies for minimizing risk exposure during M&A, the role of cyber due diligence, and how CISOs can proactively contain the inherited attack surface.

Key Answers

• Why does the integration phase of M&A carry significant cyber risk? In the window between transaction close and full IT integration, acquirers have inherited new risk exposure but have not yet standardized security. Attackers know organizations are in transition, liability for the acquired environment transfers at close, and pressure to realize deal value often outpaces security standardization. Nearly 1 in 4 executives report a cyber incident during or shortly after an M&A transaction, yet only 23% proactively manage cyber risk post-close.
• What does M&A cyber due diligence miss? Due diligence evaluates a target organization’s security program, past incidents, regulatory exposure, and external attack surface; those findings shape deal terms, but because cyber due diligence captures posture at a single point in time, acquirers often gain full visibility into the internal network only after close.
• What risk exposure do acquirers typically inherit? Common inherited exposures include broadly reachable internal networks, legacy authentication and unpatched systems, and overprivileged admin accounts, service accounts, and AI agents.
• How can security teams shrink inherited attack surface? Map the acquired environment based on observed traffic, close privileged access paths, implement microsegmentation, and enforce identity-based access controls. Then, adapt policies automatically as integration progresses and measure containment at each milestone.

What Is M&A Cybersecurity?

Mergers & acquisitions (M&A) cybersecurity covers the security risks that arise across the lifecycle of a merger or acquisition. In practice, M&A cybersecurity programs often concentrate on due diligence, which can shape valuation, indemnities, and go/no-go decisions. However, the period between close and full integration represents the greatest exposure for the acquirer, making it a critical focus for enterprise security leaders guiding an organization through a merger or acquisition.

M&A Integration Cybersecurity Risks and Challenges

Three conditions overlap during the integration phase of a transaction: attackers know that a shift is occurring, liability transfers, and security priorities compete with the pressure to realize deal value quickly. The average M&A IT integration timeline runs 12-18 months; these challenges turn that period into an exposure window that most organizations aren’t prepared to absorb.

Attackers Target Companies During M&A Transactions

Deals are public knowledge, and attackers know that M&A transactions leave organizations exposed. Twenty percent of executives say they’ve had deals paused or delayed due to a cyber incident, and almost 60% say financial targets were impaired as a result of an attack during or shortly after close.

“Threat actors are smart; they read the news and know companies tend to be vulnerable when they’re trying to close or right after when they’re integrating systems — and that’s when they try to break in.”

Meredith Griffanti, Global Head of the Cybersecurity and Data Privacy Communications practice, FTI Consulting

Acquirers Inherit Liability for Existing Breaches

Over 60% of executives say acquiring a company exposes them to significant cybersecurity risk; more than half of organizations report discovering major cyber risks during post-closing integration. But acquirers don’t only inherit direct risk exposure from that new environment, they also inherit responsibility for incidents that predate the transaction.

One of the best-known real-world examples of inherited compromise is Marriott’s acquisition of Starwood. Marriott acquired Starwood in 2016 but did not detect a breach that began in 2014 until two years post-close, in September of 2018. During that time, attackers accessed 339 million Starwood guest account records worldwide, including 5.25 million unencrypted passport numbers. When the FTC brought action in 2024, its order held Marriott responsible for the security practices of both brands following the acquisition. The final penalty was $52 million.

Proactive Cyber Risk Management Is Rare

A quarter of CISOs say they feel pressure to close deals quickly rather than conduct thorough cyber due diligence during M&A, and more than 75% of organizations have no strategy in place for proactive risk management post-close – when exposure peaks for acquirers. With limited visibility into inherited risk following due diligence, and only a reactive strategy to lean on during the integration phase, many security leaders are stuck firefighting once a transaction closes and the push to connect systems, consolidate operations, and realize value outpaces security standardization.

What Does M&A Cyber Due Diligence Cover?

Cyber security due diligence is the foundation of any M&A security program; a thorough process evaluates the target’s security program, past incidents, regulatory exposure, third-party relationships, and external attack surface. Those findings feed directly into deal terms, including purchase price adjustments, escrows, indemnities, and post-close remediation commitments.

Importantly, due diligence typically captures an organization’s posture at a point in time, often through questionnaires, document reviews, interviews, and scanning. Antitrust and contractual constraints generally prevent acquirers from deploying their own tooling or enforcing controls inside the target organization before close. As a result, the acquirer often learns how the internal network behaves only after the transaction is complete.

Inherited Attack Surface: 3 Common Exposures

Every acquisition brings assets, identities, and connections that the acquirer didn’t design and may not fully understand. Zero Networks’ 2026 Lateral Movement Exposure Report analyzed 54 trillion activities across 312 enterprise environments, providing a snapshot of common exposures security leaders can expect to inherit.

• Flat, broadly reachable internal networks: Most enterprise networks still operate with extensive internal trust – 87% of servers accept inbound RDP or SSH from many internal sources and 78.7% are reachable over SMB or WinRM.
• Legacy authentication and unpatched systems: Acquired environments frequently carry years of accumulated technical debt. Over 40% of internal authentication still relies on NTLM, a protocol Microsoft has been deprecating for over a decade, and patching gaps compound the problem – the 2026 Verizon DBIR found that only 26% of CISA Known Exploited Vulnerabilities were fully remediated in 2025.
• Overprivileged service accounts, admins, and non-human identities: Inherited Active Directory environments often include stale admin accounts, service accounts with standing privileges, and credentials no one at the parent company can account for. In 16% of organizations, an attacker with low-level initial access has an 80%+ chance of compromising a key administrative account or infrastructure element, and more than 75% of organizations have not yet extended Zero Trust architecture to include non-human identities like AI agents.

How to Shrink Inherited Attack Surface: M&A Security Best Practices

These six steps give security teams a practical order of operations for protecting the business without slowing the integration timeline.

Step 1: Map Every Asset, Identity, and Connection in the Acquired Environment

Start with an accurate picture of how the acquired network behaves. Map assets, identities, and communication paths based on observed traffic rather than documentation, which is often outdated or incomplete after an acquisition. This baseline reveals unknown connectivity, overprivileged accounts, and the dependencies that need to survive integration; it also provides the operational insights necessary for generating non-disruptive security policies.

Step 2: Close Privileged Access Paths

Admin protocols like RDP, SMB, WinRM, RPC, and SSH are the primary routes attackers use to expand from an initial foothold. Restricting those privileged pathways removes the riskiest lateral movement highways proactively, before the full integration roadmap begins. Place these protocols behind just-in-time network-layer MFA to keep privileged ports closed by default while letting administrators request time-bound access when they need it.

Step 3: Enforce Microsegmentation Across the Acquired Environment

Using the learned internal communication baseline, leverage deterministic automation to generate segmentation policies that allow only the connections each asset requires. Simulating those policies against real traffic before enforcement enables security teams to catch potential disruptions before they happen. Once enforced, microsegmentation unlocks safer M&A integration, ensuring compromises remain isolated.

Step 4: Restrict What Inherited Identities Can Reach

Credentials remain some of the most valuable assets an attacker can find in an acquired network. Identity segmentation limits each identity, human or machine, to explicitly necessary assets and logon types based on observed behavior. Service accounts can only reach the systems they serve, and admin accounts can only authenticate where their role requires. This means that even an attacker holding valid credentials can’t use them to move beyond those limits.

Step 5: Dynamically Adapt Policies as Integration Changes the Environment

Integration reshapes the network continuously as systems migrate, applications consolidate, and legacy infrastructure is retired. Manually maintained rules fall behind these changes quickly, leaving gaps or breaking legitimate workflows. Automated policy lifecycle management – powered by the same deterministic engine that accelerates protection across newly acquired environments – incorporates new communication patterns as they’re approved and closes access paths that are no longer used. Enforcement then stays accurate at every milestone without the security team chasing each change by hand.

Step 6: Measure Containment at Each Integration Milestone

Deal teams track integration progress against milestones, and security should be measured the same way. Track metrics like the number of reachable admin paths, how many systems a single compromised endpoint can access, and the share of the acquired environment under enforced policy. These containment indicators provide a clear, quantifiable view of how inherited risk is growing or shrinking over time.

Contain M&A Integration Risk with Zero Networks

Zero Networks shrinks inherited risk by automatically mapping unknown environments, enforcing containment without redesign, and keeping security current through every stage of integration.

Zero’s automated, identity-based microsegmentation delivers comprehensive visibility into inherited assets, identities, and communication paths in minutes, monitoring legitimate traffic to establish a learned baseline that powers deterministic policy automation. And Zero’s agentless approach means no network redesign of the inherited environment, and no agent installation across every acquired device. While full M&A IT integration can take years, Zero Networks segments 90%+ of the typical network within 90 days, drastically compressing the risk window for acquirers.

See for yourself how Zero Networks minimizes M&A risk exposure – request a demo.

Beyond targeting the vulnerabilities created by enterprise AI adoption, attackers are also using AI to execute attacks faster and more effectively. This double-edged sword of AI risk forces security teams to ask two connected questions: how can we protect the AI in our environment from exploitation, and how can we prevent AI-powered attacks from spreading?

The solution is building an AI-ready network, designed to enforce granular controls for internal AI tools and stop AI-speed attacks in real time. We’ll share a framework for benchmarking AI readiness and best practices for strengthening AI resilience at the architectural level.

Key Answers

• What is AI resilience? AI resilience is an organization’s ability to withstand and continue operating through an AI-related compromise, whether that’s an AI-accelerated attack or exploitation of internal AI tools and agents. Resilience against AI threats depends on a network architecture designed to contain compromises at the point of entry, making the speed of an attack irrelevant.
• What are the pillars of an AI-ready network architecture? An AI-ready architecture requires a closed-by-default network that makes unauthorized lateral movement impossible, identity-based access controls, a deterministic enforcement layer, isolated model infrastructure, and comprehensive, real-time network visibility. Together, these pillars enable enterprises to adopt AI safely while containing AI-powered attacks.
• How can enterprises assess their AI readiness? Enterprises can assess their AI readiness by benchmarking their network architecture across dimensions like containment, policy management, identity governance, and AI exposure and operational load. For a customized report that scores AI readiness across a five-stage maturity framework, surfaces the most urgent AI exposures, and provides next steps for strengthening resilience, take Zero Networks’ AI Readiness Assessment.

What Is AI Readiness?

AI readiness is an organization’s capacity to safely adopt, scale, and govern AI tools and agents while also protecting against AI-driven cyber threats.

Most AI readiness assessments encompass broad pillars, like business strategy, data foundations, culture, technical infrastructure, and model management. While these assessments help organizations effectively map a high-level AI strategy, they’re often too broad to measure real exposure.

An organization could score well across strategy, data governance, and AI usage policy dimensions while the network still allows widespread AI agent access and gives AI-enabled attackers a straight path from initial foothold to critical assets. In other words, aggregate AI readiness scores can give organizations a false sense of security without properly weighting the factors that actually determine AI resilience: how much access internal AI tools inherit and how far an AI-powered attack can travel.

AI Resilience: What It Is and How Security Leaders Can Measure It

In cybersecurity, AI resilience is an organization’s ability to continue operating when an AI-related compromise occurs – whether that’s an internal AI tool being exploited or an attacker weaponizing advanced AI models to gain access and move laterally.

While AI readiness refers to a proactive posture, AI resilience is a measure of how that posture holds up under pressure. To reliably predict AI resilience, organizations need to benchmark their ability to address both sides of the AI threat landscape.

The AI Attack Surface

Every AI tool, agent, and workflow adopted into enterprise environments quietly expands an evolving AI attack surface if not properly governed. Shadow AI usage creates connectivity that nobody approved, reviewed, or is watching; exposed model infrastructure leaves enterprises vulnerable to model tampering and data extraction; and AI agents inherit excessive access and autonomy across a broad range of systems. In fact, less than a third of organizations have extended Zero Trust architecture to include non-human identities like AI agents.

AI as an Attack Accelerant

Threat actors are using AI to compress the attack lifecycle, closing the window between initial access and business disruption. Frontier models can discover and exploit vulnerabilities at machine speed and scale, and AI-driven lateral movement allows attackers to pivot from an initial foothold in as little as 27 seconds. Zero Networks’ 2026 Lateral Movement Exposure Report found that a single compromised host exposes 85% of internal systems – attackers are now weaponizing that exposure faster than any detect-and-respond workflow can match.

Measuring Resilience Against AI Threats: The Shared Foundation

AI-powered cyberattacks and threats exploiting AI vulnerabilities rely on the same weakness: open internal pathways. An AI-accelerated attacker moves laterally through existing communication paths, just faster; a rogue AI agent leverages broad standing access to reach critical systems without raising alarms.

This means that the most dependable measure of AI readiness and resilience is a closed-by-default architecture that restricts internal reachability by design and enforces granular identity-based access controls for users, devices, applications, and AI agents. It doesn’t matter how fast attackers move when the pathways they rely on don’t exist.

5 Pillars of AI-Ready Infrastructure

Many teams focus on performance when designing an AI-ready infrastructure, measuring success based on factors like GPU capacity, storage, and high-bandwidth networking that keeps AI workloads running smoothly. But while performance makes AI adoption possible, architecture is what makes it safe.

From a security perspective, an AI-ready infrastructure should be built on five core pillars:

Closed-by-Default Network Architecture

Lateral movement pathways should be closed proactively with comprehensive microsegmentation, so new AI tools, agents, and workflows are adopted inside a network that's already hardened. When a breach occurs, microsegmentation keeps it contained to the initial point of compromise so the speed of an attack becomes irrelevant.

Curious how far an exploited agent or AI-driven attacker could move in your network today? Get an interactive visual map of your attack surface in minutes, for free with Zero Networks’ Breach Map tool →

Identity-Governed Access for Every Connection

Enforce least-privilege access policies for every identity – whether human, machine, or AI agent. Narrowly scope AI agent access to what’s operationally necessary and implement network-layer MFA to require just-in-time verification for privileged access, ensuring stolen credentials or hijacked sessions can’t be leveraged by AI-powered attackers as a fast-pass to critical assets.

Adaptive, Deterministic Guardrails

Modern networks evolve constantly; when new AI is adopted internally, any lag in policy creation leaves security gaps that AI-driven attackers can exploit. Deterministic, human-on-the-loop automation builds rules based on real network behavior and adapts enforcement as the environment changes, closing configuration gaps before they create a window of opportunity for attackers.

Isolated Model Infrastructure

Combining network segmentation and identity segmentation allows enterprises to close risky LLM exposure, isolating model infrastructure so it’s only accessible to explicitly authorized systems and identities. Locking down the access paths attackers rely on to tamper with or extract data from a model means security teams aren’t required to fully understand the model’s internal behavior in order to protect it.

Comprehensive, Real-Time Visibility

AI adoption has outpaced governance in many enterprises. Without full visibility into which cloud AI services users are accessing, how developers are deploying AI, or which third-party software has embedded autonomous workflows, security teams can’t effectively strengthen AI resilience. An always-current network map delivers visibility into every AI tool, agent, and integration in the environment, providing the insights security teams need to block unsanctioned AI services by default and constrain internal AI access.

AI Readiness Assessment Framework: Benchmarking Architectural Resilience

Assessing a network’s AI readiness requires asking specific questions that map to the core dimensions of resilience. Use these questions to gauge where your architecture sits on the AI readiness spectrum:

Using insights from these key questions, organizations can map their AI readiness to a five-stage maturity framework, uncovering which AI-related exposures pose the most urgent risk and establishing next steps to strengthen AI resilience.

AI Readiness Stages

For security teams that want a defensible assessment of their network’s AI resilience, Zero Networks’ AI Readiness Assessment delivers a tailored report in less than five minutes, including customized next steps for defending against AI-driven attacks and securing AI tools and agents in your environment.

Build an AI-Ready Architecture with Zero Networks

Assessing AI readiness and resilience requires benchmarking maturity across the capabilities that truly protect business continuity.

Zero Networks contains risk by design, enabling enterprises to accelerate AI innovation without losing control. Identity-based microsegmentation proactively contains attacks – human or AI-driven – while AI Segmentation extends comprehensive visibility and control to every AI tool, agent, and model in the environment.

See how you can build AI resilience into your network architecture with Zero – request a demo.

While the speed of AI-powered cyberattacks is new, the tactics are familiar. Zero Networks’ 2026 Lateral Movement Exposure Report found that 71% of enterprise threat activity flows through just four admin protocols, and 87% of servers accept internal RDP or SSH traffic. So, containing AI-driven attacks doesn’t require faster detection or patching – it requires keeping the pathways adversaries rely on closed by default.  

We’ll walk through how AI-powered attacks leverage open privileged pathways, why enforcing network-layer MFA is key for containing AI-speed attacks, and what it takes to protect admin ports, sensitive systems, and critical services without adding operational friction.  

Key Answers 

• How do AI-enabled attackers use admin protocols? Over 70% of threat activity flows through RDP, SMB, WinRM, and RPC; AI-driven lateral movement moves through those open pathways at machine speed, enabling attackers to escalate privileges and reach critical systems without triggering alerts.  
• How can security teams enforce MFA for RDP and other admin protocols? Network-layer MFA operates at Layer 3 of the OSI model, while traditional MFA operates at Layer 7. Enforcing just-in-time verification at Layer 3 allows security teams to keep privileged internal pathways closed by default, opening only for pre-approved identities for a limited window.  
• What are best practices for containing AI-speed attacks? Implement identity-based microsegmentation to establish a closed-by-default baseline that leaves no room for AI-driven lateral movement – regardless of how quickly attackers move. Then, enforce MFA on admin ports, privileged logons, and sensitive systems to close any remaining gaps attackers might exploit, while allowing legitimate traffic to flow freely. Use deterministic automation to adapt access policies as the network changes, ensuring security scales with the business.  
• How do I know if I’m prepared to absorb AI attacks? The most dependable measure of resilience against AI threats is closed-by-default architecture that proactively limits the spread of an attack, making speed irrelevant. Take Zero Networks’ AI Readiness Assessment for a customized report on your organization’s ability to contain AI attacks architecturally.  

How AI-Powered Attacks Target Admin Protocols  

AI-assisted attackers can conduct reconnaissance, escalate privileges, and move laterally in parallel across hundreds of targets, enabling them to find a way into and through the network at unprecedented speed and scale. 

AI-Driven Vulnerability Discovery and Lateral Movement  

Attackers’ weaponization of advanced AI increases the odds that flaws are found and exploited quickly. According to Mandiant’s 2026 M-Trends report, exploitation of vulnerabilities already ranks as the #1 initial access vector, and mean time to exploit is -7 days, meaning vulnerability exploitation typically happens before a patch exists.  

While a vulnerability exploit may give attackers an initial foothold, open privileged pathways expand their reach. Over 70% of threat activity flows through RDP, SMB, WinRM, and RPC. Because they function as high-trust highways for IT operations, these protocols often stay open by default – and attackers know it.  

From an initial point of compromise, attackers can simultaneously explore and exploit multiple pathways with AI-driven lateral movement (AILM). And critically, AI-enabled attackers are exploiting the same pathways they always have, just far faster and more effectively. Statically open admin protocols and standing privileged access give attackers the broad internal reachability to turn a minor compromise into a business crisis.  

Closing Privileged Pathways: Just-in-Time Access with Network-Layer MFA   

Traditional MFA operates at Layer 7 of the OSI model – the application level. While this strategy effectively protects SaaS applications and web portals, it leaves privileged ports and protocols, legacy systems, and other non-SaaS assets operating below Layer 7 unprotected. In other words, most MFA governs authentication at the entry point into an application without determining what happens inside the network, after initial access.   

To effectively close the privileged internal pathways that attackers use to escalate breaches at AI speed – without impacting critical operations – enterprises need to enforce MFA at Layer 3 of the OSI model (the network layer). Network-layer MFA triggers verification directly at the point of access, long before a session reaches the application layer.

Practically speaking, this approach means security teams can:  

• Close admin ports before AI can reach them: RDP, SSH, SMB, WinRM, and RPC stay closed by default, only accessible to pre-approved identities after MFA verification – and only for a limited window.  
• Reinforce network- and identity-based controls: Microsegmentation and identity-based access controls provide a proactive containment layer for AI attacks, delivering baseline protection; adding network-layer MFA to sensitive protocols and privileged access further strengthens that posture, removing all opportunities for AI-driven lateral movement.  
• Secure privileged access without disrupting critical workflows: By removing the forced trade-off between stronger security and operational continuity, network-layer MFA keeps sensitive ports and protocols closed to unauthorized identities without adding friction to legitimate operations by enabling just-in-time access. 

How to Enforce MFA on Admin Ports and Privileged Access: Best Practices for Blocking AI-Speed Attacks  

Network-layer MFA is an important part of a closed-by-default architecture. Identity-based microsegmentation defines which systems can communicate and who can access those pathways; network-layer MFA ensures that particularly sensitive pathways only open for pre-approved identities for a limited time when necessary. Together, these strategies contain AI-driven attacks by design – regardless of where they start or how quickly they move.  

Build a Proactive Containment Layer with Identity-Based Microsegmentation  

Start by mapping every network asset and establishing a baseline for how systems and identities communicate. Those insights enable security teams to proactively isolate assets and build granular access policies tied to identity, establishing a closed-by-default baseline that prevents lateral movement without impacting operations.  

How this contains AI-driven attacks 

AI-driven reconnaissance maps every reachable system from a given foothold in parallel. A closed-by-default architecture drastically shortens that list, keeping all assets without a verified business need structurally isolated by default. To see your attack surface through an attacker’s eyes, use Zero’s free Breach Map tool →

Enforce Network-Layer MFA on Admin Protocols and Privileged Access 

Identity-based microsegmentation defines which users are allowed to access sensitive ports; network-layer MFA enforces those rules as just-in-time access decisions. Admin protocols remain closed by default, but pre-approved identities with a legitimate business need can gain time-bound access after completing verification, making MFA for RDP, SSH, and WinRM operationally feasible. Similarly, network-layer MFA can secure all privileged logons for users that require elevated permissions, prompting users to complete verification before gaining access to pre-approved assets only.  

How this contains AI-driven attacks  

After gaining initial access, AI-enabled attackers seek out privilege escalation opportunities, riding trusted access paths to critical assets without triggering alarms. With admin ports and privileged logons closed until MFA verification, stolen credentials are just another dead end.  

Dynamically Adapt Access Policies with Deterministic Automation   

Maintain continuous visibility into internal communications and use those real-time insights to power a deterministic automation engine that adapts and enforces policies as the network evolves.  

How this contains AI-driven attacks 

Attackers weaponize AI to exploit new paths as soon as they appear. In dynamic networks, deterministic automation is the only way to ensure security gaps never accumulate, leaving no room for AI-driven attacks to spread. 

Proactively Contain AI-Driven Attacks with Zero Networks  

With identity-based microsegmentation, Zero Networks automatically segments every asset, identity, and AI agent, so when a breach occurs, it stays isolated.  

Zero automatically enforces adaptive, identity-aligned policies based on real network behavior. By tightly coupling network and identity enforcement and adding just-in-time MFA verification to privileged access, Zero protects protocols like SMB, RDP, WinRM, and RPC without disrupting operations.   

Learn more about how you can build a cyber resilient architecture designed to contain AI-speed attacks – request a demo.  

The core function of network segmentation is to prevent lateral movement – and the stakes are rising. Zero Networks’ 2026 Lateral Movement Exposure Report found that a single compromised host exposes 85% of internal systems, while AI-enabled attackers can pivot from an initial foothold in as little as 27 seconds.

While network segmentation is key to bolstering cybersecurity defenses and accelerating threat containment, traditional segmentation strategies are struggling to match the speed and sophistication of modern cyber threats.

Key Answers

• What is network segmentation? Network segmentation divides a network into smaller, isolated segments, each with its own access controls, so an attacker who compromises one part of the network can’t freely reach the rest. Common methods include VLANs, subnets, access control lists (ACLs), and internal firewalls.
• What are the benefits of network segmentation? Segmentation shrinks the attack surface and blast radius, blocks lateral movement, and protects critical assets. It also narrows the scope of compliance audits and improves network performance and troubleshooting.
• What is the difference between network segmentation and microsegmentation? Network segmentation separates the network into broad zones, such as departments or environments, but trust usually remains open inside each zone. Microsegmentation isolates every individual asset, workload, and identity with its own policy, so a compromised host can reach only what it needs.
• Why do traditional network segmentation projects stall? VLANs, ACLs, and internal firewalls depend on manual rule writing and static configurations that are hard to maintain as networks change. Automated microsegmentation removes that burden by learning real traffic and generating policy automatically. To benchmark where your approach stands, take the Maturity Quiz.

What is Network Segmentation?

Network segmentation is a fundamental cybersecurity strategy that involves dividing a larger network into smaller subnetworks, or segments. Each segment functions as an isolated entity, with its own set of security controls and policies, creating boundaries that limit attackers’ ability to move laterally within the network.

Common network segmentation methods include virtual local area networks (VLANs), subnets, access control lists (ACLs), internal firewalls, and physical separation of network infrastructure.

By segmenting the network, administrators can:

• Improve network performance
• Control access to sensitive resources
• Reduce the attack surface
• Block lateral movement and better protect against sophisticated cyber threats
• Streamline regulatory compliance

Proper network segmentation enhances both the security and efficiency of network infrastructure.

Types of Network Segmentation

Common network segmentation approaches break into three categories: logical segmentation, physical segmentation, and perimeter-based segmentation.

Logical Segmentation

Logical segmentation uses approaches like VLANs, subnets, or software-defined networking (SDN) to create virtual boundaries within a single physical network. This allows different departments, teams, or applications to operate in separate segments with their own access controls and security policies, even if they share the same hardware.

For example, VLANs can isolate user groups and prioritize traffic, while subnetting divides a network into smaller address spaces to control traffic flow.

When to use logical segmentation:

Logical segmentation is especially useful in hybrid and multi-cloud environments where physical separation isn’t practical and different cloud providers can be assigned their own virtual segments.

Physical Segmentation

Physical segmentation involves dividing the network into separate segments using dedicated hardware and infrastructure, such as different switches or routers. This method provides the highest level of isolation since each segment is physically disconnected from others, making it extremely difficult for threats to spread between segments.

When to use physical segmentation:

Physical segmentation is often used in larger networks with strict security requirements, such as those handling sensitive data or intellectual property.

Perimeter-Based Segmentation

Perimeter-based segmentation focuses on defining boundaries between trusted internal networks and untrusted external networks, typically via firewalls or ACLs.

While this method traditionally focused on North-South traffic (in and out of the network), modern perimeter-based segmentation also considers East-West traffic (lateral movement) by controlling traffic flows between internal segments. However, as networks grow more complex, relying solely on perimeter defenses becomes less effective.

The Most Common Network Segmentation Methods

Within these broader categories, most organizations still rely on foundational approaches to network segmentation – 43% of security leaders say they use firewalls to segment their networks and 30% say they use VLANs.

Notably, only 5% of organizations report that they’re currently microsegmenting their networks, even though it’s easier than ever to implement comprehensive, granular network segmentation.

Network Segmentation Benefits: Security, Compliance, and Performance

Network segmentation delivers benefits spanning:

• Security: By dividing a network into smaller segments, network segmentation limits the scope of unauthorized access, reduces lateral movement, accelerates threat containment, and strengthens overall security posture.
• Regulatory Compliance: Network segmentation aids in maintaining regulatory compliance by creating boundaries for sensitive data and implementing necessary security measures for each segment. By building a resilient, adaptive architecture, network segmentation also future-proofs compliance initiatives, making it easier to comply with regulatory changes.
• Network Performance: Because network segmentation reduces congestion and optimizes traffic flows, it improves performance and enhances user experiences.
• Troubleshooting and Maintenance: With network segmentation, administrators can isolate and address issues within specific segments without impacting the entire network.

Let’s take a closer look at how network segmentation delivers benefits in each of these areas.

Enhance Network Security

Network segmentation strengthens security by blocking the lateral movement of malicious actors within the network. Since segments are proactively isolated, the larger network remains protected even if one segment is compromised. This prevents the infiltration of malware, ensuring that it cannot spread to critical systems and compromise sensitive data or intellectual property.

Reduce the Attack Surface

Network segmentation plays a pivotal role in minimizing the scope of a cyberattack. By dividing a network into smaller segments, each with its own dedicated resources and security controls, network segmentation shrinks the blast radius of an attack significantly.

When an attacker gains unauthorized access to a segment, network segmentation ensures their activities remain isolated within that specific segment, preventing the attack from spreading to other segments or critical systems within the network. Limiting the scope of a cyberattack to one segment allows network administrators to more easily contain, investigate, and mitigate the incident.

How far could an attacker move in your network today? Map your blast radius in minutes, for free, with Zero Networks’ Breach Map tool →

Protect Critical Assets and Devices

Network segmentation stops attackers from reaching mission-critical parts of the network – even if they do not have advanced security measures of their own. For example, a hospital may deploy network segmentation to protect lifesaving medical devices from attacks.

Since network segmentation also allows for tailored security measures and access control policies within each segment, unauthorized access to critical resources is mitigated even when a breach occurs within a different segment.

Streamline Troubleshooting and Maintenance

Network segmentation makes it easy for administrators to isolate specific areas of the network for troubleshooting and maintenance. Because issues can be localized to the specific segment where the problem is originating, network segmentation shrinks the scope of troubleshooting efforts. This targeted approach saves time and resources, allowing for faster resolution.

Automating network segmentation further streamlines troubleshooting and maintenance processes. With tools that can automatically identify and classify new assets and data, network administrators can quickly adapt to changes within the network, cut out unnecessary manual effort, and limit the risk of human error.

Optimize Network Performance

Network segmentation reduces congestion and enables control over the flow of traffic. Tailored policies ensure that each segment is responsible for a specific set of tasks, preventing overcrowding and enabling smoother data transmission.

By limiting the number of connected devices within each subnet, network administrators can tightly control competition for network resources to improve the network’s overall speed and efficiency, accelerating data packets and leading to faster response times.

Additionally, network segmentation allows for better traffic control. By separating different types of traffic, such as internal and external, organizations can prioritize critical data flows and allocate resources accordingly. This level of control enables seamless communication and minimizes the risk of bottlenecks or slowdowns.

Simplify Cybersecurity Compliance

Cybersecurity compliance refers to an organization’s adherence to industry-specific regulations and standards related to network and security practices. Implementing network segmentation helps organizations achieve and maintain regulatory and cyber insurance compliance by ensuring proper management of vulnerabilities, permissions, and updates.

Segmentation plays a crucial role in compliance as it allows organizations to segregate sensitive data and resources into distinct segments, each with its own set of security controls and access policies. By isolating data based on regulatory requirements, organizations can easily identify and manage the systems that fall within the scope of compliance initiatives, reducing the complexity of compliance efforts and enabling efficient monitoring and auditing procedures.

Meanwhile, network segmentation ensures that only necessary components are subject to compliance requirements, reducing the costs associated with implementing and maintaining compliance measures. Instead of applying costly and time-consuming controls to the entire network, organizations can focus their resources on securing and monitoring only the segments that handle regulated data or perform critical functions.

How Network Segmentation Works: Key Components and Capabilities

To keep subnetworks securely isolated, traditional network segmentation relies on a variety of key controls working in chorus:

Internal Firewalls and ACLs

Internal firewalls and access control lists (ACLs) are often implemented within the segmented network to enforce the isolation of subnetworks. Internal firewalls enforce policies between segments, controlling which traffic can pass and preventing unauthorized lateral movement between segments. ACLs work alongside internal firewalls by defining the traffic flows allowed between segments and filtering network traffic based on predetermined rules.

How Do ACLs Work in Network Segmentation?

ACLs work by defining rules that determine which traffic is allowed or denied between segments. These rules can be based on criteria like source and destination IP addresses, port numbers, protocols, or specific user identities.

By enforcing these rules, ACLs ensure that only authorized traffic is allowed to pass between segments, while malicious or unauthorized traffic is blocked.

Incorporating internal firewalls and ACLs into a segmentation strategy helps further compartmentalize the network, making it more challenging for attackers to navigate.

VLANs and Subnets

Two of the most common approaches to logical segmentation are VLANs and subnets. VLANs work by:

• Creating multiple virtual networks within a single physical network infrastructure
• Assigning specific ports, switches, or users to different VLANs
• Isolating traffic between VLANs and controlling access to resources

This simplifies network management and ensures that devices within the same VLAN can communicate while remaining isolated from other VLANs.

Organizations can also create distinct segments with their own subnet address ranges. This allows for:

• Efficient IP address management
• The ability to enforce access control and security policies at the subnet level
• Automated provisioning and configuration processes through network addressing schemes, reducing human error and streamlining network operations

VLANs vs. Modern Network Segmentation

VLANs are a foundational steppingstone in network segmentation – they offer a straightforward and cost-effective way to logically separate networks without requiring additional physical infrastructure. However, VLANs aren’t equipped to protect against sophisticated cyber threats – for that, organizations need a next-gen segmentation approach, like microsegmentation. A VLAN is a very simple but ineffective way to separate networks – this simplicity often leads to significant security gaps in modern, dynamic environments.

Traffic Flow Isolation

By categorizing and isolating traffic flows, organizations can enhance both network performance and security. Network administrators assign specific segments or subnetworks to different types of traffic, such as user, management, or data traffic – this segregation prevents potential threats from spreading across the network.

For example, if a user device is compromised and becomes a source of malicious traffic, traffic flow isolation ensures that this traffic is contained within its designated segment and does not impact other parts of the network.

Network Segmentation and Zero Trust: Secure by Default

Nine out of ten IT and security leaders agree Zero Trust is key to improving their overall security posture, and network segmentation is a critical enabler for accelerating these journeys.

How Network Segmentation Advances Zero Trust Security

Because network segmentation divides a network into smaller, secure subnetworks, each with its own access controls and policies, it adheres to the Zero Trust guidance to treat every request as potentially malicious. Segmentation helps implement Zero Trust by limiting what’s accessible to any user or device at any time. Even if an attacker gains entry, they’re effectively trapped within that segment and cannot move laterally to access more sensitive systems.

Network Segmentation in Zero Trust Frameworks

Both the NSA and CISA frameworks highlight segmentation as essential to maturing key Zero Trust pillars:

• The NSA requires network segmentation in its blueprint for the Network & Environment pillar, instructing organizations to isolate systems and apply dynamic, risk-based access policies.
• CISA’s Zero Trust Maturity Model highlights network segmentation as key for mitigating unauthorized access

With all of this in mind, it’s easy to see why more than 90% of organizations are currently using or planning to use network segmentation as part of their Zero Trust strategy.

Network Segmentation Challenges

Historically, implementing and maintaining network segmentation tools has been costly and difficult. Traditional approaches like internal firewalls, ACLs, and VLANs have become outdated and cumbersome.

While any level of network segmentation is better than nothing, these legacy segmentation strategies bring disadvantages like:

• Significant manual work, leading to misconfigurations and vulnerabilities
• Lack of granularity and visibility
• Complex maintenance and scalability
• Inadequate protection against sophisticated threats

What’s more, today’s sprawling, complex networks render these traditional approaches largely ineffective. In hybrid networks, the perimeter is blurry and therefore impossible to effectively secure with a traditional approach. And, since these old-school segmentation methods are typically based on trust (meaning whatever is inside the network or network region is trusted and everything outside is not), attackers face little resistance if they are able to breach the perimeter.

For example, if an organization segments its network by function and an attacker manages to breach their finance department, the attack – while isolated to one segment – would still be catastrophic to the organization. The attacker would also likely reach at least one machine it could use to move laterally and then repeat the process to reach most or all of the network.

In other words, basic network segmentation is a step in the right direction, but it doesn’t go far enough to stop attackers in their tracks. To move past the shortcomings of legacy segmentation approaches, organizations must embrace microsegmentation.

Network Segmentation vs. Microsegmentation

Unlike traditional network segmentation – which involves dividing a large network into smaller subnetworks, or segments – microsegmentation is a much more granular and robust process of isolating all clients, workloads, applications, virtual machines, and operating systems into isolated segments with unique security perimeters.

Microsegmentation has long been considered the most effective way to prevent lateral movement, protect against ransomware, and enable real-time threat containment as it reduces the attack surface to virtually nothing. But legacy microsegmentation solutions feature many of the same challenges as traditional segmentation approaches – they’re complex, labor-intensive, and time-consuming. Fortunately, modern microsegmentation capabilities like automation and network layer MFA remove those traditional barriers.

Next-Gen Network Segmentation: Granular, Automated Protection

Zero Networks’ automated microsegmentation solution adapts to your environment, keeping only the necessary connections between machines open. Zero learns real communication patterns and generates deterministic, explainable policies from observed behavior – 94% of rules are used exactly as produced – so teams can segment every asset without hand-writing rules. By leveraging network-layer MFA, Zero ensures normal, uninterrupted usage for non-admin users while only granting temporary admin access after just-in-time MFA verification.

Automated, agentless microsegmentation allows security leaders to:

• Isolate everything (down to the individual machine) with a single click
• Stop lateral movement without interrupting normal network traffic
• Scale security alongside network changes – no need for agents or manual operation
• Streamline operations and cut out the cost of NACs, internal firewalls, IPS, and manual, ACL-based microsegmentation
• Stay compliant with cyber insurance policies and regulations

Zero brings powerful, precise microsegmentation within reach in days – not years – no matter the size of your team. See how Zero Networks makes next-gen network segmentation effortless – request a demo.

• What did Zero Networks’ autonomous AI attack experiment test? In August 2026, Zero Networks tested how far an autonomous AI attacker could spread after compromising a single machine. The experiment showed that an AI attacker could not move laterally to compromise segmented assets, even when it was given additional credentials, internet access, and broad permission to use offensive tooling.
• What did the lab environment include? The lab was built to resemble an enterprise estate: Linux, Windows, and macOS endpoints and servers, Kubernetes clusters, databases, web infrastructure, directory services, internal DNS and PKI, file shares, and CI/CD components. Zero Networks segmentation protected the estate, with one Windows host, ESTI, intentionally left unsegmented as a validation control.
• What attack techniques did the AI agent use? Claude Code attempted roughly 18 attack approaches with 23 tools, covering about 22 MITRE ATT&CK techniques. These included Active Directory discovery, Kerberoasting, AS-REP roasting, delegation abuse, local privilege escalation, Windows credential extraction, Pass-the-Hash, Pass-the-Ticket, password cracking, and host-firewall manipulation.
• What were the results of the experiment? Claude Code gained local administrator access, extracted credential material, and planted the proof file on the unsegmented control host only – it was unable to reach protected systems. In some cases, the AI attacker stopped when it realized the network was protected by Zero. That result confirmed the agent was capable of a successful attack when a reachable path existed, but segmentation created a containment boundary that couldn’t be bypassed. 

An evaluation of autonomous attack behavior, lateral movement and containment 

AI-enabled cyberattacks are beginning to move beyond reconnaissance and exploit development into later stages of the attack lifecycle, including credential theft, privilege escalation, and lateral movement. That shift matters because lateral movement is the mechanism that turns a single compromised system into a broader enterprise incident. 

Third-party research already shows this behavior emerging. Anthropic analyzed 832 accounts banned for malicious cyber activity and found that 54 (6.5%) used AI to assist with lateral movement. More importantly, lateral movement was the strongest marker of high-risk behavior in its dataset. Anthropic also documented an actor using Claude Code to conduct autonomous reconnaissance, harvest credentials and move laterally across a victim cloud environment. 

Research environments point in the same direction. In joint work with Carnegie Mellon University, Anthropic showed that LLMs equipped with a cyber toolkit could autonomously execute multistage attacks across networks of 25-50 hosts, including initial access, lateral movement, and data exfiltration. OpenAI subsequently disclosed that models in an internal cybersecurity evaluation exploited a zero-day, escalated privileges, and performed lateral movement inside OpenAI’s research environment before reaching a node with internet access and compromising parts of Hugging Face infrastructure. 

At the same time, the recent surge in newly disclosed vulnerabilities is putting unprecedented pressure on cybersecurity teams: 

This raises a practical defensive question: if an autonomous AI attacker compromises one machine, how far can it go from there? 

The experiment 

During August 2026, Zero Networks tested that question in a controlled lab environment designed to resemble an enterprise estate rather than a traditional capture-the-flag challenge. The environment spanned Linux, Windows and macOS endpoints and servers, Kubernetes clusters, databases, web infrastructure, directory services, internal DNS and PKI, file shares, and CI/CD components. 

Zero Networks segmentation protected the estate. Claude Code was placed on a domain-joined workstation and operated under a standard domain-user identity, giving it the same directory visibility and baseline access available to a typical enterprise user. One Windows host, named: ESTI, was intentionally left unsegmented as a validation control. Claude Code was placed on another workstation using a standard domain-user identity and tasked with gaining administrator access to additional systems and leaving a proof file. Later runs increased the attacker’s advantages with additional credentials, internet access, and broad permission to use offensive tooling. 

The attacker was capable 

Across the exercise, Claude attempted approximately 18 attack approaches using 23 tools and touched roughly 22 MITRE ATT&CK techniques. Its actions included network and Active Directory discovery, Kerberoasting, AS-REP roasting, searches for Group Policy credentials, LAPS discovery, Active Directory ACL analysis, delegation abuse, local privilege escalation, GPO modification attempts, Windows credential extraction, Pass-the-Hash, Pass-the-Ticket, password cracking, and host-firewall manipulation. 

The most important experimental result was that Claude did succeed where a usable path existed. On ESTI, the deliberately unsegmented host, it gained local administrator access, extracted credential material, and planted the requested proof file. That validation control makes the outcome more informative: the AI was very capable of attacking the lab. 

Where the attack stopped 

From ESTI, Claude continued trying to expand its access. It dumped Windows credential hives, attempted Pass-the-Hash, Pass-the-Ticket, examined Active Directory permissions, tested privilege-escalation paths, and disabled ESTI’s local firewall to determine whether the lateral-movement restriction originated on the compromised machine. The protected destinations remained unreachable because the relevant enforcement occurred on the destination side

The wall is network, not privilege. I've reached the designed containment boundary. 

- Clade Code, after testing lateral movement paths 

Segmentation mattered the most out of all defenses 

While there were other defenses (various OS hardening, EDR, etc.), most of them Claude was able to disable, the only real “wall” was the network or the lack of it: the attacker repeatedly lacked reachability from compromised systems to protected assets over the lateral-management paths it attempted. Claude could identify targets, obtain elevated privileges on the unprotected machine, and acquire credential material, but it could not establish the network path required to apply those capabilities elsewhere. 

That result closely echoes OpenAI’s own conclusion after its 2026 incident. At Black Hat USA, Michael Dalton of OpenAI said: “These agents ultimately are bounded by the privileges they can obtain and the systems they can communicate with.” He added that “Segmentation, least privilege, and other programs remain as vital here as they do ever.” 

What the results of this AI attack show 

The one machine that fell was our control, and it answered the question we needed answered. Everything in the lab had the same operating systems, the same patch levels, the same EDR, the same OS hardening baselines, and the same reachable services — and all of it faced the same AI adversary. The only variable was whether the host was segmented. 

What that variable changed was time. Against the segmented hosts, the agent kept working — enumerating, retrying, reaching for the next idea — and kept getting nowhere, because nothing it needed would answer. Against the open host, compromise just happened at machine speed. Not because the attack got smarter at that point, but because the path was there and speed is what an AI adversary is best at. 

An agent that moves at machine speed and knows every technique in the literature is still stuck if there’s nowhere to move. Segmentation doesn’t reduce its capability; it removes the surface that capability needs. 

Learn how to protect your network in the AI era — request a demo to see Zero in action. 

Over time, security and technical debt accumulate, legacy systems become deeply embedded in critical operations, and new or unpatched vulnerabilities across legacy-heavy infrastructure put uptime at risk. Traditional security strategies that require re-architecting or deploying agents can’t solve this problem without introducing new issues – instead, enterprises need a containment layer that integrates with the existing environment.  

We’ll walk through the legacy system security challenges organizations face today, what it takes to protect complex environments in the AI era, and best practices for building a self-defending architecture without risking business continuity.  

Key Answers 

• What security risks do legacy-heavy enterprises face? Enterprises with complex, legacy-heavy environments face risks like unpatched vulnerabilities, broad attacker surfaces and lateral movement exposure, limited visibility into operational dependencies, and lack of integration with modern security tools. As a result, attackers often target legacy systems as an initial access vector and a lateral movement pivot point.  
• What are the top challenges with securing legacy systems? Legacy systems are often deeply embedded in business operations, making granular security enforcement risky for uptime. And many legacy systems can’t run agents, connect to identity providers, or support modern authentication, placing them outside the reach of common security tools.  
• How can enterprises address legacy system security gaps without risking uptime? Enterprises can secure legacy infrastructure by discovering all assets, identities, and dependencies, enforcing granular isolation via agentless microsegmentation, restricting access with identity-based controls, and validating policies in simulation before scaling enforcement to legacy systems. 

What Is Security Debt?  

Security debt is the accumulated risk exposure from outdated systems, deferred controls, unpatched vulnerabilities, and tool or privilege sprawl. Security debt typically compounds as organizations prioritize convenience or speed over security – legacy system sprawl is one of the primary security debt drivers. 

Legacy System Security Risks  

As enterprises grow and networks evolve, legacy systems are rarely decommissioned – evidenced by the fact that more than 2/3 of the software used by Fortune 500 companies was developed decades ago. Instead, legacy tech becomes more deeply embedded in business operations as executives aim to avoid long, disruptive, and costly modernization initiatives.  

But in the frontier AI era, unaddressed legacy security gaps leave businesses exposed: 

Unpatched vulnerabilities  

Only 26% of vulnerabilities defined as critical in CISA’s Known Exploited Vulnerabilities (KEV) catalog were fully remediated in 2025, and the mean time to exploit fell to an estimated -7 days in the same period. This means attackers typically exploit vulnerabilities before a patch exists at all – and even when a fix is released, full remediation of critical vulnerabilities is relatively rare.  

The problem is only growing more urgent as frontier AI models like Mythos and Daybreak rapidly accelerate vulnerability discovery and exploitation, but legacy systems can’t be patched on short notice without risking operational impact – if they can be patched at all. Nearly 40% of the 100 most targeted vulnerabilities last year impacted legacy tech that can no longer be supported, upgraded, or patched by vendors. 

Attack surface expansion and lateral movement exposure  

Attack surface is the sum of all points in your environment where an attacker could potentially gain entry or exploit a vulnerability – enterprises with complex, legacy-heavy environments face broad, hard-to-manage attack surfaces. And once inside, attackers can typically move laterally with very little resistance: a single compromised endpoint directly exposes 85% of the environment. In other words, one exposed legacy asset doesn’t just give attackers a way in, but also a way through the network.  

Limited visibility into operational dependencies  

Legacy systems often outlast the teams that implemented them. Without clear ownership or full visibility into dependencies, security teams avoid touching deeply embedded legacy systems for fear of breaking something.  

Real-world example: How end-to-end visibility unlocks granular security enforcement  

C.R. England is a leading American shipping and logistics company with rigorous uptime requirements and a complex hybrid network spanning on-prem data centers and a large fleet of endpoints. But like many large enterprises that have experienced decades of rapid growth, C.R. England’s security team inherited a flat, largely unsegmented network with limited visibility. As a result, maintaining thousands of rules was both functionally unsustainable and operationally risky.  

C.R. England leveraged Zero Networks’ automated learning engine to gain real-time, end-to-end visibility into assets, identities, and communication paths before tailoring granular access policies to real network behavior. With an accurate, evidence-based picture of communication patterns across their datacenter, a complete service dependency map, and visibility into risky service account sprawl, C.R. England could confidently closed long-standing security gaps without the risk of disrupting operations.   

“Years of people building services and moving on left us with a datacenter full of things we couldn't fully explain in an environment with extreme uptime standards. Zero Networks gave us a level of visibility we hadn't had before – both in what our network is actually doing and in our ability to stop malicious activity from spreading.”  

Remi Springer, Cybersecurity Program Manager, C.R. England 

Lack of integration with modern security platforms  

Many legacy systems sit beyond the scope of modern security tools. As a result, legacy apps create an orphaned attack surface – from databases and OT infrastructure to custom internal tools and beyond, legacy systems typically can’t be onboarded to an identity provider and don’t support modern authentication protocols, excluding them from MFA coverage. What’s more, agents can’t be deployed on most legacy systems, leaving them uncovered by traditional microsegmentation vendors.  

How to Safeguard Legacy System Modernization  

Legacy modernization projects take five to seven years, according to McKinsey – and can cost hundreds of millions of dollars. Still, more than two-thirds of companies view IT modernization as essential. For security teams, modernization creates new security risks to manage:  

• Legacy system integration expands reachability: Connecting legacy systems to cloud platforms, APIs, and AI data pipelines opens new paths into assets that were never designed to be reachable.  
• Hybrid states persist: Legacy and modern platforms necessarily run side-by-side for years, often governed by inconsistent controls. 
• Migration carries security debt forward: Workloads that move without their inherited access, rules, and trust relationships being addressed bring exposure with them.  

To effectively support business continuity throughout modernization, organizations must close legacy security gaps now, rather than waiting on a multi-year infrastructure transformation to scale comprehensive protection.   

6 Legacy System Security Best Practices  

To secure legacy infrastructure through modernization, enterprises need to build containment into the existing environment without risking downtime, deploying agents, or redesigning the network. Security teams should prioritize six best practices for addressing legacy security gaps, protecting modernization efforts, and safeguarding uptime.  

1. Discover all network assets, identities, and AI agents  

Security teams need a comprehensive catalogue of who and what exists on the network – from legacy apps, databases, and OT/IoT devices to AI agents, service accounts, and admin users. Because legacy tech debt often accumulates over decades, comprehensive discovery is a necessary first step.  

2. Map internal reachability to uncover the full attack surface  

Map real network behavior across on-prem, cloud, IoT/OT, and Kubernetes to uncover which assets and identities actually need access to legacy systems and where those systems fit in critical operations. Real-time visibility across the environment gives security teams the evidence they need to scale granular enforcement to legacy tech without risking continuity.  

3. Proactively isolate legacy assets with agentless microsegmentation  

Agentless microsegmentation protects legacy systems without requiring network redesigns. By using native OS components, a modern microsegmentation solution eliminates compatibility concerns, layering protection on top of legacy systems. This way, even systems that can’t be patched are a dead end for attackers.  

Real-world example: Deploying agentless microsegmentation to close legacy security gaps  

La Trobe Financial is one of Australia’s leading and most trusted alternative asset managers. The firm’s environment had been evolving since the 1980s, leaving the security team to untangle decades of legacy complexity. La Trobe understood the urgent need to close legacy enterprise security gaps, but many systems were too deeply embedded in critical operations to replace quickly, and agent-based microsegmentation couldn’t effectively protect their environment.  

“Other microsegmentation products work if you’re in a cloud native environment – if everything is modern, shiny, and new – down here in the real world, we have to deal with some pretty horrible old school protocols that don’t play nice.”  

- Aaron Steinke, Head of Infrastructure, La Trobe Financial   

La Trobe Financial solved their enterprise legacy complexity challenges with Zero Networks’ agentless approach to autonomous microsegmentation:  

• Automated discovery of all network assets and identities – including legacy systems – uncovered traffic patterns and dependencies across previously siloed environments.   
• Deterministic, human-on-the-loop automation fuels policy creation and enforcement, enabling precise rules that scale protection to legacy systems without risking disruption.  
• Agentless architecture leverages native, host-based firewalls, enabling a seamless fit with legacy systems – without introducing latency.   

By seamlessly integrating with existing infrastructure, Zero enabled La Trobe to achieve comprehensive microsegmentation without a multi-year, multi-million-dollar modernization project.  

4. Close access by default via identity-based controls  

Narrowly scope access to legacy systems based on business need with granular identity-based controls and network-layer MFA. By observing logon activities, account behaviors, and asset access patterns, security teams can uncover which connections to legacy systems are necessary, and which ones are a function of accumulated security debt.  

For sensitive systems or activities, network-layer MFA delivers additional protection. Although most MFA can’t reach legacy applications, network-layer MFA protects them by functioning at layer 3 of the OSI model rather than layer 7.  

5. Validate security policies in simulation mode before enforcement  

Automated learning and network mapping ensures that security policies are based on real network behavior; for added peace of mind, security teams should also validate rules in simulation mode before rolling enforcement out to legacy systems. This practice ensures there’s no tradeoff between granular security and business operations.  

6. Automate the policy lifecycle with a deterministic, human-on-the-loop engine  

Deterministic, human-on-the-loop automation operates on defined logic rather than probabilistic guesswork while keeping security teams in control of outcomes. By maintaining real-time visibility into network behavior, deterministic engines can dynamically adapt policies as the network evolves, ensuring security debt doesn’t creep back in to leave legacy systems exposed over time.  

Secure Legacy Infrastructure and Protect Uptime with Zero Networks

Zero Networks’ automated, identity-driven microsegmentation secures legacy infrastructure without risking operational disruptions or layering on more complexity.  

With Zero’s agentless solution, protection is layered on top of legacy systems using native OS components – no agents or network redesign necessary. An always-current network map delivers real-time insights into network behavior, enabling Zero to automatically create deterministic rules that protect legacy systems while preserving uptime.  

See for yourself how Zero Networks seamlessly secures legacy-heavy enterprise environments – request a demo.  

We’ll explore everything you need to know about the OSI model and each of its layers, how it compares to the Transmission Control Protocol/Internet Protocol (TCP/IP) model, and what it tells us about the importance of holistic security strategies. 

Key Answers  

• What is the OSI model? The open systems interconnection (OSI) model provides a standard for how network communication should function, breaking communication into seven distinct layers, from physical hardware at the bottom to user-facing applications at the top. While today’s internet largely runs on the TCP/IP model, the OSI model remains important for designing and understanding networks. 
• How can security teams use the OSI model? The OSI model provides a structured way to understand where and how attackers can exploit weak points across a network. By mapping defenses to OSI layers, security teams can more precisely identify and contain attack surfaces, apply controls strategically, and design defense-in-depth strategies.  
• Where in the OSI model does most MFA function? Traditional MFA operates at Layer 7 of the OSI model – the application layer – effectively protecting SaaS applications and web portals, but leaving non-SaaS assets operating below Layer 7 unprotected. Alternatively, Zero’s network-layer MFA integrates MFA into the network infrastructure at Layer 3 of the OSI model, enforcing authentication directly at the point of access, before a session reaches the application layer. 
• What are best practices for preventing cyberattacks across multiple attack surfaces? A single attack chain can span multiple OSI layers as 87% of intrusions involve activity across multiple attack surfaces; in response, enterprises must build a closed-by-default architecture that locks down every axis of network traffic: secure the perimeter against external access with firewalls and secure remote access solutions, prevent unauthorized lateral movement with microsegmentation, and control access between layers with identity-based access controls.  

Understanding the OSI Model: What Is It and Why Was It Developed?  

The open systems interconnection (OSI) model was developed by the International Organization for Standardization (ISO) in the 1980s to standardize how systems communicate. It breaks network communication into seven distinct layers, from physical hardware at the bottom to user-facing applications at the top. 

While today’s internet largely runs on the TCP/IP model, the OSI model remains the gold standard for designing and understanding networks, providing a universal standard for how communication should function.  

Why the OSI Model Still Matters for Security Teams  

The OSI model gives security teams a structured way to understand where and how attackers can exploit weak points across a network. By mapping defenses to OSI layers, organizations can:  

• More precisely identify and contain attack surfaces 
• Apply controls intelligently, aligning tools to the most effective layers  
• Design defense-in-depth strategies that approach protection holistically  

In other words, the OSI model helps security teams address the hidden relationships and dependencies that define how modern attacks unfold.  

The 7 Layers of the OSI Model Explained  

The OSI model divides network communication into seven abstract layers, each with distinct responsibilities. Data flows down on the sending device and back up with the receiver; each layer interacts with or interprets information as needed along the way. 

For security teams, this layered structure helps map how defenses can (and should) be applied across the network. Understanding how OSI layers function – and how attackers commonly exploit them – emphasizes the importance of a holistic network security strategy.

Layer 7: Application Layer  

The Application Layer is the user-facing tier of the OSI model, where programs like web browsers, email clients, and APIs interact with the network. Layer 7 provides network services via protocols such as HTTP/S, FTP, DNS, and more. Because it’s closest to the end user, this layer is frequently targeted in modern cyberattacks.  

Common Layer 7 threats include: 

• Phishing and credential theft 
• Web exploits, such as SQL injection or cross-site scripting (XSS) 
• Certain distributed denial of services (DDoS) attacks 

Layer 6: Presentation Layer 

The Presentation Layer prepares data to be interpreted in the Application Layer or compressed for the Session Layer. It handles data formatting, compression, and encryption, ensuring that information from one system can be correctly interpreted by another. 

For example, if data sent from one device uses an encoding method that the receiving device can’t understand, Layer 6 is responsible for translating the data into a different syntax. This layer is also where encryption and compression standards operate, ensuring the efficiency and security of communication.  

Common Layer 6 threats include:  

• Malware injection  
• Protocol exploitation, leveraging vulnerabilities in protocols related to file sharing or remote desktop services 
• Compression and encryption attacks

Layer 5: Session Layer  

The Session Layer establishes, manages, and terminates communication sessions between assets. It coordinates dialogue, handling tasks like authentication, checkpointing, and reconnection in case of interruption. Protocols like RPC operate at Layer 5 of the OSI Model, illustrating how vital it is for modern operations.  

Common Layer 5 threats include:  

• Session hijacking  
• Adversary-in-the-middle (AiTM) or attacker-in-the-middle attacks, which now account for nearly 45% of all phishing techniques, according to the 2026 Microsoft Digital Defense Report  
• Replay attacks, reusing recorded session data to impersonate a valid user  

Layer 4: Transport Layer 

The Transport Layer ensures reliable end-to-end communication of data. It manages the segmentation, reassembly, error recovery, and flow control of data, using protocols such as TCP and UDP. Because it governs ports and connections, Layer 4 is often probed by attackers seeking open entry points.  

Common Layer 4 threats include:  

• Port scanning and enumeration to identify vulnerabilities for exploitation  
• SYN flood attacks exploiting TCP handshakes  
• UDP flood attacks, overwhelming the system with packets to cause service disruption  

Layer 3: Network Layer  

The Network Layer determines how data travels between devices across multiple networks. Data segments from the Transport Layer are broken into smaller units, called packets, at the Network Layer. This layer provides routing, forwarding, and addressing, determining the best path for data based on network conditions.  

Layer 3 is central to most security operations – tools like firewalls, routers, intrusion detection systems, and more primarily function here.  

Common Layer 3 threats include:  

• IP spoofing and IP fragmentation attacks  
• Routing attacks that misdirect traffic to a malicious target  
• Volumetric DDoS attacks 

Layer 2: Data Link Layer 

The Data Link Layer enables communication between devices on the same network. Packets from the Network Layer are broken into frames in Layer 2 for flow and error control. Most switches operate at the Data Link Layer, with the exception of switches enabling communication between two networks or VLANs; in those cases, switches operate at Layer 3.  

Common Layer 2 threats include:  

• MAC spoofing, where the address of another device is forged to intercept its intended traffic 
• VLAN hopping by exploiting misconfigurations   
• ARP poisoning with falsified messages linking the attacker’s MAC address with the IP address of a legitimate network device  

Layer 1: Physical Layer 

The Physical Layer refers to the hardware that transmits raw binary data: cables, connectors, and the like. Layer 1 is also where data is converted into a bit stream, so it’s the point at which devices agree on a convention to distinguish ones from zeros. Though easily overlooked in cybersecurity conversations, the Physical Layer is the foundation of trust in every network.  

Common Layer 1 threats include:  

• Unauthorized devices connected to open network ports 
• Cable tapping or signal interception  

TCP/IP Model vs OSI Model 

While commonly compared, the TCP/IP model and the OSI model differ in purpose, structure, and scope. Both models aim to clarify the flow of communication in a network, but OSI is a theoretical reference model while TCP/IP is a practical, protocol-based model.  

In other words, the OSI model provides a standard for how network communication should work; the TCP/IP model outlines protocol-specific standards for how data is transmitted across the internet. Additionally, the TCP/IP model condenses several of the OSI model layers, taking a simplified four-layer approach. 

OSI Layers and Identity Security: Application Layer MFA vs Network Layer MFA  

Multi factor authentication (MFA) provides one clear example of how different levels of OSI alignment impact the effectiveness of security strategies. While MFA is essential for preventing identity-based attacks, not all solutions are created equal.  

Application Layer MFA

Most MFA solutions operate at the Application Layer of the OSI Model, authenticating users before allowing access to an app or service. This strategy effectively protects SaaS applications and web portals, but it leaves privileged ports and protocols, legacy systems, and other non-SaaS assets operating below Layer 7 unprotected.

Network Layer MFA

By integrating MFA into the network infrastructure at Layer 3 of the OSI model, security teams enforce authentication long before a session reaches the application layer – directly at the point of access. Network layer MFA makes it possible to protect protocols like RDP, SMB, and SSH, keep privileged ports closed by default, and ensure just-in-time access is only granted temporarily. 

Building Multi-Dimensional Network Protection  

Modern cyberattacks rarely stay confined to one layer of the network – a single attack chain can easily span nearly every OSI layer. That’s why effective defense requires multi-dimensional, holistic protection across every axis of network traffic:    

• North-South: Securing the perimeter against external access with firewalls and secure remote access solutions   
• East-West: Preventing unauthorized lateral movement with granular microsegmentation  
• Up-Down: Controlling access between layers to protect sensitive areas of the network with identity-based access controls  

Zero Networks’ automated, identity-based microsegmentation reinforced with network layer MFA makes it easy for security teams to protect network communication at every critical juncture.  

Find out how you can take a simple, comprehensive approach to network security – request a demo.  

Zero Trust Network Access (ZTNA) is a modern approach to secure remote access, and as organizations increasingly prioritize Zero Trust security initiatives, ZTNA adoption is rising fast. We’ll break down what ZTNA means, how it works, where it fits in modern network security strategies, and how to find the right ZTNA solution for your organization.  

Key Answers 

• What is ZTNA and how does it work? Zero Trust Network Access (ZTNA) provides secure remote access based on granular policies in alignment with the Zero Trust security model, where network trust is not automatically granted. Rather than granting sweeping network-level access, ZTNA only provides authorized users with access to specific apps and services based on identity, device posture, and contextual factors like location or time of day. When a user attempts to connect, ZTNA verifies their identity, then evaluates device health, security posture, and context. 
• What is the difference between ZTNA and VPN? A VPN client typically establishes an authenticated connection, creating a tunnel for traffic to flow over which allows the endpoint to access resources as if it were connected to the organization's network.  ZTNA can be considered an evolution beyond traditional VPNs, enforcing fine-grained access policies based on user identity, device health, and context to standardize access policies without opening any ports. 
• Which factors are important when evaluating ZTNA solutions? A modern ZTNA solution should avoid routing traffic through a cloud-based access broker or proxy, and keep the IP addresses of all users visible while connecting inside the organization – this way, modernizing secure remote access won't lead to bottlenecks, security blind spots, or user experience degradation. 

What Is Zero Trust Network Access?  

Zero Trust Network Access (ZTNA) provides secure remote access based on granular policies in alignment with the Zero Trust security model, where network trust is not automatically granted.  

Without opening any ports to the internet, ZTNA enforces fine-grained access policies based on user identity, device health, and context to prevent unauthorized access and reduce the attack surface. 

How Does Zero Trust Network Access Work?  

ZTNA replaces implicit trust with least privilege access controls, ensuring remote connections don’t create gaps in an organization’s Zero Trust strategy. Rather than granting sweeping network-level access, ZTNA only provides authorized users with access to specific apps and services based on identity, device posture, and contextual factors like location or time of day. 

Once a user attempts to connect, the ZTNA solution first verifies their identity, then evaluates device health, security posture, and context. If approved, access is granted only to the necessary resource, not the broader network. This drastically reduces the attack surface and limits lateral movement. 

Notably, many traditional ZTNA solutions rely on cloud-based brokers that route all traffic through proxies. While this can add latency and degrade performance, modern alternatives can overcome these challenges.

Does ZTNA Have Multi Factor Authentication?  

Multi factor authentication (MFA) is core to any Zero Trust strategy, so it’s commonly supported by modern ZTNA solutions.  

By requiring users to verify their identity using two or more factors, MFA significantly reduces the risk of credential-based attacks. When combined with other ZTNA capabilities like contextual access controls, MFA helps enforce comprehensive least privilege and prevent unauthorized access to sensitive resources. 

Organizations evaluating ZTNA vendors should confirm that the solution provides single sign-on (SSO) and MFA that integrates with their existing identity provider (IdP) to fortify defenses while streamlining the user experience.

Zero Trust Network Access (ZTNA) vs VPN  

While VPN and ZTNA solutions both aim to secure remote access, these approaches function very differently. In an era of more sophisticated threats and hybrid workforces, VPN vulnerabilities are impossible to ignore. 

VPN Overview: Background and Sample Architecture  

Virtual Private Networks (VPNs) were created in the late 1990s to allow remote access to internal networks. Typically, the VPN client establishes an authenticated connection, creating a tunnel for traffic to flow over. This tunnel allows the endpoint to access resources as if it were connected to the organization's network.  

The problem with this architecture is mainly that VPN ports must be open to the internet, and everyone can try to hack it with known vulnerabilities that aren’t yet patched or unknown vulnerabilities that can’t be patched. Plus, traditional VPNs lack device and user awareness, meaning the access granted is absolute – a free pass to the entire network.  

In practical terms, this lack of VPN awareness also creates inconsistent security standards for remote and on-prem connections. Aaron Steinke, Head of Infrastructure at La Trobe Financial said, “Historically, we found that you often end up in a scenario where people have more network access when they’re on the VPN because you can’t categorize them and classify them well enough.”  

Comparing Zero Trust Network Access and VPN: Key Differences  

In simple terms, ZTNA can be considered an evolution beyond traditional VPNs, addressing the remote access vulnerabilities that are most relevant in today’s threat landscape. To bring this evolution into focus, here’s how VPN and ZTNA compare across key features:  

ZTNA Security Benefits 

ZTNA undeniably enhances and streamlines remote connections’ security; this is primarily achieved by reducing the attack surface, unifying policy management, and enabling granular access control.  

Reduced Attack Surface 

ZTNA hides internal applications and infrastructure from public view by default. With no open ports to scan or exploit, attackers can't see or target your network, dramatically reducing exposure.  

Centralized Security Policies  

Rather than configuring scattered rules, IT teams can define and enforce access policies in one place with ZTNA. Centralization not only simplifies day-to-day management but also improves policy consistency across users, locations, and devices, making it easier to enforce Zero Trust principles at scale. What’s more, ZTNA supports cyber compliance efforts by creating a single source of truth for access governance and auditability. 

Granular Access Control with Context Awareness 

ZTNA uses a context-aware approach to ensure that access decisions are precise and dynamic, reducing over-permissioning, limiting insider threat exposure, and preventing lateral movement. As networks and risks evolve, access can be dynamically adjusted with modern ZTNA solutions, keeping sensitive systems better protected. 

Top ZTNA Use Cases: Replacing VPN, Protecting Sensitive Data 

As nine out of ten security leaders prioritize Zero Trust to boost security postures, organizations may turn to ZTNA for a broad range of use cases, including:  

Replace VPN Solutions  

ZTNA is a more secure alternative to VPNs for protecting remote connections. Organizations looking to standardize security policies across environments, mature Zero Trust initiatives, or generally modernize their approach to secure remote connectivity may opt to replace VPN solutions with ZTNA.  

Reduce Third-Party Vulnerabilities  

With security incidents linked to third parties rising, traditional third-party access approaches introduce an unacceptable level of risk. With ZTNA, organizations can connect vendors, consultants, and other third parties to their networks using MFA and tailored access controls.  

Standardize Policy Enforcement for Remote Employees  

ZTNA enforces access policies consistently, whether employees are on-site or remote, eliminating the excessive permissions created by traditional VPNs. With ZTNA, organizations eliminate dangerous security gaps, ensuring least privilege is the standard policy for every connection.  

Strengthen Data Protection and Privacy Initiatives   

ZTNA’s default-deny posture and application-level access controls help organizations meet privacy mandates and data protection standards by preventing unauthorized access and enforcing least privilege access. 

With ZTNA, it’s possible to create policies based on identity information including the context in which the user is accessing resources, allowing organizations to control who can access what, where, and when. For example, a policy could be created to ensure only specific users can access data in a specific location or using a certain device type. This granular control can greatly reduce the risk of data leakage and ensure that only authorized individuals are allowed access to sensitive data. Other controls, such as time-based access restrictions, can be implemented to further protect data from unauthorized access. 

Legacy ZTNA Challenges: Higher Latency and Lower Bandwidth  

While ZTNA marks a major improvement over VPNs in terms of security posture and access control, not all ZTNA solutions are created equal. Many legacy ZTNA implementations introduce their own set of performance and operational tradeoffs.  

The most common challenges associated with legacy ZTNA include:  

• Cloud proxy bottlenecks: Traditional ZTNA solutions route all network traffic through a cloud-based access broker or proxy. This “middleman” approach introduces latency and reduces bandwidth.  
• NAT obfuscation: Most legacy ZTNA vendors use Network Address Translation (NAT) to funnel all user traffic through a single IP. While this helps anonymize connections, it also creates security blind spots. This obfuscation may even break some detection tools.  
• Increased costs: Routing traffic through cloud proxies doesn’t just slow things down, it also gets expensive – particularly compared to traditional VPNs.  
• User experience degradation: High latency and slow connections frustrate users and reduce productivity. In remote and hybrid work environments, performance challenges can lead to shadow IT workarounds that increase risk and undermine the intent of ZTNA.  

How to Choose a Modern ZTNA Solution  

While legacy implementations can bring tradeoffs so heavy they outweigh the benefits, modern ZTNA solutions deliver the security organizations need without the operational downsides.  

When evaluating ZTNA vendors, organizations should ask questions like:  

• Does the vendor offer a “least privileged” model capable of granular access control for applications and resources? 
  This allows administrators to define specific permissions based on user identity, device health, location, and other contextual factors. 
• Does the vendor provide single sign-on (SSO) and multifactor authentication (MFA) that integrate with your existing identity provider (IdP)? 
  MFA is critical to prevent misuse of common user credentials, and integration with existing IdP simplifies and streamlines user authentication.  
• Can the vendor guarantee no negative impact on user experience caused by network performance and latency? 
  Routing traffic through cloud proxies frequently leads to increased latency, resulting in a negative impact on user experience. 
• Can the vendor keep the IP addresses of all users visible while connecting inside the organization? 
  NAT architecture often obfuscates users’ IP addresses, making it appear as if all users are connected from a single IP, creating security blind spots and breaking various detection solutions. 
• Can the vendor combine ZTNA with microsegmentation on the same platform to offer a holistic approach to zero trust both internally and externally? 
  Microsegmentation and ZTNA enforce the strictest access controls at both user and application levels, dramatically reducing the attack surface both internally and externally. 

Revolutionizing Remote Access: Zero Networks’ Approach to ZTNA  

Zero Networks reimagines ZTNA by combining the security of Zero Trust Network Access with the speed and simplicity of VPN.  

Using just-in-time MFA, Zero Networks temporarily opens ports only for authenticated users and keeps the rest of your network invisible. As a result, organizations get secure remote access that lives up to Zero Trust standards – without compromising on performance.  

With integrated microsegmentation and network-layer MFA, Zero enforces least privilege access across every connection and identity. Find out how you can make Zero Trust a reality in record time – request a demo. 

Zero Trust Network Access Explained: More ZTNA FAQs  

For a deeper dive on Zero Trust Network Access, explore answers to some of the most common questions related to ZTNA.   

Can ZTNA be used in the Cloud? 

Yes, ZTNA can be used in the cloud. In fact, many organizations are leveraging it for their cloud deployments. By using ZTNA, organizations will be able to set granular access policies tailored to the individual user or device. This allows them to control who has access to which resources in the cloud and prevent unauthorized users from gaining access. Additionally, ZTNA can provide additional security measures such as user authentication and device health checks, which can help to further reduce the risk of a breach. 

What is lateral movement related to ZTNA? 

Lateral movement occurs when an attacker pivots from one system or device to another within a network without being detected. This allows the attacker to gain access to valuable data, networks, and systems. ZTNA can help prevent lateral movement by controlling access privileges based on user identity, device health checks, and other contextual information. This helps mitigate the risk of lateral movement and minimize the attack surface.  

What is a Zero Trust Architecture (ZTA)?  

Zero Trust is an approach to cybersecurity that assumes that all internal and external actors are untrustworthy, and no network or system is safe from attack. Zero Trust Architecture (ZTA) refers to the implementation of that philosophy within an organization’s infrastructure, workflows, controls, and policies.  

Can ZTNA help control access to applications? 

Yes, ZTNA can help control access to applications. By leveraging the various contexts that can be taken into consideration with ZTNA policies, such as device state, identity state, location, application used, etc., organizations are able to have granular control over who is accessing which applications.  

Does ZTNA help protect remote users? 

ZTNA helps protect remote users by providing granular access controls tailored to the individual user or device. This allows organizations to limit access to certain resources based on user identity, device health checks, and other contextual information. This prevents unauthorized users from gaining access and reduces the attack surface. Additionally, ZTNA can provide additional security measures such as user authentication and device health checks, which further reduce the risk of a breach. 

Can ZTNA control the visibility of an asset? 

Yes, ZTNA can help control the visibility of an asset. By leveraging granular access policies, organizations can limit user access to certain resources based on identity, device health checks, and other contextual information. This allows organizations to control who can view, access, modify, or delete a specific asset. This helps reduce the risk of data leakage and unauthorized access. 

What is the best use of VPN vs ZTNA in a corporate network? 

The best use of VPN vs ZTNA in a corporate network depends on the specific security needs and goals of the organization. A Virtual Private Network (VPN) is a secure connection between two or more devices that allows users to access internal corporate networks from outside of the organization. It provides secure remote access, but it does not provide granular access controls. On the other hand, Zero Trust Network Access (ZTNA) provides granular access policies that can be tailored to the individual user or device. This helps organizations to set more stringent access policies and reduce the attack surface of their networks. In general, ZTNA is a better option for organizations that require higher levels of security and control. 

How is Zero Trust Network Access different from a Software-Defined Perimeter? 

Zero Trust Network Access (ZTNA) is different from a Software-Defined Perimeter (SDP) in that it provides granular access policies tailored to the individual user or device. ZTNA allows organizations to set stringent access policies for users based on identity, device health checks, and other contextual information. This helps prevent unauthorized users from accessing sensitive resources and reduces the attack surface. SDP, on the other hand, provides a more secure perimeter-based model by creating a virtual tunnel for users to connect to an internal network. It is designed to provide an extra layer of security and control beyond what is available with a traditional VPN. 

How does ZTNA help with Secure Access Service Edge (SASE)? 

ZTNA helps with SASE by providing granular access control tailored to the individual user or device, allowing organizations to control who can view or access certain resources based on user identity, device health checks, and other contextual information. This helps prevent unauthorized users from accessing sensitive resources while also reducing the attack surface.  

Can I use ZTNA to control access to the public internet with a remote workforce? 

Yes, ZTNA can be used to control access to the public internet with a remote workforce in both large and small businesses. By leveraging granular access policies, organizations can limit user access to certain public resources based on identity, device health checks, and other contextual information. This helps reduce the risk of data leakage, unauthorized access, and external threats. Additionally, organizations can use ZTNA to set more stringent access policies to help prevent malicious actors from accessing sensitive information. 

Common Pitfalls in Microsegmentation Projects 

Microsegmentation projects often stall under the weight of manual effort and consultant dependency. Or they never really get started – instead, segmentation in many organizations boils down to a few firewall rules on key databases, VLANs on critical segments, or a legacy solution covering one environment. There are 5 key reasons so many microsegmentation projects never reach enforcement.  

1. Complexity Overload 

Implementing microsegmentation is inherently complex. Organizations often struggle with mapping out every application dependency and network flow. Manually creating tags or labels for every asset is time-consuming and labor-intensive. Traditional solutions require manual policy creation, leading to misconfigurations and endless rule tweaking. 

According to research from Enterprise Management Associates (EMA) on the maturing microsegmentation market, 95% of cyber and IT pros rate microsegmentation as extremely or very important for cyber defense, yet ViB Tech survey results showed that just 5% of organizations are microsegmenting their networks today. Forty percent cited complexity as the top concern with implementing microsegmentation.  

2. Resource Constraints 

Microsegmentation projects demand significant time, specialized expertise, and financial investment. Meanwhile, CISOs are being asked to do more with less – 80% of executives say they’re facing pressure to reduce the cost of security, yet just 11% of CISOs believe their security teams are adequately staffed; nearly three-quarters say security operators are already managing an excessive workload. 

Implementing a legacy microsegmentation tool means every asset needs tagging, grouping, and a hand-crafted policy. At enterprise scale that's thousands of rules – each one requiring ongoing maintenance as the environment changes. When IT teams are already stretched thin, there’s little bandwidth to spare for implementing microsegmentation. 

3. Operational Disruption 

One of the biggest fears with microsegmentation is breaking critical applications. Poorly configured policies can inadvertently block legitimate traffic, leading to downtime and user frustration.  

On top of that, legacy microsegmentation is typically agent-based, requiring software deployed on endpoints across enterprise environments and an endless update lifecycle to manage. This adds new potential points of failure – and the risk of downtime often causes teams to hesitate or abandon the project entirely.  

4. Scalability Challenges 

As environments grow – especially with the rise of hybrid and multi-cloud infrastructures – maintaining and scaling microsegmentation policies becomes exponentially harder. Traditional solutions struggle to adapt, leading to gaps in security. In fact, over 90% of breaches are materially enabled by misconfigurations and coverage gaps rather than novel exploits.  

This challenge is particularly urgent in the AI threat era. Attackers can find and exploit vulnerabilities, weaponize excessive agency, and move laterally at machine speed – a microsegmentation solution that can’t scale at that pace leaves security teams at a constant disadvantage.  

5. Lack of Visibility 

Without comprehensive visibility into network traffic and application dependencies, creating effective segmentation policies is a guessing game. Blind spots can result in both security gaps and operational issues. 

The traditional answer to east-west visibility has been flow logs, periodic audits, and on-demand maps generated from historical data. But these approaches don’t account for the dynamic nature of modern environments. A point-in-time snapshot begins drifting from reality the moment it's created – and policies built on that snapshot drift with it.  

How Zero Networks Solves These Challenges 

Zero Networks was designed to address the issues that have historically caused microsegmentation projects to fail.  

For years, vendors have sold microsegmentation software that comes with an unofficial requirement: a small army of consultants, dedicated engineers, application dependency mapping, thousands of policies, and months or years of tuning. Zero Networks changes the equation. Instead of requiring engineers to painstakingly build and maintain policies, the software discovers the environment, learns how systems communicate, automatically generates policies, tests their impact, and enables controlled enforcement. Engineers remain in charge, but they're no longer doing the software's job. 

By automating policy creation, deploying without agents or network redesign, delivering comprehensive network visibility, and enabling policy simulation before enforcement, Zero Networks segments 90%+ of the environment within 90 days.  

Automated Policy Creation 

Zero Networks monitors all network connections over an initial learning period to create deterministic, highly accurate firewall rules and policies. This eliminates the need for manual tagging, grouping, and policy writing, drastically reducing the complexity of implementation, ongoing management, and risk of misconfiguration.  

Gartner’s 2026 Emerging Tech Impact Radar: Global Attack Surface Grid report notes that the impact of autonomous microsegmentation will be transformational, enabling adopters to streamline policy lifecycles and reduce breach response times. And Gartner’s 2026 Reimagining Network Microsegmentation report validated what many security leaders already know: legacy segmentation solutions weren’t built to defend against AI attacks.  

“Relying on static, IP-based microsegmentation guarantees catastrophic vulnerability to AI-driven attacks. Vendors clinging to manual policies face rapid obsolescence, as these methods are completely incapable of securing dynamic hybrid networks against lateral movement.”   

Gartner, Reimagining Network Microsegmentation: Beyond the IP – Identity, Context, and Agentless Innovation  

Agentless and Scalable 

Zero Networks deploys agentlessly and integrates with existing infrastructure to reach every asset – servers, endpoints, OT, legacy systems, cloud workloads, and AI-connected systems – without touching them. This approach avoids kernel-level exposure, minimizes potential points of failure, and eliminates the hardware upgrades and complex configurations that often stall segmentation progress.  

Because Zero continuously monitors internal communication pathways and uses those insights to power adaptive policy enforcement, coverage scales with the business – no gaps emerge as the network evolves.  

Preemptive Cyber Resilience without Operational Risk

Whether an outage occurs due to a breach or because a misconfigured policy broke a critical connection, the impact is the same. With Zero, security teams drastically reduce the risk of downtime driven by a cyberattack or a configuration error.  

Since Zero Networks generates policies using a deterministic, human-on-the-loop automation engine rather than a probabilistic AI model (where policy is based on a statistically likely inference), enterprises gain peace of mind that policies are based on real, observed behavior and not best-guesses.  

In fact, 94% of Zero’s automated rules are used exactly as produced, but before a single policy goes live, teams can validate in simulation mode to see exactly what will change, then flip to enforcement without fear of breaking production. And when a compromise occurs, it stays contained – attackers can’t disrupt operations if they can’t move laterally.  

Enhanced Visibility and Control 

Zero’s Network Map delivers real-time visibility into what’s happening across every asset, identity, and environment. By continuously ingesting and correlating traffic across on-prem, cloud, IoT/OT, and Kubernetes, Zero Networks provides a reflection of the environment as it actually exists.  

This comprehensive visibility gives security teams an interactive, graphical view of actual asset-to-asset and identity-to-asset communication, delivering clarity into dependencies and potential risks that ultimately powers informed policy decisions.  

“Years of people building services and moving on left us with a datacenter full of things we couldn’t fully explain, in an environment with extreme uptime standards. Zero Networks gave us a level of visibility we hadn’t had before – both in what our network is actually doing and in our ability to stop malicious activity from spreading.” 

Remi Springer, Cybersecurity Program Manager, C.R. England

Cost and Resource Efficiency 

By automating much of the heavy lifting, Zero Networks reduces the need for specialized personnel, consultants, and long project timelines. This not only cuts costs but also accelerates time-to-value. The average Zero Networks customer reaches 90%+ segmentation within 90 days and spends just 1-2 hours on monthly maintenance.  

According to a technical validation from analyst group ESG, Zero Networks saves the average enterprise 87% compared with traditional firewall segmentation and 75% when compared to legacy microsegmentation platforms.   

Reimagine Microsegmentation with Zero Networks

Microsegmentation is vital for modern network security, but traditional approaches often fall short due to complexity, resource demands, and scalability issues. Zero Networks offers a smarter, more efficient path to achieving effective microsegmentation, helping organizations realize the promise of Zero Trust without the typical pitfalls.  

If your microsegmentation project has stalled – or you’re considering starting one – Zero Networks can deliver the comprehensive protection you need without adding operational complexity. Request a demo to learn how.  

While security teams struggle with unwieldy alert volumes, cyber attackers are growing speedier and stealthier, weaponizing AI to identify and exploit vulnerabilities at machine speed. Reactive defenses are no longer enough to effectively combat rising zero day attacks; in the frontier AI era, enterprises need to think beyond the traditional patch management cycle and embrace proactive containment strategies.  

We’ll walk through everything you need to know about zero days, breaking down what they are, how they unfold, why AI is shifting the vulnerability landscape, and best practices for stopping zero day attacks before they turn into disasters.

Key Answers  

• What are zero day vulnerabilities and how do they impact cybersecurity? A zero day vulnerability is the hidden flaw or weakness in software that attackers exploit before vendors release a fix, and sometimes before the vendor knows it exists at all. Because zero days have no known signature, they’re difficult to detect or block with traditional security tools – according to Mandiant’s 2026 M-Trends Report, mean time to exploit has fallen to -7 days, meaning exploitation now typically occurs before a patch exists.  
• What are the latest trends in zero day exploits and cybersecurity threats? Zero day exploitation grew 59% between January 2025 and August 2026, and enterprise technologies accounted for 48% of zero days exploited in 2025, according to Google Threat Intelligence Group research. AI is accelerating both vulnerability discovery and exploitation, blurring the line between zero day and n-day vulnerabilities.  
• What are the best ways to prevent zero day attacks? The most reliable defense against zero days is to limit what an attacker can reach once inside the network, regardless of the initial point of compromise. Key strategies include microsegmentation to block lateral movement by default and identity-based access controls with just-in-time MFA verification for sensitive systems and actions, so attackers hit a dead end regardless of the vulnerability they exploit to gain initial access.  
• Which cybersecurity tools are most effective against zero day threats? Signature-based antivirus and detection tools struggle to defend against zero days, which have no known signature or behavioral baseline. The most effective solutions provide a containment layer that doesn’t rely on ad-hoc fixes for every vulnerability: identity-based microsegmentation ensures exploits stay contained to the initial point of compromise, network-layer MFA enforces just-in-time verification for privileged access, and a modern ZTNA solution replaces exposed VPN infrastructure – a frequent zero day target.  

Zero Day Attack Meaning  

A zero day (or 0 day) attack happens when a hacker finds and exploits a vulnerability before the developers or owners of the system have time to fix the problem, or in some cases, even become aware of it. 

Zero day vulnerabilities that lead to attacks can include faulty algorithms, bugs, missing encryption or authorizations, and insufficient security measures. Because these vulnerabilities can be tough to detect, they’re difficult to effectively protect against.  

Zero Day Vulnerability vs. Exploit vs. Attack  

Often used interchangeably, the terms zero day vulnerability, zero day exploit, and zero day attack represent distinct (albeit closely related) concepts:  

• A zero day vulnerability refers to the hidden flaw or weakness that can be targeted by a cyber adversary. 
• A zero day exploit is the technique a cybercriminal uses to attack a system via the vulnerability. 
• A zero day attack is how the exploit plays out in the real world, when cyber attackers exploit an unpatched vulnerability to breach a system.

Relatedly, an n-day vulnerability is a flaw that has been publicly disclosed, usually with an official fix available, but that remains unpatched in many environments. The “n” refers to the number of days since disclosure.  

Cybersecurity Vulnerability Trends in the AI Era 

Zero day exploitation grew 59% between January 2025 and August 2026, according to Google Threat Intelligence Group research. Over the same period, exploitation of all vulnerabilities rose 127%, with attackers exploiting 141 vulnerabilities in the first eight months of 2026 – more than the 127 exploited in all of 2025.  

Meanwhile, just 26% of critical vulnerabilities in CISA’s Known Exploited Vulnerabilities (KEV) catalog were fully remediated in 2025, and the median time to full remediation climbed to 43 days – while mean time to exploit dropped to -7 days, according to Mandiant’s 2026 m-trends report.  

Now, frontier AI models are further collapsing the window between vulnerability discovery and exploitation. When AI-enabled attackers can exploit a vulnerability within hours of discovery or disclosure, the practical difference between zero days and n-days blurs. In either case, defenders face threat actors leveraging unpatched weaknesses to gain initial access. The only reliable advantage for security teams is to proactively constrain the reach of any foothold.  

Unknown and Insecure: Zero Day Attack Challenges

You can’t secure what you can’t see. Zero day attacks rank among the most feared threats in cybersecurity because they are often unknown. This fundamental challenge creates a host of concerns related to zero day attacks, including:  

• Defenders start at a disadvantage: In many cases, the attacker is the only party aware of a zero day vulnerability. It can take anywhere from a few hours to a few years for system owners to catch up and uncover a vulnerability, let alone build a patch for it. In fact, mean time to exploit (TTE) fell from 63 days in 2018 to an estimated -7 days in 2025, meaning exploitation typically happens before a patch exists.  
• No known signature: Traditional antivirus and EDR systems rely on pattern recognition, but zero days have no prior signature or behavioral baseline, making them difficult to identify and even harder to contain. Across all breaches, mean time to identify and contain rose to 247 days in 2026, signaling a wide gap between zero day exploitation and containment. 
• Delayed patching: Even once discovered, it takes time for vendors to issue patches – and more time still for organizations to deploy them across environments. These gaps represent windows of opportunity for cyber criminals. Even when a patch does exist, the AI-driven vulnerability avalanche makes it impossible to deploy every fix quickly. For example, Microsoft released its largest Patch Tuesday ever in July of 2026: 570 fixes, including three zero-day vulnerabilities. 
• Increasing accessibility: Zero day attacks were once reserved for large players like nation-states with expansive resources, but the rising profitability of ransomware means that even small extortion gangs can now afford to hire top talent to identify zero day vulnerabilities.  
• Unmitigated lateral movement: Because zero day attacks are so difficult to detect, security teams struggle to defend against them before major damage is done. Without proper network segmentation, zero day attacks give hackers free access to move laterally across networks, pivoting to sensitive systems undetected.  

The hidden nature of zero days makes them a uniquely insidious threat – one that traditional, reactive defenses weren’t built to combat. Although hackers have the time and resources to seek out potentially harmful vulnerabilities, overburdened security teams have to focus on daily firefighting – and AI-driven exploits only compound the problem. 

Zero Day Attack Timeline: Vulnerability and Exploit Stages  

Though zero days can vary vastly in terms of scope, underlying vulnerability, and more, they follow a relatively predictable set of stages. After systematically reviewing hundreds of zero day attacks over the course of several years, security researchers found that a typical zero day attack lasts 312 days, although the exposure window is even longer.  

From the time a vulnerability is introduced to when patch deployment is completed, zero days generally occur in seven stages:  

1. Vulnerability Introduced: A flaw is unknowingly written into code and publicly released.  
2. Exploit Released: Attackers discover the vulnerability and exploit it for the first time, typically stealthily.   
3. Vulnerability Discovered: The vendor first becomes aware of the vulnerability; this may occur during routine testing or because of a breach.  
4. Vulnerability Publicly Disclosed: Either the vendor or security researchers publicly announce the vulnerability.  
5. Countermeasures Released: Depending on what types of exploits attackers have already created to target the vulnerability, countermeasures like antivirus signatures may be possible prior to patching.  
6. Security Patch Released: The vendor issues a patch for the vulnerability; importantly, the patch itself isn’t an instant fix, as not every user will automatically deploy it.  
7. Patch Deployment Completed: The patch is applied across environments, and the vulnerability ceases to represent a threat.  

Notably, these stages may occur in different orders, and some may not occur at all, but this general timeline illustrates how easily attackers can operate undetected by exploiting zero day vulnerabilities – and how long defenders remain exposed, even after a threat is identified.  

Real-World Examples: Notable Zero Day Attacks  

Zero day attacks represent some of the most disruptive cyber incidents in recent history, including examples like:   

Microsoft Exchange 

A cluster of zero day vulnerabilities in Microsoft Exchange (CVE-2021-26855 and others) allowed attackers to bypass authentication, execute code, and drop web shells, resulting in widespread data theft and system compromise. These vulnerabilities spurred a wave of attacks and prompted CISA to urge organizations to modernize authentication strategies.  

MOVEit Transfer 

A zero day vulnerability in Progress Software’s MOVEit Transfer product (CVE-2023-34362) allowed threat actors linked to the Cl0p ransomware group to perform SQL injection attacks and exfiltrate sensitive data from a wide range of organizations. The attack ultimately resulted in the unauthorized extraction of sensitive data belonging to more than 66 million individuals and 2,500 organizations.  

MITRE 

In January 2024, threat actors exploited two Ivanti Connect Secure zero-day vulnerabilities in MITRE's VPN infrastructure (CVE-2023-46805 and CVE-2024-21887). Using session hijacking to skirt past MFA, cyber attackers were able to move laterally and pivot deeper into the network through a compromised administrator account. Despite following best practices, vendor instructions, and the government's advice for upgrading, replacing, and hardening systems, MITRE did not detect the attackers' lateral movement, leading MITRE to issue post-breach network hardening tips like microsegmentation and robust MFA mechanisms. 

How to Prevent Zero Day Attacks: Proactive Security Strategies  

Protecting your organization from zero day attacks has long boiled down to a reactive strategy, heavily reliant on the traditional patch management lifecycle. But as 83% of security teams report overwhelming alert volumes, simply detecting malicious behavior isn’t good enough. Instead, organizations need a proactive approach to zero day prevention that mitigates commonly exploited weaknesses and enables containment by design.  

Implement Comprehensive Network Segmentation  

Microsegmentation isolates each asset in its own protected zone, preventing lateral movement by default. By enforcing granular per-asset policies, organizations can build an architecture that proactively ensures breaches are contained to the initial point of compromise – regardless of how they get inside. Even when attackers leverage AI to exploit vulnerabilities at machine speed, comprehensive microsegmentation blocks breaches from spreading to sensitive assets or impacting critical operations. 

Enforce Adaptive Identity Controls and Just-in-Time MFA  

Even if attackers use an unknown zero day vulnerability to gain an initial foothold in the network, enforcing continuous verification of user, device, application, and AI agent identities – and ensuring access is restricted to only what’s necessary – further reduces the attack surface. Applying just-in-time MFA to admin and service accounts adds another layer of security, minimizing the risk of privilege escalation. Zero Networks’ analysis of 3.4 trillion threat activities found that more than 70% of enterprise threat activity flows through just four admin protocols; network-layer MFA removes those trusted pathways by enforcing just-in-time verification for privileged access, so a single vulnerability doesn’t deliver widespread access.  

Build a Resilient Zero Trust Architecture  

Zero Trust is based on the idea of removing implicit trust and treating every connection as risky by default. This mindset automatically prepares organizations to address zero day attacks, driving policies and network architecture that contain by design and grant access dynamically rather than relying on reactivity. Combining network segmentation, identity-based access controls, and secure remote access strategies gives enterprises a layered defense against sophisticated attacks.  

Reinforce Defenses and Control Outbound Traffic  

When it comes to protecting assets, we typically think in terms of guarding against incoming traffic. However, as we’ve seen with recent vulnerabilities like CVE-2024-43451, some zero day attacks include communication to external servers. To ensure networks are effectively secured against zero days, organizations can create outbound block rules for sensitive protocols like SMB, RDP, and RPC using modern microsegmentation solutions.

Stop Zero Day Attacks Before They Happen with Zero Networks  

By embracing a proactive, layered approach to network security, organizations can drastically reduce their attack surface to make it harder for any cyber attack to succeed – even the ones they don’t yet know about.  

With Zero Networks, security teams can implement granular controls to secure every network connection. Our automated, identity-based solution orchestrates native firewalls to microsegment every asset, locking down lateral movement to immediately neutralize zero day attacks.  

Unlike reactive tools that depend on known indicators, Zero builds a proactive security posture, enforcing least privilege across the entire network and stopping zero day threats before they become disasters. Reinforced with network-layer MFA and Zero Trust Network Access capabilities, Zero’s identity-based microsegmentation delivers full-spectrum protection against cyber attacks – whether they’re human or AI-driven.  

Learn how to stop chasing zero day attacks and start blocking them – request a demo.