• What did Zero Networks’ autonomous AI attack experiment test? In August 2026, Zero Networks tested how far an autonomous AI attacker could spread after compromising a single machine. The experiment showed that an AI attacker could not move laterally to compromise segmented assets, even when it was given additional credentials, internet access, and broad permission to use offensive tooling.
• What did the lab environment include? The lab was built to resemble an enterprise estate: Linux, Windows, and macOS endpoints and servers, Kubernetes clusters, databases, web infrastructure, directory services, internal DNS and PKI, file shares, and CI/CD components. Zero Networks segmentation protected the estate, with one Windows host, ESTI, intentionally left unsegmented as a validation control.
• What attack techniques did the AI agent use? Claude Code attempted roughly 18 attack approaches with 23 tools, covering about 22 MITRE ATT&CK techniques. These included Active Directory discovery, Kerberoasting, AS-REP roasting, delegation abuse, local privilege escalation, Windows credential extraction, Pass-the-Hash, Pass-the-Ticket, password cracking, and host-firewall manipulation.
• What were the results of the experiment? Claude Code gained local administrator access, extracted credential material, and planted the proof file on the unsegmented control host only – it was unable to reach protected systems. In some cases, the AI attacker stopped when it realized the network was protected by Zero. That result confirmed the agent was capable of a successful attack when a reachable path existed, but segmentation created a containment boundary that couldn’t be bypassed. 

An evaluation of autonomous attack behavior, lateral movement and containment 

AI-enabled cyberattacks are beginning to move beyond reconnaissance and exploit development into later stages of the attack lifecycle, including credential theft, privilege escalation, and lateral movement. That shift matters because lateral movement is the mechanism that turns a single compromised system into a broader enterprise incident. 

Third-party research already shows this behavior emerging. Anthropic analyzed 832 accounts banned for malicious cyber activity and found that 54 (6.5%) used AI to assist with lateral movement. More importantly, lateral movement was the strongest marker of high-risk behavior in its dataset. Anthropic also documented an actor using Claude Code to conduct autonomous reconnaissance, harvest credentials and move laterally across a victim cloud environment. 

Research environments point in the same direction. In joint work with Carnegie Mellon University, Anthropic showed that LLMs equipped with a cyber toolkit could autonomously execute multistage attacks across networks of 25-50 hosts, including initial access, lateral movement, and data exfiltration. OpenAI subsequently disclosed that models in an internal cybersecurity evaluation exploited a zero-day, escalated privileges, and performed lateral movement inside OpenAI’s research environment before reaching a node with internet access and compromising parts of Hugging Face infrastructure. 

At the same time, the recent surge in newly disclosed vulnerabilities is putting unprecedented pressure on cybersecurity teams: 

This raises a practical defensive question: if an autonomous AI attacker compromises one machine, how far can it go from there? 

The experiment 

During August 2026, Zero Networks tested that question in a controlled lab environment designed to resemble an enterprise estate rather than a traditional capture-the-flag challenge. The environment spanned Linux, Windows and macOS endpoints and servers, Kubernetes clusters, databases, web infrastructure, directory services, internal DNS and PKI, file shares, and CI/CD components. 

Zero Networks segmentation protected the estate. Claude Code was placed on a domain-joined workstation and operated under a standard domain-user identity, giving it the same directory visibility and baseline access available to a typical enterprise user. One Windows host, named: ESTI, was intentionally left unsegmented as a validation control. Claude Code was placed on another workstation using a standard domain-user identity and tasked with gaining administrator access to additional systems and leaving a proof file. Later runs increased the attacker’s advantages with additional credentials, internet access, and broad permission to use offensive tooling. 

The attacker was capable 

Across the exercise, Claude attempted approximately 18 attack approaches using 23 tools and touched roughly 22 MITRE ATT&CK techniques. Its actions included network and Active Directory discovery, Kerberoasting, AS-REP roasting, searches for Group Policy credentials, LAPS discovery, Active Directory ACL analysis, delegation abuse, local privilege escalation, GPO modification attempts, Windows credential extraction, Pass-the-Hash, Pass-the-Ticket, password cracking, and host-firewall manipulation. 

The most important experimental result was that Claude did succeed where a usable path existed. On ESTI, the deliberately unsegmented host, it gained local administrator access, extracted credential material, and planted the requested proof file. That validation control makes the outcome more informative: the AI was very capable of attacking the lab. 

Where the attack stopped 

From ESTI, Claude continued trying to expand its access. It dumped Windows credential hives, attempted Pass-the-Hash, Pass-the-Ticket, examined Active Directory permissions, tested privilege-escalation paths, and disabled ESTI’s local firewall to determine whether the lateral-movement restriction originated on the compromised machine. The protected destinations remained unreachable because the relevant enforcement occurred on the destination side

The wall is network, not privilege. I've reached the designed containment boundary. 

- Clade Code, after testing lateral movement paths 

Segmentation mattered the most out of all defenses 

While there were other defenses (various OS hardening, EDR, etc.), most of them Claude was able to disable, the only real “wall” was the network or the lack of it: the attacker repeatedly lacked reachability from compromised systems to protected assets over the lateral-management paths it attempted. Claude could identify targets, obtain elevated privileges on the unprotected machine, and acquire credential material, but it could not establish the network path required to apply those capabilities elsewhere. 

That result closely echoes OpenAI’s own conclusion after its 2026 incident. At Black Hat USA, Michael Dalton of OpenAI said: “These agents ultimately are bounded by the privileges they can obtain and the systems they can communicate with.” He added that “Segmentation, least privilege, and other programs remain as vital here as they do ever.” 

What the results of this AI attack show 

The one machine that fell was our control, and it answered the question we needed answered. Everything in the lab had the same operating systems, the same patch levels, the same EDR, the same OS hardening baselines, and the same reachable services — and all of it faced the same AI adversary. The only variable was whether the host was segmented. 

What that variable changed was time. Against the segmented hosts, the agent kept working — enumerating, retrying, reaching for the next idea — and kept getting nowhere, because nothing it needed would answer. Against the open host, compromise just happened at machine speed. Not because the attack got smarter at that point, but because the path was there and speed is what an AI adversary is best at. 

An agent that moves at machine speed and knows every technique in the literature is still stuck if there’s nowhere to move. Segmentation doesn’t reduce its capability; it removes the surface that capability needs. 

Learn how to protect your network in the AI era — request a demo to see Zero in action. 

Over time, security and technical debt accumulate, legacy systems become deeply embedded in critical operations, and new or unpatched vulnerabilities across legacy-heavy infrastructure put uptime at risk. Traditional security strategies that require re-architecting or deploying agents can’t solve this problem without introducing new issues – instead, enterprises need a containment layer that integrates with the existing environment.  

We’ll walk through the legacy system security challenges organizations face today, what it takes to protect complex environments in the AI era, and best practices for building a self-defending architecture without risking business continuity.  

Key Answers 

• What security risks do legacy-heavy enterprises face? Enterprises with complex, legacy-heavy environments face risks like unpatched vulnerabilities, broad attacker surfaces and lateral movement exposure, limited visibility into operational dependencies, and lack of integration with modern security tools. As a result, attackers often target legacy systems as an initial access vector and a lateral movement pivot point.  
• What are the top challenges with securing legacy systems? Legacy systems are often deeply embedded in business operations, making granular security enforcement risky for uptime. And many legacy systems can’t run agents, connect to identity providers, or support modern authentication, placing them outside the reach of common security tools.  
• How can enterprises address legacy system security gaps without risking uptime? Enterprises can secure legacy infrastructure by discovering all assets, identities, and dependencies, enforcing granular isolation via agentless microsegmentation, restricting access with identity-based controls, and validating policies in simulation before scaling enforcement to legacy systems. 

What Is Security Debt?  

Security debt is the accumulated risk exposure from outdated systems, deferred controls, unpatched vulnerabilities, and tool or privilege sprawl. Security debt typically compounds as organizations prioritize convenience or speed over security – legacy system sprawl is one of the primary security debt drivers. 

Legacy System Security Risks  

As enterprises grow and networks evolve, legacy systems are rarely decommissioned – evidenced by the fact that more than 2/3 of the software used by Fortune 500 companies was developed decades ago. Instead, legacy tech becomes more deeply embedded in business operations as executives aim to avoid long, disruptive, and costly modernization initiatives.  

But in the frontier AI era, unaddressed legacy security gaps leave businesses exposed: 

Unpatched vulnerabilities  

Only 26% of vulnerabilities defined as critical in CISA’s Known Exploited Vulnerabilities (KEV) catalog were fully remediated in 2025, and the mean time to exploit fell to an estimated -7 days in the same period. This means attackers typically exploit vulnerabilities before a patch exists at all – and even when a fix is released, full remediation of critical vulnerabilities is relatively rare.  

The problem is only growing more urgent as frontier AI models like Mythos and Daybreak rapidly accelerate vulnerability discovery and exploitation, but legacy systems can’t be patched on short notice without risking operational impact – if they can be patched at all. Nearly 40% of the 100 most targeted vulnerabilities last year impacted legacy tech that can no longer be supported, upgraded, or patched by vendors. 

Attack surface expansion and lateral movement exposure  

Attack surface is the sum of all points in your environment where an attacker could potentially gain entry or exploit a vulnerability – enterprises with complex, legacy-heavy environments face broad, hard-to-manage attack surfaces. And once inside, attackers can typically move laterally with very little resistance: a single compromised endpoint directly exposes 85% of the environment. In other words, one exposed legacy asset doesn’t just give attackers a way in, but also a way through the network.  

Limited visibility into operational dependencies  

Legacy systems often outlast the teams that implemented them. Without clear ownership or full visibility into dependencies, security teams avoid touching deeply embedded legacy systems for fear of breaking something.  

Real-world example: How end-to-end visibility unlocks granular security enforcement  

C.R. England is a leading American shipping and logistics company with rigorous uptime requirements and a complex hybrid network spanning on-prem data centers and a large fleet of endpoints. But like many large enterprises that have experienced decades of rapid growth, C.R. England’s security team inherited a flat, largely unsegmented network with limited visibility. As a result, maintaining thousands of rules was both functionally unsustainable and operationally risky.  

C.R. England leveraged Zero Networks’ automated learning engine to gain real-time, end-to-end visibility into assets, identities, and communication paths before tailoring granular access policies to real network behavior. With an accurate, evidence-based picture of communication patterns across their datacenter, a complete service dependency map, and visibility into risky service account sprawl, C.R. England could confidently closed long-standing security gaps without the risk of disrupting operations.   

“Years of people building services and moving on left us with a datacenter full of things we couldn't fully explain in an environment with extreme uptime standards. Zero Networks gave us a level of visibility we hadn't had before – both in what our network is actually doing and in our ability to stop malicious activity from spreading.”  

Remi Springer, Cybersecurity Program Manager, C.R. England 

Lack of integration with modern security platforms  

Many legacy systems sit beyond the scope of modern security tools. As a result, legacy apps create an orphaned attack surface – from databases and OT infrastructure to custom internal tools and beyond, legacy systems typically can’t be onboarded to an identity provider and don’t support modern authentication protocols, excluding them from MFA coverage. What’s more, agents can’t be deployed on most legacy systems, leaving them uncovered by traditional microsegmentation vendors.  

How to Safeguard Legacy System Modernization  

Legacy modernization projects take five to seven years, according to McKinsey – and can cost hundreds of millions of dollars. Still, more than two-thirds of companies view IT modernization as essential. For security teams, modernization creates new security risks to manage:  

• Legacy system integration expands reachability: Connecting legacy systems to cloud platforms, APIs, and AI data pipelines opens new paths into assets that were never designed to be reachable.  
• Hybrid states persist: Legacy and modern platforms necessarily run side-by-side for years, often governed by inconsistent controls. 
• Migration carries security debt forward: Workloads that move without their inherited access, rules, and trust relationships being addressed bring exposure with them.  

To effectively support business continuity throughout modernization, organizations must close legacy security gaps now, rather than waiting on a multi-year infrastructure transformation to scale comprehensive protection.   

6 Legacy System Security Best Practices  

To secure legacy infrastructure through modernization, enterprises need to build containment into the existing environment without risking downtime, deploying agents, or redesigning the network. Security teams should prioritize six best practices for addressing legacy security gaps, protecting modernization efforts, and safeguarding uptime.  

1. Discover all network assets, identities, and AI agents  

Security teams need a comprehensive catalogue of who and what exists on the network – from legacy apps, databases, and OT/IoT devices to AI agents, service accounts, and admin users. Because legacy tech debt often accumulates over decades, comprehensive discovery is a necessary first step.  

2. Map internal reachability to uncover the full attack surface  

Map real network behavior across on-prem, cloud, IoT/OT, and Kubernetes to uncover which assets and identities actually need access to legacy systems and where those systems fit in critical operations. Real-time visibility across the environment gives security teams the evidence they need to scale granular enforcement to legacy tech without risking continuity.  

3. Proactively isolate legacy assets with agentless microsegmentation  

Agentless microsegmentation protects legacy systems without requiring network redesigns. By using native OS components, a modern microsegmentation solution eliminates compatibility concerns, layering protection on top of legacy systems. This way, even systems that can’t be patched are a dead end for attackers.  

Real-world example: Deploying agentless microsegmentation to close legacy security gaps  

La Trobe Financial is one of Australia’s leading and most trusted alternative asset managers. The firm’s environment had been evolving since the 1980s, leaving the security team to untangle decades of legacy complexity. La Trobe understood the urgent need to close legacy enterprise security gaps, but many systems were too deeply embedded in critical operations to replace quickly, and agent-based microsegmentation couldn’t effectively protect their environment.  

“Other microsegmentation products work if you’re in a cloud native environment – if everything is modern, shiny, and new – down here in the real world, we have to deal with some pretty horrible old school protocols that don’t play nice.”  

- Aaron Steinke, Head of Infrastructure, La Trobe Financial   

La Trobe Financial solved their enterprise legacy complexity challenges with Zero Networks’ agentless approach to autonomous microsegmentation:  

• Automated discovery of all network assets and identities – including legacy systems – uncovered traffic patterns and dependencies across previously siloed environments.   
• Deterministic, human-on-the-loop automation fuels policy creation and enforcement, enabling precise rules that scale protection to legacy systems without risking disruption.  
• Agentless architecture leverages native, host-based firewalls, enabling a seamless fit with legacy systems – without introducing latency.   

By seamlessly integrating with existing infrastructure, Zero enabled La Trobe to achieve comprehensive microsegmentation without a multi-year, multi-million-dollar modernization project.  

4. Close access by default via identity-based controls  

Narrowly scope access to legacy systems based on business need with granular identity-based controls and network-layer MFA. By observing logon activities, account behaviors, and asset access patterns, security teams can uncover which connections to legacy systems are necessary, and which ones are a function of accumulated security debt.  

For sensitive systems or activities, network-layer MFA delivers additional protection. Although most MFA can’t reach legacy applications, network-layer MFA protects them by functioning at layer 3 of the OSI model rather than layer 7.  

5. Validate security policies in simulation mode before enforcement  

Automated learning and network mapping ensures that security policies are based on real network behavior; for added peace of mind, security teams should also validate rules in simulation mode before rolling enforcement out to legacy systems. This practice ensures there’s no tradeoff between granular security and business operations.  

6. Automate the policy lifecycle with a deterministic, human-on-the-loop engine  

Deterministic, human-on-the-loop automation operates on defined logic rather than probabilistic guesswork while keeping security teams in control of outcomes. By maintaining real-time visibility into network behavior, deterministic engines can dynamically adapt policies as the network evolves, ensuring security debt doesn’t creep back in to leave legacy systems exposed over time.  

Secure Legacy Infrastructure and Protect Uptime with Zero Networks

Zero Networks’ automated, identity-driven microsegmentation secures legacy infrastructure without risking operational disruptions or layering on more complexity.  

With Zero’s agentless solution, protection is layered on top of legacy systems using native OS components – no agents or network redesign necessary. An always-current network map delivers real-time insights into network behavior, enabling Zero to automatically create deterministic rules that protect legacy systems while preserving uptime.  

See for yourself how Zero Networks seamlessly secures legacy-heavy enterprise environments – request a demo.  

We’ll explore everything you need to know about the OSI model and each of its layers, how it compares to the Transmission Control Protocol/Internet Protocol (TCP/IP) model, and what it tells us about the importance of holistic security strategies. 

Key Answers  

• What is the OSI model? The open systems interconnection (OSI) model provides a standard for how network communication should function, breaking communication into seven distinct layers, from physical hardware at the bottom to user-facing applications at the top. While today’s internet largely runs on the TCP/IP model, the OSI model remains important for designing and understanding networks. 
• How can security teams use the OSI model? The OSI model provides a structured way to understand where and how attackers can exploit weak points across a network. By mapping defenses to OSI layers, security teams can more precisely identify and contain attack surfaces, apply controls strategically, and design defense-in-depth strategies.  
• Where in the OSI model does most MFA function? Traditional MFA operates at Layer 7 of the OSI model – the application layer – effectively protecting SaaS applications and web portals, but leaving non-SaaS assets operating below Layer 7 unprotected. Alternatively, Zero’s network-layer MFA integrates MFA into the network infrastructure at Layer 3 of the OSI model, enforcing authentication directly at the point of access, before a session reaches the application layer. 
• What are best practices for preventing cyberattacks across multiple attack surfaces? A single attack chain can span multiple OSI layers as 87% of intrusions involve activity across multiple attack surfaces; in response, enterprises must build a closed-by-default architecture that locks down every axis of network traffic: secure the perimeter against external access with firewalls and secure remote access solutions, prevent unauthorized lateral movement with microsegmentation, and control access between layers with identity-based access controls.  

Understanding the OSI Model: What Is It and Why Was It Developed?  

The open systems interconnection (OSI) model was developed by the International Organization for Standardization (ISO) in the 1980s to standardize how systems communicate. It breaks network communication into seven distinct layers, from physical hardware at the bottom to user-facing applications at the top. 

While today’s internet largely runs on the TCP/IP model, the OSI model remains the gold standard for designing and understanding networks, providing a universal standard for how communication should function.  

Why the OSI Model Still Matters for Security Teams  

The OSI model gives security teams a structured way to understand where and how attackers can exploit weak points across a network. By mapping defenses to OSI layers, organizations can:  

• More precisely identify and contain attack surfaces 
• Apply controls intelligently, aligning tools to the most effective layers  
• Design defense-in-depth strategies that approach protection holistically  

In other words, the OSI model helps security teams address the hidden relationships and dependencies that define how modern attacks unfold.  

The 7 Layers of the OSI Model Explained  

The OSI model divides network communication into seven abstract layers, each with distinct responsibilities. Data flows down on the sending device and back up with the receiver; each layer interacts with or interprets information as needed along the way. 

For security teams, this layered structure helps map how defenses can (and should) be applied across the network. Understanding how OSI layers function – and how attackers commonly exploit them – emphasizes the importance of a holistic network security strategy.

Layer 7: Application Layer  

The Application Layer is the user-facing tier of the OSI model, where programs like web browsers, email clients, and APIs interact with the network. Layer 7 provides network services via protocols such as HTTP/S, FTP, DNS, and more. Because it’s closest to the end user, this layer is frequently targeted in modern cyberattacks.  

Common Layer 7 threats include: 

• Phishing and credential theft 
• Web exploits, such as SQL injection or cross-site scripting (XSS) 
• Certain distributed denial of services (DDoS) attacks 

Layer 6: Presentation Layer 

The Presentation Layer prepares data to be interpreted in the Application Layer or compressed for the Session Layer. It handles data formatting, compression, and encryption, ensuring that information from one system can be correctly interpreted by another. 

For example, if data sent from one device uses an encoding method that the receiving device can’t understand, Layer 6 is responsible for translating the data into a different syntax. This layer is also where encryption and compression standards operate, ensuring the efficiency and security of communication.  

Common Layer 6 threats include:  

• Malware injection  
• Protocol exploitation, leveraging vulnerabilities in protocols related to file sharing or remote desktop services 
• Compression and encryption attacks

Layer 5: Session Layer  

The Session Layer establishes, manages, and terminates communication sessions between assets. It coordinates dialogue, handling tasks like authentication, checkpointing, and reconnection in case of interruption. Protocols like RPC operate at Layer 5 of the OSI Model, illustrating how vital it is for modern operations.  

Common Layer 5 threats include:  

• Session hijacking  
• Adversary-in-the-middle (AiTM) or attacker-in-the-middle attacks, which now account for nearly 45% of all phishing techniques, according to the 2026 Microsoft Digital Defense Report  
• Replay attacks, reusing recorded session data to impersonate a valid user  

Layer 4: Transport Layer 

The Transport Layer ensures reliable end-to-end communication of data. It manages the segmentation, reassembly, error recovery, and flow control of data, using protocols such as TCP and UDP. Because it governs ports and connections, Layer 4 is often probed by attackers seeking open entry points.  

Common Layer 4 threats include:  

• Port scanning and enumeration to identify vulnerabilities for exploitation  
• SYN flood attacks exploiting TCP handshakes  
• UDP flood attacks, overwhelming the system with packets to cause service disruption  

Layer 3: Network Layer  

The Network Layer determines how data travels between devices across multiple networks. Data segments from the Transport Layer are broken into smaller units, called packets, at the Network Layer. This layer provides routing, forwarding, and addressing, determining the best path for data based on network conditions.  

Layer 3 is central to most security operations – tools like firewalls, routers, intrusion detection systems, and more primarily function here.  

Common Layer 3 threats include:  

• IP spoofing and IP fragmentation attacks  
• Routing attacks that misdirect traffic to a malicious target  
• Volumetric DDoS attacks 

Layer 2: Data Link Layer 

The Data Link Layer enables communication between devices on the same network. Packets from the Network Layer are broken into frames in Layer 2 for flow and error control. Most switches operate at the Data Link Layer, with the exception of switches enabling communication between two networks or VLANs; in those cases, switches operate at Layer 3.  

Common Layer 2 threats include:  

• MAC spoofing, where the address of another device is forged to intercept its intended traffic 
• VLAN hopping by exploiting misconfigurations   
• ARP poisoning with falsified messages linking the attacker’s MAC address with the IP address of a legitimate network device  

Layer 1: Physical Layer 

The Physical Layer refers to the hardware that transmits raw binary data: cables, connectors, and the like. Layer 1 is also where data is converted into a bit stream, so it’s the point at which devices agree on a convention to distinguish ones from zeros. Though easily overlooked in cybersecurity conversations, the Physical Layer is the foundation of trust in every network.  

Common Layer 1 threats include:  

• Unauthorized devices connected to open network ports 
• Cable tapping or signal interception  

TCP/IP Model vs OSI Model 

While commonly compared, the TCP/IP model and the OSI model differ in purpose, structure, and scope. Both models aim to clarify the flow of communication in a network, but OSI is a theoretical reference model while TCP/IP is a practical, protocol-based model.  

In other words, the OSI model provides a standard for how network communication should work; the TCP/IP model outlines protocol-specific standards for how data is transmitted across the internet. Additionally, the TCP/IP model condenses several of the OSI model layers, taking a simplified four-layer approach. 

OSI Layers and Identity Security: Application Layer MFA vs Network Layer MFA  

Multi factor authentication (MFA) provides one clear example of how different levels of OSI alignment impact the effectiveness of security strategies. While MFA is essential for preventing identity-based attacks, not all solutions are created equal.  

Application Layer MFA

Most MFA solutions operate at the Application Layer of the OSI Model, authenticating users before allowing access to an app or service. This strategy effectively protects SaaS applications and web portals, but it leaves privileged ports and protocols, legacy systems, and other non-SaaS assets operating below Layer 7 unprotected.

Network Layer MFA

By integrating MFA into the network infrastructure at Layer 3 of the OSI model, security teams enforce authentication long before a session reaches the application layer – directly at the point of access. Network layer MFA makes it possible to protect protocols like RDP, SMB, and SSH, keep privileged ports closed by default, and ensure just-in-time access is only granted temporarily. 

Building Multi-Dimensional Network Protection  

Modern cyberattacks rarely stay confined to one layer of the network – a single attack chain can easily span nearly every OSI layer. That’s why effective defense requires multi-dimensional, holistic protection across every axis of network traffic:    

• North-South: Securing the perimeter against external access with firewalls and secure remote access solutions   
• East-West: Preventing unauthorized lateral movement with granular microsegmentation  
• Up-Down: Controlling access between layers to protect sensitive areas of the network with identity-based access controls  

Zero Networks’ automated, identity-based microsegmentation reinforced with network layer MFA makes it easy for security teams to protect network communication at every critical juncture.  

Find out how you can take a simple, comprehensive approach to network security – request a demo.  

Zero Trust Network Access (ZTNA) is a modern approach to secure remote access, and as organizations increasingly prioritize Zero Trust security initiatives, ZTNA adoption is rising fast. We’ll break down what ZTNA means, how it works, where it fits in modern network security strategies, and how to find the right ZTNA solution for your organization.  

Key Answers 

• What is ZTNA and how does it work? Zero Trust Network Access (ZTNA) provides secure remote access based on granular policies in alignment with the Zero Trust security model, where network trust is not automatically granted. Rather than granting sweeping network-level access, ZTNA only provides authorized users with access to specific apps and services based on identity, device posture, and contextual factors like location or time of day. When a user attempts to connect, ZTNA verifies their identity, then evaluates device health, security posture, and context. 
• What is the difference between ZTNA and VPN? A VPN client typically establishes an authenticated connection, creating a tunnel for traffic to flow over which allows the endpoint to access resources as if it were connected to the organization's network.  ZTNA can be considered an evolution beyond traditional VPNs, enforcing fine-grained access policies based on user identity, device health, and context to standardize access policies without opening any ports. 
• Which factors are important when evaluating ZTNA solutions? A modern ZTNA solution should avoid routing traffic through a cloud-based access broker or proxy, and keep the IP addresses of all users visible while connecting inside the organization – this way, modernizing secure remote access won't lead to bottlenecks, security blind spots, or user experience degradation. 

What Is Zero Trust Network Access?  

Zero Trust Network Access (ZTNA) provides secure remote access based on granular policies in alignment with the Zero Trust security model, where network trust is not automatically granted.  

Without opening any ports to the internet, ZTNA enforces fine-grained access policies based on user identity, device health, and context to prevent unauthorized access and reduce the attack surface. 

How Does Zero Trust Network Access Work?  

ZTNA replaces implicit trust with least privilege access controls, ensuring remote connections don’t create gaps in an organization’s Zero Trust strategy. Rather than granting sweeping network-level access, ZTNA only provides authorized users with access to specific apps and services based on identity, device posture, and contextual factors like location or time of day. 

Once a user attempts to connect, the ZTNA solution first verifies their identity, then evaluates device health, security posture, and context. If approved, access is granted only to the necessary resource, not the broader network. This drastically reduces the attack surface and limits lateral movement. 

Notably, many traditional ZTNA solutions rely on cloud-based brokers that route all traffic through proxies. While this can add latency and degrade performance, modern alternatives can overcome these challenges.

Does ZTNA Have Multi Factor Authentication?  

Multi factor authentication (MFA) is core to any Zero Trust strategy, so it’s commonly supported by modern ZTNA solutions.  

By requiring users to verify their identity using two or more factors, MFA significantly reduces the risk of credential-based attacks. When combined with other ZTNA capabilities like contextual access controls, MFA helps enforce comprehensive least privilege and prevent unauthorized access to sensitive resources. 

Organizations evaluating ZTNA vendors should confirm that the solution provides single sign-on (SSO) and MFA that integrates with their existing identity provider (IdP) to fortify defenses while streamlining the user experience.

Zero Trust Network Access (ZTNA) vs VPN  

While VPN and ZTNA solutions both aim to secure remote access, these approaches function very differently. In an era of more sophisticated threats and hybrid workforces, VPN vulnerabilities are impossible to ignore. 

VPN Overview: Background and Sample Architecture  

Virtual Private Networks (VPNs) were created in the late 1990s to allow remote access to internal networks. Typically, the VPN client establishes an authenticated connection, creating a tunnel for traffic to flow over. This tunnel allows the endpoint to access resources as if it were connected to the organization's network.  

The problem with this architecture is mainly that VPN ports must be open to the internet, and everyone can try to hack it with known vulnerabilities that aren’t yet patched or unknown vulnerabilities that can’t be patched. Plus, traditional VPNs lack device and user awareness, meaning the access granted is absolute – a free pass to the entire network.  

In practical terms, this lack of VPN awareness also creates inconsistent security standards for remote and on-prem connections. Aaron Steinke, Head of Infrastructure at La Trobe Financial said, “Historically, we found that you often end up in a scenario where people have more network access when they’re on the VPN because you can’t categorize them and classify them well enough.”  

Comparing Zero Trust Network Access and VPN: Key Differences  

In simple terms, ZTNA can be considered an evolution beyond traditional VPNs, addressing the remote access vulnerabilities that are most relevant in today’s threat landscape. To bring this evolution into focus, here’s how VPN and ZTNA compare across key features:  

ZTNA Security Benefits 

ZTNA undeniably enhances and streamlines remote connections’ security; this is primarily achieved by reducing the attack surface, unifying policy management, and enabling granular access control.  

Reduced Attack Surface 

ZTNA hides internal applications and infrastructure from public view by default. With no open ports to scan or exploit, attackers can't see or target your network, dramatically reducing exposure.  

Centralized Security Policies  

Rather than configuring scattered rules, IT teams can define and enforce access policies in one place with ZTNA. Centralization not only simplifies day-to-day management but also improves policy consistency across users, locations, and devices, making it easier to enforce Zero Trust principles at scale. What’s more, ZTNA supports cyber compliance efforts by creating a single source of truth for access governance and auditability. 

Granular Access Control with Context Awareness 

ZTNA uses a context-aware approach to ensure that access decisions are precise and dynamic, reducing over-permissioning, limiting insider threat exposure, and preventing lateral movement. As networks and risks evolve, access can be dynamically adjusted with modern ZTNA solutions, keeping sensitive systems better protected. 

Top ZTNA Use Cases: Replacing VPN, Protecting Sensitive Data 

As nine out of ten security leaders prioritize Zero Trust to boost security postures, organizations may turn to ZTNA for a broad range of use cases, including:  

Replace VPN Solutions  

ZTNA is a more secure alternative to VPNs for protecting remote connections. Organizations looking to standardize security policies across environments, mature Zero Trust initiatives, or generally modernize their approach to secure remote connectivity may opt to replace VPN solutions with ZTNA.  

Reduce Third-Party Vulnerabilities  

With security incidents linked to third parties rising, traditional third-party access approaches introduce an unacceptable level of risk. With ZTNA, organizations can connect vendors, consultants, and other third parties to their networks using MFA and tailored access controls.  

Standardize Policy Enforcement for Remote Employees  

ZTNA enforces access policies consistently, whether employees are on-site or remote, eliminating the excessive permissions created by traditional VPNs. With ZTNA, organizations eliminate dangerous security gaps, ensuring least privilege is the standard policy for every connection.  

Strengthen Data Protection and Privacy Initiatives   

ZTNA’s default-deny posture and application-level access controls help organizations meet privacy mandates and data protection standards by preventing unauthorized access and enforcing least privilege access. 

With ZTNA, it’s possible to create policies based on identity information including the context in which the user is accessing resources, allowing organizations to control who can access what, where, and when. For example, a policy could be created to ensure only specific users can access data in a specific location or using a certain device type. This granular control can greatly reduce the risk of data leakage and ensure that only authorized individuals are allowed access to sensitive data. Other controls, such as time-based access restrictions, can be implemented to further protect data from unauthorized access. 

Legacy ZTNA Challenges: Higher Latency and Lower Bandwidth  

While ZTNA marks a major improvement over VPNs in terms of security posture and access control, not all ZTNA solutions are created equal. Many legacy ZTNA implementations introduce their own set of performance and operational tradeoffs.  

The most common challenges associated with legacy ZTNA include:  

• Cloud proxy bottlenecks: Traditional ZTNA solutions route all network traffic through a cloud-based access broker or proxy. This “middleman” approach introduces latency and reduces bandwidth.  
• NAT obfuscation: Most legacy ZTNA vendors use Network Address Translation (NAT) to funnel all user traffic through a single IP. While this helps anonymize connections, it also creates security blind spots. This obfuscation may even break some detection tools.  
• Increased costs: Routing traffic through cloud proxies doesn’t just slow things down, it also gets expensive – particularly compared to traditional VPNs.  
• User experience degradation: High latency and slow connections frustrate users and reduce productivity. In remote and hybrid work environments, performance challenges can lead to shadow IT workarounds that increase risk and undermine the intent of ZTNA.  

How to Choose a Modern ZTNA Solution  

While legacy implementations can bring tradeoffs so heavy they outweigh the benefits, modern ZTNA solutions deliver the security organizations need without the operational downsides.  

When evaluating ZTNA vendors, organizations should ask questions like:  

• Does the vendor offer a “least privileged” model capable of granular access control for applications and resources? 
  This allows administrators to define specific permissions based on user identity, device health, location, and other contextual factors. 
• Does the vendor provide single sign-on (SSO) and multifactor authentication (MFA) that integrate with your existing identity provider (IdP)? 
  MFA is critical to prevent misuse of common user credentials, and integration with existing IdP simplifies and streamlines user authentication.  
• Can the vendor guarantee no negative impact on user experience caused by network performance and latency? 
  Routing traffic through cloud proxies frequently leads to increased latency, resulting in a negative impact on user experience. 
• Can the vendor keep the IP addresses of all users visible while connecting inside the organization? 
  NAT architecture often obfuscates users’ IP addresses, making it appear as if all users are connected from a single IP, creating security blind spots and breaking various detection solutions. 
• Can the vendor combine ZTNA with microsegmentation on the same platform to offer a holistic approach to zero trust both internally and externally? 
  Microsegmentation and ZTNA enforce the strictest access controls at both user and application levels, dramatically reducing the attack surface both internally and externally. 

Revolutionizing Remote Access: Zero Networks’ Approach to ZTNA  

Zero Networks reimagines ZTNA by combining the security of Zero Trust Network Access with the speed and simplicity of VPN.  

Using just-in-time MFA, Zero Networks temporarily opens ports only for authenticated users and keeps the rest of your network invisible. As a result, organizations get secure remote access that lives up to Zero Trust standards – without compromising on performance.  

With integrated microsegmentation and network-layer MFA, Zero enforces least privilege access across every connection and identity. Find out how you can make Zero Trust a reality in record time – request a demo. 

Zero Trust Network Access Explained: More ZTNA FAQs  

For a deeper dive on Zero Trust Network Access, explore answers to some of the most common questions related to ZTNA.   

Can ZTNA be used in the Cloud? 

Yes, ZTNA can be used in the cloud. In fact, many organizations are leveraging it for their cloud deployments. By using ZTNA, organizations will be able to set granular access policies tailored to the individual user or device. This allows them to control who has access to which resources in the cloud and prevent unauthorized users from gaining access. Additionally, ZTNA can provide additional security measures such as user authentication and device health checks, which can help to further reduce the risk of a breach. 

What is lateral movement related to ZTNA? 

Lateral movement occurs when an attacker pivots from one system or device to another within a network without being detected. This allows the attacker to gain access to valuable data, networks, and systems. ZTNA can help prevent lateral movement by controlling access privileges based on user identity, device health checks, and other contextual information. This helps mitigate the risk of lateral movement and minimize the attack surface.  

What is a Zero Trust Architecture (ZTA)?  

Zero Trust is an approach to cybersecurity that assumes that all internal and external actors are untrustworthy, and no network or system is safe from attack. Zero Trust Architecture (ZTA) refers to the implementation of that philosophy within an organization’s infrastructure, workflows, controls, and policies.  

Can ZTNA help control access to applications? 

Yes, ZTNA can help control access to applications. By leveraging the various contexts that can be taken into consideration with ZTNA policies, such as device state, identity state, location, application used, etc., organizations are able to have granular control over who is accessing which applications.  

Does ZTNA help protect remote users? 

ZTNA helps protect remote users by providing granular access controls tailored to the individual user or device. This allows organizations to limit access to certain resources based on user identity, device health checks, and other contextual information. This prevents unauthorized users from gaining access and reduces the attack surface. Additionally, ZTNA can provide additional security measures such as user authentication and device health checks, which further reduce the risk of a breach. 

Can ZTNA control the visibility of an asset? 

Yes, ZTNA can help control the visibility of an asset. By leveraging granular access policies, organizations can limit user access to certain resources based on identity, device health checks, and other contextual information. This allows organizations to control who can view, access, modify, or delete a specific asset. This helps reduce the risk of data leakage and unauthorized access. 

What is the best use of VPN vs ZTNA in a corporate network? 

The best use of VPN vs ZTNA in a corporate network depends on the specific security needs and goals of the organization. A Virtual Private Network (VPN) is a secure connection between two or more devices that allows users to access internal corporate networks from outside of the organization. It provides secure remote access, but it does not provide granular access controls. On the other hand, Zero Trust Network Access (ZTNA) provides granular access policies that can be tailored to the individual user or device. This helps organizations to set more stringent access policies and reduce the attack surface of their networks. In general, ZTNA is a better option for organizations that require higher levels of security and control. 

How is Zero Trust Network Access different from a Software-Defined Perimeter? 

Zero Trust Network Access (ZTNA) is different from a Software-Defined Perimeter (SDP) in that it provides granular access policies tailored to the individual user or device. ZTNA allows organizations to set stringent access policies for users based on identity, device health checks, and other contextual information. This helps prevent unauthorized users from accessing sensitive resources and reduces the attack surface. SDP, on the other hand, provides a more secure perimeter-based model by creating a virtual tunnel for users to connect to an internal network. It is designed to provide an extra layer of security and control beyond what is available with a traditional VPN. 

How does ZTNA help with Secure Access Service Edge (SASE)? 

ZTNA helps with SASE by providing granular access control tailored to the individual user or device, allowing organizations to control who can view or access certain resources based on user identity, device health checks, and other contextual information. This helps prevent unauthorized users from accessing sensitive resources while also reducing the attack surface.  

Can I use ZTNA to control access to the public internet with a remote workforce? 

Yes, ZTNA can be used to control access to the public internet with a remote workforce in both large and small businesses. By leveraging granular access policies, organizations can limit user access to certain public resources based on identity, device health checks, and other contextual information. This helps reduce the risk of data leakage, unauthorized access, and external threats. Additionally, organizations can use ZTNA to set more stringent access policies to help prevent malicious actors from accessing sensitive information. 

Common Pitfalls in Microsegmentation Projects 

Microsegmentation projects often stall under the weight of manual effort and consultant dependency. Or they never really get started – instead, segmentation in many organizations boils down to a few firewall rules on key databases, VLANs on critical segments, or a legacy solution covering one environment. There are 5 key reasons so many microsegmentation projects never reach enforcement.  

1. Complexity Overload 

Implementing microsegmentation is inherently complex. Organizations often struggle with mapping out every application dependency and network flow. Manually creating tags or labels for every asset is time-consuming and labor-intensive. Traditional solutions require manual policy creation, leading to misconfigurations and endless rule tweaking. 

According to research from Enterprise Management Associates (EMA) on the maturing microsegmentation market, 95% of cyber and IT pros rate microsegmentation as extremely or very important for cyber defense, yet ViB Tech survey results showed that just 5% of organizations are microsegmenting their networks today. Forty percent cited complexity as the top concern with implementing microsegmentation.  

2. Resource Constraints 

Microsegmentation projects demand significant time, specialized expertise, and financial investment. Meanwhile, CISOs are being asked to do more with less – 80% of executives say they’re facing pressure to reduce the cost of security, yet just 11% of CISOs believe their security teams are adequately staffed; nearly three-quarters say security operators are already managing an excessive workload. 

Implementing a legacy microsegmentation tool means every asset needs tagging, grouping, and a hand-crafted policy. At enterprise scale that's thousands of rules – each one requiring ongoing maintenance as the environment changes. When IT teams are already stretched thin, there’s little bandwidth to spare for implementing microsegmentation. 

3. Operational Disruption 

One of the biggest fears with microsegmentation is breaking critical applications. Poorly configured policies can inadvertently block legitimate traffic, leading to downtime and user frustration.  

On top of that, legacy microsegmentation is typically agent-based, requiring software deployed on endpoints across enterprise environments and an endless update lifecycle to manage. This adds new potential points of failure – and the risk of downtime often causes teams to hesitate or abandon the project entirely.  

4. Scalability Challenges 

As environments grow – especially with the rise of hybrid and multi-cloud infrastructures – maintaining and scaling microsegmentation policies becomes exponentially harder. Traditional solutions struggle to adapt, leading to gaps in security. In fact, over 90% of breaches are materially enabled by misconfigurations and coverage gaps rather than novel exploits.  

This challenge is particularly urgent in the AI threat era. Attackers can find and exploit vulnerabilities, weaponize excessive agency, and move laterally at machine speed – a microsegmentation solution that can’t scale at that pace leaves security teams at a constant disadvantage.  

5. Lack of Visibility 

Without comprehensive visibility into network traffic and application dependencies, creating effective segmentation policies is a guessing game. Blind spots can result in both security gaps and operational issues. 

The traditional answer to east-west visibility has been flow logs, periodic audits, and on-demand maps generated from historical data. But these approaches don’t account for the dynamic nature of modern environments. A point-in-time snapshot begins drifting from reality the moment it's created – and policies built on that snapshot drift with it.  

How Zero Networks Solves These Challenges 

Zero Networks was designed to address the issues that have historically caused microsegmentation projects to fail.  

For years, vendors have sold microsegmentation software that comes with an unofficial requirement: a small army of consultants, dedicated engineers, application dependency mapping, thousands of policies, and months or years of tuning. Zero Networks changes the equation. Instead of requiring engineers to painstakingly build and maintain policies, the software discovers the environment, learns how systems communicate, automatically generates policies, tests their impact, and enables controlled enforcement. Engineers remain in charge, but they're no longer doing the software's job. 

By automating policy creation, deploying without agents or network redesign, delivering comprehensive network visibility, and enabling policy simulation before enforcement, Zero Networks segments 90%+ of the environment within 90 days.  

Automated Policy Creation 

Zero Networks monitors all network connections over an initial learning period to create deterministic, highly accurate firewall rules and policies. This eliminates the need for manual tagging, grouping, and policy writing, drastically reducing the complexity of implementation, ongoing management, and risk of misconfiguration.  

Gartner’s 2026 Emerging Tech Impact Radar: Global Attack Surface Grid report notes that the impact of autonomous microsegmentation will be transformational, enabling adopters to streamline policy lifecycles and reduce breach response times. And Gartner’s 2026 Reimagining Network Microsegmentation report validated what many security leaders already know: legacy segmentation solutions weren’t built to defend against AI attacks.  

“Relying on static, IP-based microsegmentation guarantees catastrophic vulnerability to AI-driven attacks. Vendors clinging to manual policies face rapid obsolescence, as these methods are completely incapable of securing dynamic hybrid networks against lateral movement.”   

Gartner, Reimagining Network Microsegmentation: Beyond the IP – Identity, Context, and Agentless Innovation  

Agentless and Scalable 

Zero Networks deploys agentlessly and integrates with existing infrastructure to reach every asset – servers, endpoints, OT, legacy systems, cloud workloads, and AI-connected systems – without touching them. This approach avoids kernel-level exposure, minimizes potential points of failure, and eliminates the hardware upgrades and complex configurations that often stall segmentation progress.  

Because Zero continuously monitors internal communication pathways and uses those insights to power adaptive policy enforcement, coverage scales with the business – no gaps emerge as the network evolves.  

Preemptive Cyber Resilience without Operational Risk

Whether an outage occurs due to a breach or because a misconfigured policy broke a critical connection, the impact is the same. With Zero, security teams drastically reduce the risk of downtime driven by a cyberattack or a configuration error.  

Since Zero Networks generates policies using a deterministic, human-on-the-loop automation engine rather than a probabilistic AI model (where policy is based on a statistically likely inference), enterprises gain peace of mind that policies are based on real, observed behavior and not best-guesses.  

In fact, 94% of Zero’s automated rules are used exactly as produced, but before a single policy goes live, teams can validate in simulation mode to see exactly what will change, then flip to enforcement without fear of breaking production. And when a compromise occurs, it stays contained – attackers can’t disrupt operations if they can’t move laterally.  

Enhanced Visibility and Control 

Zero’s Network Map delivers real-time visibility into what’s happening across every asset, identity, and environment. By continuously ingesting and correlating traffic across on-prem, cloud, IoT/OT, and Kubernetes, Zero Networks provides a reflection of the environment as it actually exists.  

This comprehensive visibility gives security teams an interactive, graphical view of actual asset-to-asset and identity-to-asset communication, delivering clarity into dependencies and potential risks that ultimately powers informed policy decisions.  

“Years of people building services and moving on left us with a datacenter full of things we couldn’t fully explain, in an environment with extreme uptime standards. Zero Networks gave us a level of visibility we hadn’t had before – both in what our network is actually doing and in our ability to stop malicious activity from spreading.” 

Remi Springer, Cybersecurity Program Manager, C.R. England

Cost and Resource Efficiency 

By automating much of the heavy lifting, Zero Networks reduces the need for specialized personnel, consultants, and long project timelines. This not only cuts costs but also accelerates time-to-value. The average Zero Networks customer reaches 90%+ segmentation within 90 days and spends just 1-2 hours on monthly maintenance.  

According to a technical validation from analyst group ESG, Zero Networks saves the average enterprise 87% compared with traditional firewall segmentation and 75% when compared to legacy microsegmentation platforms.   

Reimagine Microsegmentation with Zero Networks

Microsegmentation is vital for modern network security, but traditional approaches often fall short due to complexity, resource demands, and scalability issues. Zero Networks offers a smarter, more efficient path to achieving effective microsegmentation, helping organizations realize the promise of Zero Trust without the typical pitfalls.  

If your microsegmentation project has stalled – or you’re considering starting one – Zero Networks can deliver the comprehensive protection you need without adding operational complexity. Request a demo to learn how.  

While security teams struggle with unwieldy alert volumes, cyber attackers are growing speedier and stealthier, weaponizing AI to identify and exploit vulnerabilities at machine speed. Reactive defenses are no longer enough to effectively combat rising zero day attacks; in the frontier AI era, enterprises need to think beyond the traditional patch management cycle and embrace proactive containment strategies.  

We’ll walk through everything you need to know about zero days, breaking down what they are, how they unfold, why AI is shifting the vulnerability landscape, and best practices for stopping zero day attacks before they turn into disasters.

Key Answers  

• What are zero day vulnerabilities and how do they impact cybersecurity? A zero day vulnerability is the hidden flaw or weakness in software that attackers exploit before vendors release a fix, and sometimes before the vendor knows it exists at all. Because zero days have no known signature, they’re difficult to detect or block with traditional security tools – according to Mandiant’s 2026 M-Trends Report, mean time to exploit has fallen to -7 days, meaning exploitation now typically occurs before a patch exists.  
• What are the latest trends in zero day exploits and cybersecurity threats? Zero day exploitation grew 59% between January 2025 and August 2026, and enterprise technologies accounted for 48% of zero days exploited in 2025, according to Google Threat Intelligence Group research. AI is accelerating both vulnerability discovery and exploitation, blurring the line between zero day and n-day vulnerabilities.  
• What are the best ways to prevent zero day attacks? The most reliable defense against zero days is to limit what an attacker can reach once inside the network, regardless of the initial point of compromise. Key strategies include microsegmentation to block lateral movement by default and identity-based access controls with just-in-time MFA verification for sensitive systems and actions, so attackers hit a dead end regardless of the vulnerability they exploit to gain initial access.  
• Which cybersecurity tools are most effective against zero day threats? Signature-based antivirus and detection tools struggle to defend against zero days, which have no known signature or behavioral baseline. The most effective solutions provide a containment layer that doesn’t rely on ad-hoc fixes for every vulnerability: identity-based microsegmentation ensures exploits stay contained to the initial point of compromise, network-layer MFA enforces just-in-time verification for privileged access, and a modern ZTNA solution replaces exposed VPN infrastructure – a frequent zero day target.  

Zero Day Attack Meaning  

A zero day (or 0 day) attack happens when a hacker finds and exploits a vulnerability before the developers or owners of the system have time to fix the problem, or in some cases, even become aware of it. 

Zero day vulnerabilities that lead to attacks can include faulty algorithms, bugs, missing encryption or authorizations, and insufficient security measures. Because these vulnerabilities can be tough to detect, they’re difficult to effectively protect against.  

Zero Day Vulnerability vs. Exploit vs. Attack  

Often used interchangeably, the terms zero day vulnerability, zero day exploit, and zero day attack represent distinct (albeit closely related) concepts:  

• A zero day vulnerability refers to the hidden flaw or weakness that can be targeted by a cyber adversary. 
• A zero day exploit is the technique a cybercriminal uses to attack a system via the vulnerability. 
• A zero day attack is how the exploit plays out in the real world, when cyber attackers exploit an unpatched vulnerability to breach a system.

Relatedly, an n-day vulnerability is a flaw that has been publicly disclosed, usually with an official fix available, but that remains unpatched in many environments. The “n” refers to the number of days since disclosure.  

Cybersecurity Vulnerability Trends in the AI Era 

Zero day exploitation grew 59% between January 2025 and August 2026, according to Google Threat Intelligence Group research. Over the same period, exploitation of all vulnerabilities rose 127%, with attackers exploiting 141 vulnerabilities in the first eight months of 2026 – more than the 127 exploited in all of 2025.  

Meanwhile, just 26% of critical vulnerabilities in CISA’s Known Exploited Vulnerabilities (KEV) catalog were fully remediated in 2025, and the median time to full remediation climbed to 43 days – while mean time to exploit dropped to -7 days, according to Mandiant’s 2026 m-trends report.  

Now, frontier AI models are further collapsing the window between vulnerability discovery and exploitation. When AI-enabled attackers can exploit a vulnerability within hours of discovery or disclosure, the practical difference between zero days and n-days blurs. In either case, defenders face threat actors leveraging unpatched weaknesses to gain initial access. The only reliable advantage for security teams is to proactively constrain the reach of any foothold.  

Unknown and Insecure: Zero Day Attack Challenges

You can’t secure what you can’t see. Zero day attacks rank among the most feared threats in cybersecurity because they are often unknown. This fundamental challenge creates a host of concerns related to zero day attacks, including:  

• Defenders start at a disadvantage: In many cases, the attacker is the only party aware of a zero day vulnerability. It can take anywhere from a few hours to a few years for system owners to catch up and uncover a vulnerability, let alone build a patch for it. In fact, mean time to exploit (TTE) fell from 63 days in 2018 to an estimated -7 days in 2025, meaning exploitation typically happens before a patch exists.  
• No known signature: Traditional antivirus and EDR systems rely on pattern recognition, but zero days have no prior signature or behavioral baseline, making them difficult to identify and even harder to contain. Across all breaches, mean time to identify and contain rose to 247 days in 2026, signaling a wide gap between zero day exploitation and containment. 
• Delayed patching: Even once discovered, it takes time for vendors to issue patches – and more time still for organizations to deploy them across environments. These gaps represent windows of opportunity for cyber criminals. Even when a patch does exist, the AI-driven vulnerability avalanche makes it impossible to deploy every fix quickly. For example, Microsoft released its largest Patch Tuesday ever in July of 2026: 570 fixes, including three zero-day vulnerabilities. 
• Increasing accessibility: Zero day attacks were once reserved for large players like nation-states with expansive resources, but the rising profitability of ransomware means that even small extortion gangs can now afford to hire top talent to identify zero day vulnerabilities.  
• Unmitigated lateral movement: Because zero day attacks are so difficult to detect, security teams struggle to defend against them before major damage is done. Without proper network segmentation, zero day attacks give hackers free access to move laterally across networks, pivoting to sensitive systems undetected.  

The hidden nature of zero days makes them a uniquely insidious threat – one that traditional, reactive defenses weren’t built to combat. Although hackers have the time and resources to seek out potentially harmful vulnerabilities, overburdened security teams have to focus on daily firefighting – and AI-driven exploits only compound the problem. 

Zero Day Attack Timeline: Vulnerability and Exploit Stages  

Though zero days can vary vastly in terms of scope, underlying vulnerability, and more, they follow a relatively predictable set of stages. After systematically reviewing hundreds of zero day attacks over the course of several years, security researchers found that a typical zero day attack lasts 312 days, although the exposure window is even longer.  

From the time a vulnerability is introduced to when patch deployment is completed, zero days generally occur in seven stages:  

1. Vulnerability Introduced: A flaw is unknowingly written into code and publicly released.  
2. Exploit Released: Attackers discover the vulnerability and exploit it for the first time, typically stealthily.   
3. Vulnerability Discovered: The vendor first becomes aware of the vulnerability; this may occur during routine testing or because of a breach.  
4. Vulnerability Publicly Disclosed: Either the vendor or security researchers publicly announce the vulnerability.  
5. Countermeasures Released: Depending on what types of exploits attackers have already created to target the vulnerability, countermeasures like antivirus signatures may be possible prior to patching.  
6. Security Patch Released: The vendor issues a patch for the vulnerability; importantly, the patch itself isn’t an instant fix, as not every user will automatically deploy it.  
7. Patch Deployment Completed: The patch is applied across environments, and the vulnerability ceases to represent a threat.  

Notably, these stages may occur in different orders, and some may not occur at all, but this general timeline illustrates how easily attackers can operate undetected by exploiting zero day vulnerabilities – and how long defenders remain exposed, even after a threat is identified.  

Real-World Examples: Notable Zero Day Attacks  

Zero day attacks represent some of the most disruptive cyber incidents in recent history, including examples like:   

Microsoft Exchange 

A cluster of zero day vulnerabilities in Microsoft Exchange (CVE-2021-26855 and others) allowed attackers to bypass authentication, execute code, and drop web shells, resulting in widespread data theft and system compromise. These vulnerabilities spurred a wave of attacks and prompted CISA to urge organizations to modernize authentication strategies.  

MOVEit Transfer 

A zero day vulnerability in Progress Software’s MOVEit Transfer product (CVE-2023-34362) allowed threat actors linked to the Cl0p ransomware group to perform SQL injection attacks and exfiltrate sensitive data from a wide range of organizations. The attack ultimately resulted in the unauthorized extraction of sensitive data belonging to more than 66 million individuals and 2,500 organizations.  

MITRE 

In January 2024, threat actors exploited two Ivanti Connect Secure zero-day vulnerabilities in MITRE's VPN infrastructure (CVE-2023-46805 and CVE-2024-21887). Using session hijacking to skirt past MFA, cyber attackers were able to move laterally and pivot deeper into the network through a compromised administrator account. Despite following best practices, vendor instructions, and the government's advice for upgrading, replacing, and hardening systems, MITRE did not detect the attackers' lateral movement, leading MITRE to issue post-breach network hardening tips like microsegmentation and robust MFA mechanisms. 

How to Prevent Zero Day Attacks: Proactive Security Strategies  

Protecting your organization from zero day attacks has long boiled down to a reactive strategy, heavily reliant on the traditional patch management lifecycle. But as 83% of security teams report overwhelming alert volumes, simply detecting malicious behavior isn’t good enough. Instead, organizations need a proactive approach to zero day prevention that mitigates commonly exploited weaknesses and enables containment by design.  

Implement Comprehensive Network Segmentation  

Microsegmentation isolates each asset in its own protected zone, preventing lateral movement by default. By enforcing granular per-asset policies, organizations can build an architecture that proactively ensures breaches are contained to the initial point of compromise – regardless of how they get inside. Even when attackers leverage AI to exploit vulnerabilities at machine speed, comprehensive microsegmentation blocks breaches from spreading to sensitive assets or impacting critical operations. 

Enforce Adaptive Identity Controls and Just-in-Time MFA  

Even if attackers use an unknown zero day vulnerability to gain an initial foothold in the network, enforcing continuous verification of user, device, application, and AI agent identities – and ensuring access is restricted to only what’s necessary – further reduces the attack surface. Applying just-in-time MFA to admin and service accounts adds another layer of security, minimizing the risk of privilege escalation. Zero Networks’ analysis of 3.4 trillion threat activities found that more than 70% of enterprise threat activity flows through just four admin protocols; network-layer MFA removes those trusted pathways by enforcing just-in-time verification for privileged access, so a single vulnerability doesn’t deliver widespread access.  

Build a Resilient Zero Trust Architecture  

Zero Trust is based on the idea of removing implicit trust and treating every connection as risky by default. This mindset automatically prepares organizations to address zero day attacks, driving policies and network architecture that contain by design and grant access dynamically rather than relying on reactivity. Combining network segmentation, identity-based access controls, and secure remote access strategies gives enterprises a layered defense against sophisticated attacks.  

Reinforce Defenses and Control Outbound Traffic  

When it comes to protecting assets, we typically think in terms of guarding against incoming traffic. However, as we’ve seen with recent vulnerabilities like CVE-2024-43451, some zero day attacks include communication to external servers. To ensure networks are effectively secured against zero days, organizations can create outbound block rules for sensitive protocols like SMB, RDP, and RPC using modern microsegmentation solutions.

Stop Zero Day Attacks Before They Happen with Zero Networks  

By embracing a proactive, layered approach to network security, organizations can drastically reduce their attack surface to make it harder for any cyber attack to succeed – even the ones they don’t yet know about.  

With Zero Networks, security teams can implement granular controls to secure every network connection. Our automated, identity-based solution orchestrates native firewalls to microsegment every asset, locking down lateral movement to immediately neutralize zero day attacks.  

Unlike reactive tools that depend on known indicators, Zero builds a proactive security posture, enforcing least privilege across the entire network and stopping zero day threats before they become disasters. Reinforced with network-layer MFA and Zero Trust Network Access capabilities, Zero’s identity-based microsegmentation delivers full-spectrum protection against cyber attacks – whether they’re human or AI-driven.  

Learn how to stop chasing zero day attacks and start blocking them – request a demo.  

In this landscape, traditional segmentation and manual firewall rule management can’t keep up; autonomous microsegmentation is vital for enabling real-time breach containment.  

Gartner’s 2026 Emerging Tech Impact Radar: Global Attack Surface Grid report by analysts Luis Castillo, Charanpal Bhogal, Isy Bangurah, Murat Önder, Kanishka Chauhan, Esha Bhatia, David Senf, Bryan Haley, Evan Zeng, Stacey Yin, and Tom Powledge validates autonomous microsegmentation as one of the most impactful technologies for reducing attack surfaces, with early majority (more than 15% of the target market) adoption anticipated in 3-6 years.

"The impact [of autonomous microsegmentation] will be transformational ... Adopters can streamline policy life cycles, automate draft rule generation, and significantly reduce breach response times." 

- Gartner, Emerging Tech Impact Radar: Global Attack Surface Grid 

What Is Autonomous Microsegmentation?  

Autonomous microsegmentation divides a network into isolated segments that function as individual security zones; these solutions “discover network assets, model traffic telemetry, and dynamically enforce access policies,” according to Gartner.  

While legacy microsegmentation approaches place a heavy manual burden on security teams, autonomous microsegmentation shifts from a “human-in-the-loop” approach to a “human-on-the-loop” system where policy enforcement is automated with staff oversight as needed. 

Autonomous Microsegmentation vs. Legacy Microsegmentation  

Strategies to prevent lateral movement have evolved significantly in the last 30 years. As a new, autonomous generation of microsegmentation takes center stage, it’s important to understand how solutions have progressed from legacy approaches to modern microsegmentation.  

The earliest segmentation attempts divided networks into VLANs and utilized NACs to enforce who could connect. Next came agent-based microsegmentation solutions, which delivered more granular control and flexible enforcement but still faced scalability challenges and security gaps with a heavy reliance on manual work. Finally, next-gen microsegmentation introduced automated, agentless management of native controls – this evolution paved the way for Gartner’s recognition of “autonomous microsegmentation” as an emerging technology. 

Why Security Teams Need Autonomous Microsegmentation Now: Industry Trend Review 

Gartner’s 2025 Hype Cycle for Workload and Network Security placed microsegmentation on the “Slope of Enlightenment” – a rebound from the “Trough of Disillusionment” (where interest wanes and only the most effective solutions survive), signaling early mainstream maturity in the microsegmentation market.  

Meanwhile, CISA’s latest guidance confirms microsegmentation is foundational for Zero Trust, and recent research from Enterprise Management Associates (EMA) reveals that 96% of IT and security leaders consider microsegmentation very or extremely important for cyber defense.  

Still, it’s clear that traditional approaches to microsegmentation have fallen short. Gartner estimates microsegmentation market penetration hovers between 5% and 20%, echoing  a ViB Tech survey that found only 5% of organizations are microsegmenting their networks today.  

In other words, industry insights send a clear message that microsegmentation is now a foundational cybersecurity practice rather than a nice-to-have optimization; Gartner’s Emerging Tech Impact Radar reinforces this takeaway with a critical clarification: automation is central to segmentation success.  

This is further underscored by Gartner’s 2026 report Reimagining Network Microsegmentation: Beyond the IP – Identity, Context, and Agentless Innovation, which identifies three critical insights shaping the future of network microsegmentation: the shift from IP-based rules to identity-first enforcement, the need for autonomous policy governance that moves beyond manual management, and the requirement for agentless, multimodal enforcement architectures that can deliver comprehensive coverage across heterogeneous enterprise environments. 

Gartner attributes the urgency around autonomous microsegmentation to a bevy of interconnected factors, including the accelerating pace of AI-driven threats, rising IoT breaches, and a new wave of Zero Trust prioritization. Attackers now begin moving laterally in as little as 27 seconds, meaning defenders can’t afford to rely on delayed detection or manual response, yet implementation complexity remains the #1 barrier stopping security teams from adopting microsegmentation.  

How Autonomous Microsegmentation Works: Simplifying the Path to Self-Defending Networks 

As Gartner points out, the next generation of microsegmentation requires a shift from manual management to “advanced, self-governing Zero Trust.” The report clarifies that the current state of the art approach for autonomous microsegmentation exists as human-on-the-loop architectures where solutions automatically handle asset discovery, zero-trust policy creation, and simulation of policy impact against life traffic telemetry. In practice, this means a modern microsegmentation solution should:  

• Automatically discover assets and learn network behavior 
• Create and enforce deterministic firewall rules and policies with a human-on-the-loop 
• Provide comprehensive real-time visibility  
• Dynamically adapt policies to network changes  

Perhaps unsurprisingly, these capabilities mirror security leaders’ priorities, validating the assertion that autonomous microsegmentation will prove vital in the coming years.  

What Security Leaders Want from a Microsegmentation Solution 

When EMA’s research asked about the key differentiators between leading microsegmentation solutions and legacy approaches in the next 1-2 years, an overwhelming majority of respondents cited “fast, automated asset discovery and tagging that scales with growing environments” and “automated policy creation and lifecycle management that reduces manual effort and ensures consistent enforcement” as important. 

Similarly, ViB Tech survey findings show that automated policy creation ranks among the most important capabilities for a microsegmentation solution, while CISA’s latest Microsegmentation in Zero Trust guidance highlights the need for segmentation policies that evolve dynamically using contextual data – a takeaway echoed in Gartner’s 2026 Reimagining Network Microsegmentation report:  

“Relying on static, IP-based microsegmentation guarantees catastrophic vulnerability to AI-driven attacks. Vendors clinging to manual policies face rapid obsolescence, as these methods are completely incapable of securing dynamic hybrid networks against lateral movement.”  

Gartner, Reimagining Network Microsegmentation: Beyond the IP – Identity, Context, and Agentless Innovation   

Instant Threat Containment and Lateral Movement Prevention  

Research shows that security leaders perceive microsegmentation’s top benefits as: 

• The ability to instantly contain and quarantine threats  
• Halting lateral movement and thwarting ransomware 

Autonomous microsegmentation unlocks a simple, scalable path to realizing these benefits. While traditional segmentation waits for someone to notice a threat and apply a rule, autonomous microsegmentation learns continuously, adapting quickly to constantly changing environments. This shift empowers defenders, allowing them to focus on meaningful projects while knowing they can rely on a self-defending network that blocks unauthorized lateral movement. 

Why Gartner Named Zero Networks a Sample Vendor for Autonomous Microsegmentation  

Purpose-built from day one to overcome the deficiencies of legacy segmentation, Zero Networks was named a sample vendor in Gartner’s Emerging Tech Radar. Zero’s automated, identity-aligned solution delivers the core capabilities defining the next generation of microsegmentation:  

• Adaptive segmentation based on learned network connections: Zero Networks deploys in a click, pinpointing every network asset before monitoring and learning all connections to create deterministic, highly accurate firewall rules and policies. 
• Human-on-the-loop enforcement and real-time visibility: Thanks to Zero’s robust automation engine and comprehensive visibility, security teams can oversee segmentation and network activity without needing to manually implement changes.  
• Comprehensive coverage and scalability across environments: Zero’s dynamic policy creation continuously refines and adapts policies to ever-growing and changing networks so organizations can automatically secure every asset (IT, and OT/IoT) across all environment types: on-premises, cloud, hybrid, and Kubernetes. 

Zero Networks’ dynamic approach delivers quantifiable business value. Zero pinpoints every asset and identity within minutes, automatically learning all network activities in just 30 days and greatly reducing the manual burden associated with managing network segmentation long-term. As a result, Zero Networks saves the average enterprise 87% compared with traditional segmentation solutions.   

By leveraging native controls at the host level and automating the most notoriously complex microsegmentation tasks, Zero Networks delivers comprehensive network protection without the manual burden of legacy solutions.  

See for yourself how Zero Networks is ushering in a new era of microsegmentation – request a demo.   

To understand where VLANs fit into modern cybersecurity strategies, we’ll outline everything you need to know about how VLANs work and when to combine them with more advanced solutions.  

Key Answers  

• What is a VLAN? A VLAN (virtual local area network) is a logical segment within a physical network that groups devices into a shared broadcast domain, regardless of where they sit physically. 
• How does a VLAN work? VLANs operate at Layer 2 of the OSI model, using switch port assignments and traffic tagging to control which devices can communicate directly with each other. 
• Is a VLAN the same as network segmentation? No, VLANs only separate broadcast domains, not traffic or access between devices. Even with a VLAN in place, a compromised device can move laterally to others in the same Layer 3 network.  
• Do VLANs stop lateral movement? VLANs cannot effectively prevent all unauthorized lateral movement on their own. In theory, communication between different VLANs is restricted unless explicitly permitted, but misconfigurations like excessive allow-rules or poorly managed inter-VLAN traffic make it easy for attackers to bypass those restrictions and move laterally. 
• What is the top VLAN alternative? Modern microsegmentation solutions extend VLAN-level isolation with identity-aware, granular access controls to close the gaps VLANs leave open without requiring a network redesign.  

Virtual LAN (VLAN) Definition 

A virtual local area network (VLAN) is a logical segment within a physical network. A VLAN can ensure network traffic on a single physical infrastructure behaves as if it is split between separate networks.  

VLANs are often used to isolate traffic for specific departments within an organization, segment VoIP systems, or create separate guest networks.   

How Do VLANs Work?  

VLANs function at Layer 2 of the OSI model, enabling devices within the same VLAN to communicate directly while restricting communication with other VLANs unless explicitly permitted. This is achieved by assigning devices to specific logical groups, then ensuring traffic is only forwarded within those groups.   

VLAN Misconception: Why VLANs Don’t Equal Segmentation

VLANs were designed in an earlier era of networking. As today’s distributed infrastructures face AI-driven attacks and sophisticated cyber threats, the inherent limitations of VLANs are increasingly clear: A VLAN is a very simple but ineffective way to separate networks. 

VLANs are often mistaken for true network segmentation, but in reality, they only separate broadcast domains – not traffic or access between devices. So, while a VLAN can reduce noise and improve organization, it doesn’t inherently stop one compromised endpoint from reaching another within the same Layer 3 network. This false sense of segmentation can leave organizations exposed to lateral movement and internal spread of attacks. True segmentation requires enforcing access controls and isolation policies that go beyond simple VLAN boundaries. 

VLANs vs. Subnets 

VLANs and Subnets are two of the most common approaches to logical segmentation. VLANs operate at Layer 2 and work by:   

• Creating multiple virtual networks within a physical infrastructure   
• Assigning specific ports, switches, or users  
• Isolating traffic between VLANs  

Subnets operate at Layer 3; they allow organizations to create segments with distinct subnet address ranges, which enables:  

• Efficient IP address management  
• Access control and security policy enforcement at the subnet level  
• Network addressing schemes for automated provisioning and configuration processes  

VLAN Configuration and Considerations: Key Components

To function properly, VLANs rely on a handful of technical building blocks, all of which play a role in configuration.  

VLAN Ports and Switches  

Switches are the backbone of VLANs. Once a VLAN is created, ports on a switch can be assigned to it so any device plugged into that port automatically becomes part of the VLAN. 

VLAN Membership 

Membership determines which devices are assigned to a VLAN; some of the most common approaches for assigning membership to VLANs are:  

• Port-based membership: The most common method, where a switch port is tied to a VLAN ID. 
• MAC-based membership: VLAN assignment follows the device’s unique MAC address. 

VLAN Tagging

Tagging helps distinguish VLAN traffic from other traffic, ensuring that traffic is associated with the right VLAN as it traverses the network. VLAN tagging is typically achieved by marking Ethernet frames with a VLAN ID.  

VLAN Trunking 

Usually completed using a protocol like IEEE 802.1Q, VLAN trunking allows a single physical link to carry traffic for multiple VLANs. 

VLAN Router 

Because VLANs operate at Layer 2, devices in different VLANs can’t communicate directly. A router (or Layer 3 switch) is needed for inter-VLAN routing, which allows traffic to pass between VLANs in a controlled way.

VLAN Segmentation: Benefits and Disadvantages  

By dividing a single physical network into multiple logical segments, VLANs make it easier for organizations to segment networks via firewalls between gateways, reduce the scope for auditing, and improve identification of assets by network addresses.  

Because VLANs offer a straightforward and cost-effective way to logically separate networks without requiring additional physical infrastructure, they have long been a foundational tool in network segmentation. In fact, VLANs remain one of the most popular network segmentation methods, leveraged by 30% of organizations today. 

Still, it’s important to recognize that VLANs were never built for today's challenges. Understanding both the advantages and pitfalls of VLAN segmentation helps clarify where the technology fits into a modern security strategy. 

VLAN Benefits: Foundational Network Security 

VLANs have earned their reputation as a tried-and-true network security strategy thanks to benefits like:  

• Performance optimization: VLANs help to keep traffic local and reduce congestion. In large enterprises with thousands of connected assets, this can meaningfully improve network efficiency.  
• Baseline security isolation: By keeping devices in one VLAN from directly communicating with devices in another, organizations can prevent accidental exposure of sensitive data and minimize the attack surface.  
• Operational flexibility: VLANs allow administrators to reorganize networks without touching physical infrastructure. For example, a device that moves to a new location can still remain in the same VLAN since it’s a logical rather than physical construct. 
• Cost efficiency: Instead of buying and deploying additional physical switches, security teams can achieve security gains more cost-effectively with VLANs.  

So, VLANs deliver foundational security improvements without excessive cost or operational complexity, but they also come with tradeoffs.

VLAN Disadvantages: Misconfigurations, Blind Spots, and Manual Burden 

VLANs are a straightforward, well-established approach to network segmentation; still, they bring distinct drawbacks, such as:  

• Administrative overhead: Each VLAN must be configured and maintained consistently across switches. In sprawling environments, this can create operational drag, excessive manual burden, and a high risk of misconfiguration. 
• Misconfigurations: VLANs are only as effective as their configurations – improper setups can introduce hidden vulnerabilities. VLANs often end up looking like Swiss cheese as allow-rules accumulate, so they don’t really increase protection on either side. Misconfigurations like excessive allow-rules or poorly managed inter-VLAN traffic make it easy for attackers to bypass restrictions and move laterally. Misconfigurations can also interrupt network operations, causing outages and poor performance.   
• Limited adaptability: VLANs work well in relatively static environments but struggle to keep pace with hybrid clouds, multisite networks, and other dynamic environments that demand constant flexibility. Large, constantly changing infrastructures make it particularly difficult to maintain and scale brittle VLAN configurations without error.  
• Security blind spots: While VLANs provide isolation, they don’t enforce granular access controls. In other words, a VLAN may visually segment a network, but true traffic isolation is only achieved with stringent rule enforcement. VLANs often give a false sense of security by appearing to segment assets when in reality they aren't properly configured for segmentation. 
• Limited granularity: VLANs divide networks into broad segments but lack fine-grained control. To combat threats like ransomware, organizations need segmentation strategies capable of preventing lateral movement and quarantining security breaches. VLANs operate primarily at Layer 2 and lack the granularity and adaptive capabilities needed to counter these sophisticated attacks.  

In practice, VLANs traditionally strike a balance between efficiency and control, but they should be understood for what they are: a legacy tool that provides valuable isolation but falls short of delivering the fine-grained, adaptive security controls modern networks require as organizations pursue Zero Trust. VLANs can be a steppingstone, but they need to be complemented by other tools to truly secure a network.

VLAN Alternatives: Network Segmentation Strategies  

While VLANs remain a staple of enterprise networking, alternative segmentation approaches may better serve an organization’s security objectives. In some cases, these strategies can (and should) be layered with VLANs to bolster cyber defenses.  

Traditional Firewall Segmentation 

Using firewalls to enforce policies between network segments can help organizations extend VLANs with more granular traffic rules. Firewall segmentation often provides familiar tooling and centralized control, but it comes with a familiar limitation: scalability. 

Every new application requires policy updates, and sprawling rule sets are prone to misconfiguration. Firewall segmentation approaches also tend to enforce coarse controls rather than the fine-grained, dynamic access policies needed today. 

Software-Defined Networking  

SDN decouples the control plane from the data plane, enabling administrators to centrally manage traffic flows. Organizations with large, virtualized, or cloud-heavy environments may turn to SDN for greater agility. However, SDN requires significant upfront investment and often necessitates a complete network overhaul with reconfiguration of the existing infrastructure. On top of that, the developing nature of SDN technology means it requires specialized knowledge to manage, and while SDN centralizes control, it doesn’t necessarily alleviate operational complexity. 

Application Ringfencing   

Application ringfencing tightly controls how applications communicate with one another and what resources they can access. Ringfencing limits the blast radius by ensuring applications operate only within defined boundaries, making it a particularly appealing approach for environments where certain applications are especially sensitive or heavily regulated.  

Importantly, application ringfencing is best leveraged as part of a layered strategy as it’s not a comprehensive segmentation solution. Like other approaches, ringfencing also brings operational complexity and administrative burdens as implementing and managing policies requires significant manual effort.  

Physical Segmentation  

At face value, physical segmentation – the practice of deploying separate physical infrastructures for different parts of an organization – may seem like a step in the wrong direction as it’s expensive, rigid, and difficult to scale. However, this method provides the highest level of isolation since segments are physically disconnected, making lateral movement extremely difficult.  

Still, even for organizations with extremely high security or regulatory requirements (like those in government, defense, or other mission-critical industries), physical segmentation is falling out of step with modern trends such as cloud adoption and hybrid workforces.  

Microsegmentation  

Unlike traditional network segmentation approaches – which generally divide a large network into broad subnetworks, or segments – microsegmentation is a much more granular and robust process of isolating all clients, workloads, applications, virtual machines, and operating systems into individual segments with unique security perimeters.  

Microsegmentation aligns with Zero Trust principles by enforcing least privilege across the entire network; it gives organizations the ability to proactively contain breaches at the source, block lateral movement, and shrink the attack surface. Legacy microsegmentation has historically been complex to deploy and manage, leading to relatively low adoption despite widespread recognition that microsegmentation is the gold standard in network security. However, modern microsegmentation solutions can combine deterministic automation and identity-aware access controls to accelerate implementation and enable hands-free adaptability, unlocking granular segmentation at scale – without added complexity. 

Real-World Example: Replacing VLANS with Microsegmentation   

Reference Laboratory delivers high-quality clinical analysis services in collaboration with 400+ hospitals and 1,000 clinical analysis laboratories worldwide, so downtime can spell diagnostic delays and critical disruptions in patient care. Although Reference Laboratory had achieved basic segregation with VLANs, the organization struggled with a lack of visibility into VLAN traffic – and in turn, a lack of control.  

Reference Laboratory turned to Zero Networks’ automated, identity-based microsegmentation for the granular control, comprehensive visibility, and operational simplicity they needed, uncovering previously unknown service accounts and automatically generating fine-grained access policies to constrain them. 

Modernizing Network Security: Evolving Beyond VLANs  

VLANs remain an important network security building block, providing an initial level of internal segmentation that improves performance and basic security. But as environments grow more complex and threats more advanced, VLANs alone are not enough. Instead, VLANs should be part of a layered defense strategy that includes firewalls, Zero Trust Network Access (ZTNA), and automated microsegmentation.  

Zero Networks makes it easy to address the security vulnerabilities left by VLANs and achieve comprehensive granular segmentation with an automated, three-step approach: 

• Comprehensive Discovery: Zero deploys in a click, automatically pinpointing assets before conducting a detailed analysis of all network interactions during an automated learning period.   
• Automated Tagging and Policy Creation: Using the data gathered in learning, Zero Networks generates deterministic, fine-grained policies – no manual labeling, guessing on grouping, or never-ending policy creation required.  
• Effortless Enforcement: Once policies are in place, Zero automatically segments assets, rapidly enhancing security without disrupting day-to-day operations.   

Learn more about how you can build from the foundational network security established by VLANs and achieve comprehensive, identity-aware microsegmentation without adding operational complexity – request a demo.  

In an era where cyber threats and enterprise networks are constantly evolving, Zero Trust is a critical security building block – not a buzzword. Still, 90% of organizations have yet to achieve an advanced level of cyber resilience as they struggle to operationalize Zero Trust strategies, despite recognizing microsegmentation as key to success.

We’ll dig into the importance of Zero Trust in cybersecurity today, how microsegmentation accelerates Zero Trust maturity, and key capabilities to leave traditional microsegmentation challenges behind and bring advanced Zero Trust milestones within reach.  

Key Answers  

• How are network segmentation and Zero Trust related? Network segmentation represents a core Zero Trust pillar; by proactively limiting what any user or device can access, granular network segmentation ensures that attackers remain isolated even if they manage to gain initial access. In recent years, industry leaders like CISA have affirmed that microsegmentation is foundational for Zero Trust.  
• What are the most important capabilities for Zero Trust microsegmentation? Key Zero Trust microsegmentation capabilities that help security teams overcome traditional operational hurdles include automated policy creation and enforcement, integrated identity controls, and agentless deployment.  
• How does Zero Trust microsegmentation strengthen AI security? A modern Zero Trust microsegmentation solution helps protect against offensive AI leveraged by attackers and close security gaps created by enterprise AI adoption, enforcing AI security best practices such as: proactively isolating systems, enforcing least agency for all AI agents with identity-based access controls, applying deterministic guardrails to AI adoption, and maintaining real-time network visibility and control.

What Is Zero Trust? Redefining Network Security

Zero Trust security is a cybersecurity strategy that distrusts all traffic by default, even if it’s already inside the network perimeter. Zero Trust upends traditional perimeter-based approaches to network security by removing implicit trust and requiring continuous verification of users, devices, and access requests. Rather than assuming internal traffic is trustworthy, Zero Trust assumes breach.

The Zero Trust model is built on core principles like:

• Never trust, always verify: Every request is treated as risky until proven otherwise.
• Least privilege access: Users, devices, and applications get only the access they need – nothing more.
• Assume breach: Networks are designed with the expectation that attackers will breach perimeter defenses.

As modern networks sprawl across data centers, clouds, branch locations, remote endpoints, and everything in between, implementing Zero Trust to prevent unauthorized lateral movement and cut off attackers’ pathways has never been more important.

Today, 64% of organizations connect more than 5,000 assets to their corporate networks. Tasked with securing such complex and ever-expanding infrastructures, it’s easy to see why 90% of cyber professionals consider Zero Trust key to improving cybersecurity posture.

This widespread emphasis on Zero Trust marks an important shift in prevailing cybersecurity sentiments. Dr. Chase Cunningham, aka Dr. Zero Trust, says it’s encouraging to see 90% of security leaders embrace Zero Trust: “If we compare this to five years ago, it would be pretty much the other side of the coin."

Zero Trust Security vs. Zero Trust Architecture: What’s the Difference?

Zero Trust security refers to an overarching philosophy that removes inherent trust for anything inside or outside the network.

Zero Trust architecture (ZTA) refers to the implementation of that philosophy within an organization’s infrastructure, workflows, controls, and policies.

The NIST 800-207 special publication on Zero Trust architecture explains the nuance this way:

“Zero trust (ZT) provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised. Zero trust architecture (ZTA) is an enterprise’s cybersecurity plan that utilizes zero trust concepts and encompasses component relationships, workflow planning, and access policies. Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a zero trust architecture plan.”

The NSA's Zero Trust Reference Architecture is one of the most widely referenced frameworks for operationalizing Zero Trust, outlining seven core Zero Trust pillars that collectively reduce risk, contain threats, and bolster cyber resilience.

Zero Trust Pillars Explained: NSA’s 7-Pillar Model

The pillars the NSA ranks as essential for building a mature Zero Trust environment are:

• User: Continuous authentication and behavioral monitoring of users
• Device: Evaluation of asset health, compliance, and posture
• Applications & Workload: Protection for applications, containers, and services
• Data: Tightly controlling access to sensitive data while enabling transparency and visibility
• Network & Environment: Segmentation and isolation of the network with granular policy and access controls
• Automation & Orchestration: Adaptive security responses enabled by dynamic automated processes
• Visibility & Analytics: Monitoring and analysis of network behavior and events to inform access decisions

Notably, 75% of security leaders say the NSA’s model is optimal for realizing Zero Trust security outcomes – and they’re focused on two pillars in particular. Cyber pros say the Data and Network & Environment Pillars are most critical to Zero Trust, with 89% rating each of these pillars as “extremely important” or “very important.”

To strengthen these key pillars, security teams can lean on guidance from Zero Trust models which call out network segmentation as a foundational strategy.

How Network Segmentation Advances Zero Trust

Network segmentation divides a network into smaller, secure subnetworks or zones, each with its own access controls and security policies. In turn, network segmentation adheres to the Zero Trust guidance to treat every request – whether from a user, device, or application – as potentially malicious.  

In other words, segmentation helps implement Zero Trust by limiting what’s accessible to any user or device at any time; even if an attacker gains entry, they’re effectively trapped within that segment and cannot move laterally to access more sensitive systems.  

As AI adoption accelerates, this approach is more important than ever. Among organizations that experienced an AI-related breach in the last year, 92% lack proper AI access controls; across all organizations, less than a third have extended Zero Trust architecture to include non-human identities (NHIs) like AI agents.   

What Top Zero Trust Frameworks Say About Network Segmentation  

Both the NSA and CISA Zero Trust frameworks highlight segmentation as essential to achieving Zero Trust. The NSA places it at the center of the Network & Environment pillar, requiring organizations to isolate systems and apply dynamic, risk-based access policies. CISA echoes this guidance in its Zero Trust Maturity Model, emphasizing segmentation as a key capability for mitigating unauthorized access. 

In fact, CISA’s latest Microsegmentation in Zero Trust guidance validates that microsegmentation is not a nice-to-have or an advanced-stage optimization, it’s a foundational pillar of Zero Trust security that every organization can and should adopt.  

“Rather than structuring defenses around perimeters and hoping to prevent security breaches, [Zero Trust] architecture presumes that breaches will occur, networks are already compromised, and the design must minimize the damage of current and future breaches … microsegmentation limits opportunities for threats to exploit network-adjacent systems and data through vulnerabilities or other weaknesses. As a result, the microsegment limits the impact to an organization if it is exploited.” 

CISA, Microsegmentation in Zero Trust 

Most organizations understand the importance of network segmentation for Zero Trust – over 90% are currently using or planning to use network segmentation as part of their Zero Trust strategy. 

While any level of network segmentation is a useful Zero Trust stepping stone, not all methods are created equal – many organizations still rely on basic segmentation approaches, inevitably slowing their Zero Trust journey.   

Top Network Segmentation Strategies for Zero Trust

Sixty-five percent of organizations are using network segmentation today; of that group, nearly three-quarters rely on firewalls and VLANs to segment their networks.

Network segmentation aligns perfectly with Zero Trust principles by dividing the network into tightly controlled zones and preventing unrestricted access, so any degree of network segmentation is a step in the right direction. However, traditional segmentation methods like VLANs present limitations that make it difficult to implement the key tenets of Zero Trust at scale.

Traditional firewalls and VLANs are typically static, prone to misconfigurations, and difficult to scale across hybrid environments. They can segment broad zones but can’t provide the granular, identity-aware controls needed to enforce least privilege across the entire network.

To mature Zero Trust, segmentation strategies must evolve.

Zero Trust Microsegmentation: Evolving Network Security

While traditional network segmentation approaches divide a large network into smaller segments, microsegmentation is a much more granular and robust process of isolating all clients, workloads, applications, virtual machines, and operating systems into separate segments with individual security perimeters and policies.

It’s no secret that microsegmentation is the network security gold standard – and vital for accelerating Zero Trust. About three-quarters of security leaders say microsegmentation is important for cyber defense; nearly 70% agree it’s key to realizing Zero Trust.

Why Is Microsegmentation Important for Zero Trust?

Microsegmentation strengthens Zero Trust pillars like:

• Network & Environment: By isolating every asset, microsegmentation reduces the risk of lateral movement and instantly contains breaches.
• Data: When paired with identity segmentation, microsegmentation restricts access to sensitive data by tightly controlling who (or what) can access specific assets, enforcing least privilege by design.
• Automation & Orchestration: Modern microsegmentation solutions support policy automation and adaptive enforcement, scaling alongside network changes.

Still, holistic network segmentation is difficult to achieve with legacy tools – that’s why so many organizations still rely on traditional segmentation solutions. 

Zero Trust Roadblocks: Key Microsegmentation Challenges

Despite the widespread understanding that microsegmentation means built-in Zero Trust, just 5% of organizations are microsegmenting their networks today. It’s no coincidence that 88% of CISOs say they’ve experienced significant challenges in their attempts to implement Zero Trust. Because microsegmentation is core to operationalizing Zero Trust, stalled or failed microsegmentation projects create a Zero Trust barrier.  

Security leaders’ top concerns about implementing microsegmentation echo well-known and long-standing challenges with legacy microsegmentation solutions.  

The top reported concerns with implementing microsegmentation are:

• Implementation complexity
• Disruption to existing operations
• Dealing with legacy applications

To effectively curb these challenges and advance Zero Trust initiatives beyond early stages, security leaders must set their sights on modern, autonomous microsegmentation. 

How to Implement Zero Trust Microsegmentation

The key to unlocking Zero Trust microsegmentation lies in simplicity. Security teams can leave complex, labor-intensive, and never-ending microsegmentation implementations in the past by prioritizing capabilities like automation, agentless deployment, and MFA.

IT and security leaders recognize these factors as key to simplifying microsegmentation on their Zero Trust journeys – ViB Tech survey findings showed that MFA overlay, automated policy creation, and agentless deployment rank as the most important capabilities for a microsegmentation solution. 

Research from EMA on the maturing microsegmentation market reinforced those findings. When asked about the important differentiators between leading microsegmentation solutions and legacy approaches in the next 1-2 years, respondents prioritized:   

• Fast, automated asset discovery and tagging that scales with growing environments 
• Automated policy creation and lifecycle management that reduces manual effort and ensures consistent enforcement  
• Integration with multi-factor authentication (MFA) to secure privileged access   

Here’s how modern capabilities like these translate to streamlined microsegmentation implementation, and in turn, an accelerated Zero Trust journey:

• Automated asset tagging and grouping: Manually creating tags or labels for every asset is incredibly time-consuming and labor-intensive. By intelligently and accurately automating this process, security teams can remove a key barrier to entry and ensure microsegmentation projects don’t stall before they truly start.
• Hands-free policy creation: Modern microsegmentation solutions can automatically create, enforce, and manage deterministic, highly accurate rules and policies based on learned network behavior, drastically reducing implementation complexity, ongoing management burdens, and the risk of misconfiguration.
• Layered identity-aware access controls: Microsegementation solutions with built-in identity segmentation and MFA capabilities directly strengthen Zero Trust pillars related to network, data, and identity by ensuring all users, service accounts, and devices are governed by least privilege access. Network layer MFA even scales just-in-time verification to non-SaaS assets to secure every port, protocol, and application, erasing the legacy tech challenges so many organizations report as top barriers to microsegmentation.
• Agentless architecture: With an agentless approach, modern microsegmentation can be deployed quickly across diverse environments without the need to install software on every endpoint. This not only ensures consistent policy enforcement across on-premises, cloud, and hybrid infrastructures, but also eases concerns that microsegmentation will disrupt operations or break critical network connections.

With modern microsegmentation capabilities, organizations can take a shortcut through the Zero Trust roadmap, leapfrogging early steps like rough segmentation and building mature Zero Trust architectures in record time.

“I tell people with automation and an agentless capability, microsegmentation doesn't have to be at the end of the road anymore – it can actually now be at the front.”

- Nicholas DiCola, VP of Customers at Zero Networks

A Unified Solution for Zero Trust Microsegmentation

Zero Networks delivers a comprehensive solution for Zero Trust microsegmentation. By combining identity segmentation, adaptive policy automation, network layer MFA, and agentless deployment, Zero Networks enables organizations to: 

• Segment every asset in a click 
• Automatically enforce least privilege access everywhere 
• Block lateral movement and contain breaches in real time 
• Build Zero Trust principles into the network architecture without disrupting operations  

When it comes to Zero Trust, it’s time to rethink what’s possible. Learn how Zero Networks makes microsegmentation enables preemptive cyber resilience and brings Zero Trust within reach – request a demo.  

A containment-focused approach to cyber risk quantification overcomes the language barrier between CISOs and business leaders by delivering an objective measurement of what’s at stake, how easily an attacker could reach critical assets, and where security investments can minimize cyber risk exposure the fastest. We’ll walk through a step-by-step approach for connecting security gaps to real-world impact, then leverage those insights into a business-validated cyber resilience roadmap.  

Key Answers  

• What is cyber risk quantification? The practice of measuring cybersecurity risks in objective, business-aligned terms, so security leaders can communicate the cost of a security gap and the value of proposed security investments in a language every executive and board member grasps.
• How can enterprises measure cyber resilience? To calculate an enterprise containment score (the most defensible measure of proactive cyber resilience), security teams need a validated inventory of critical assets, an estimate of the business impact if any of those assets were compromised, and an attack path analysis that scores each asset’s current level of exposure within common compromise scenarios. Composite containment scores for each critical asset can be averaged out to an enterprise-wide score.
• How can security leaders track the value of cyber resilience investments? By regularly calculating containment metrics in the context of business exposure, security leaders can measure cyber risk exposure before and after implementing targeted controls designed to address the costliest risks. Reduced exposure of business-critical assets translates to measurable cyber resilience ROI.  

What Is Cyber Risk Quantification?   

Cyber risk quantification (CRQ) is the process of assigning objective, business-aligned measurements to cybersecurity threats and vulnerabilities. For example, rather than surfacing a gap as “critical,” a properly executed CRQ enables security leaders to communicate the cost of that gap in business terms and quantify the impact of suggested security investments.  

While many CRQ strategies focus on the estimated financial repercussions of a breach, it’s equally important to measure the true scope of exposure by uncovering how accessible critical assets are and what security controls are currently in place to mitigate that accessibility.  

Containment Metrics: Measuring Proactive Resilience Strategies  

Containment metrics are critical to comprehensive cyber risk quantification. Rather than scoring how well a security team detects or responds to an incident, containment metrics score the structural properties of the environment – the factors that determine how far an attacker can move and how much damage they can do from an initial point of compromise.  

Containment metrics help translate a critical asset inventory into a high-level exposure score that’s digestible at the board level.  

The 3 Dimensions of an Enterprise Cyber Resilience Score  

To calculate the full scope of cyber risk exposure, security leaders need three connected inputs:  

1. Critical asset inventory: Identify which systems are essential to business operations.   
2. The business impact of critical asset compromise: Collaborate with cross-functional leaders to quantify the impact of a critical asset breach, in both financial and operational terms.  
3. Attack path analysis and breach containment controls: Map the attack paths adversaries could use to reach critical assets and measure the existing security controls along those paths. Note: We understand mapping attack paths is a lot of work. That's why we built a free tool that will do it for you – get it here.  

The goal isn’t just to inventory critical assets and establish their current exposure, but to translate those insights into an overall containment score, standardizing cyber resilience measurement and clarifying the value of security investments.  

How to Quantify Business Exposure: Mapping Cyber Risk to Business Impact  

With an inventory of critical assets and a baseline estimation of the financial or operational fallout if a compromise occurred, security teams can proceed to measuring how exposed critical assets are today and uncovering which security interventions would most meaningfully shrink that exposure.  

Track Path Distance, Privilege Escalation, and Data-Layer Controls  

For each critical asset, security teams should analyze attack paths using common compromise scenarios and likely ingress points. Each of these paths should be scored on dimensions of structural containment:  

• Path Distance: How many structural barriers and controls – such as authentication boundaries and network segments – exist between the ingress point for a breach scenario and the critical asset.  
• Privilege Requirements: How difficult it is for an attacker to gain the privileges needed to access the critical asset, defined by factors like escalation levels required and service account density.  
• Data-Layer Controls: How much damage an attacker could do once they reach the critical asset, indicated by encryption at rest and identity-based access controls.  

Calculated together, these measurements turn a list of individual controls into a unified resilience metric.  

Critical Asset Containment Score: Detailed Exposure Breakdown  

After scoring every compromise scenario against structural containment dimensions, security teams can calculate each critical asset’s overall containment score by: 

• Counting the controls within the first two containment categories to reach a composite (average) score for both path distance and privilege requirements  
• Calculating the overall containment score for each path using the formula: Containment Score = (Path Distance composite x 0.54) + (Privilege Requirements composite x 0.36) + (0.5 for each Data-Layer Control)  
• Mapping overall containment scores for each compromise scenario to understand where the greatest weaknesses lie, then averaging path-level containment scores to reach the critical asset’s composite containment score.  

This approach leaves security leaders with two important insights: a high-level view of each critical asset’s resilience posture, and a granular view of the riskiest exposures across the business, indicated by each asset’s lowest containment score.  

Highest Cost Path Indicator: Enterprise-Wide Cyber Risk Insights  

The final step in quantifying cyber risk and resilience is to consolidate containment scores into one business-wide score and to surface priority security gaps by documenting worst-case containment scores in a single enterprise view.  

First, calculate the average of every critical asset’s composite containment score; the result is the organization’s overall containment score. Next, look back at the lowest containment scores for each critical asset – these will be used to calculate the highest cost path indicator (HCPI), which assigns a single blended score for cyber exposure and business exposure.  

To calculate HCPI, divide the median estimated damage from a critical asset breach by the asset’s worst-case containment score. A higher result (relative to the HCPI for other critical assets) indicates that an asset is both costly to lose and easy to reach; a lower score indicates that the asset carries relatively low business impact or is fairly well protected.  

Tracking the HCPI for every critical asset gives security leaders a single, comprehensive view of where enterprise risk is concentrated – and the controls that would most significantly improve business exposure.  

Building a Cyber Resilience Plan with Business Exposure Measurements  

Calculating enterprise-wide containment scores by using granular per-scenario and per-asset scores as building blocks gives security leaders both the high-level reporting output they need to communicate at the board level and the detailed exposure insights that tell what to do about it.  

When a CISO surfaces HCPI scores across the enterprise, they can use the individual containment metric scores within each of those worst-case compromise scenarios as a diagnostic tool to uncover priority interventions:  

• A low path distance composite score indicates the need for more comprehensive network segmentation and additional authentication boundaries. Path distance is the most heavily weighted dimension of containment scoring because adding one of these controls can eliminate entire compromise scenarios; as a result, actions here typically have the largest impact per dollar invested.  
• A low privilege requirements composite score indicates that eliminating standing privileges, governing service accounts, or enforcing just-in-time access controls would most meaningfully improve business exposure.  
• Missing data-layer controls within a worst-case compromise scenario can be addressed by adding granular identity-based access controls or encryption at rest with separated key management.  

Building a cyber resilience roadmap this way gives security leaders a data-driven and defensible strategy for investment asks and provides a baseline for measuring the impact of those investments over time. Tailoring cyber resilience strategies to business exposure delivers the evidence boards expect in a language they can easily grasp.  

Strengthen Cyber Resilience and Maintain Business Continuity with Zero Networks 

Zero Networks gives security teams a direct path for addressing business-critical cyber risk exposure. With automated, identity-based microsegmentation, Zero provides immediate visibility into every identity and asset on the network, then automatically enforces adaptive, identity-aligned policies that prevent lateral movement to critical assets to safeguard business resilience.   

By strengthening every containment dimension from a unified platform, Zero Networks unlocks a cyber resilient architecture with measurable business value. Request a demo to learn how.