Microsegmentation is the practice of dividing a network into small, isolated segments with tightly controlled connections between them, so that a compromise in one zone cannot spread freely across the whole network.
The problem it solves
Many networks are, in security terms, flat. Once you are inside, you can reach almost everything: a compromised laptop can talk to the file server, the database, the domain controller, and the connected devices, with little standing in the way. Attackers love flat networks, because a single foothold gives them the run of the place. Lateral movement, the stage where an intrusion spreads from one machine to many, is fast and easy when nothing is segmented.
Segmentation is the long-standing answer: divide the network into zones and control what can cross between them. Microsegmentation takes that idea to a much finer grain. Rather than a few large zones, it enforces tightly controlled boundaries around small groups of systems, or even individual workloads and devices, so each one can communicate only with what it genuinely needs. The micro in the name is the point: the segments are small and specific, not broad.
How microsegmentation works
Microsegmentation is enforced through policies that define which systems are allowed to talk to which others, and over what protocols. A patient monitor might be permitted to communicate only with its central monitoring station and nothing else; a billing server only with the specific systems it integrates with. Everything not explicitly allowed is denied. These policies are applied at the network layer, so they work regardless of what is running on the device, which matters for the many devices that cannot host security software.
The more advanced forms are dynamic and behavior-aware rather than static. Static segmentation, where rules are written once and rarely change, is powerful but hard to maintain as an environment evolves. Behavior-aware microsegmentation can adjust in response to what it observes, and crucially it can tighten around a specific device the moment that device starts behaving like a threat, isolating it at the network layer in real time.
Why it is so effective against ransomware
Microsegmentation directly attacks the stage of a ransomware campaign that does the most damage: the spread. An attacker who compromises one machine in a well-segmented network finds that the machine can only reach a handful of others, each boundary a wall they have to overcome. Instead of racing across a flat network to deploy ransomware everywhere at once, they are contained to a small blast radius, which buys defenders time and dramatically limits the harm.
In a hospital, this capability has an added dimension. The ideal response to a compromised medical device is to cut off the attacker's access without shutting the device down, because the device may be attached to a patient. Microsegmentation enforced at the network layer makes that possible: the device can be quarantined, its connections severed, while it stays powered and clinically functional. That is the difference between a containment action and a patient-safety incident.
Where it fits in a modern defense
Microsegmentation is a core building block of a zero-trust architecture, the model that assumes no system should be trusted by default simply because it is inside the network. By default-denying communication and allowing only what is explicitly needed, microsegmentation operationalizes the zero-trust principle at the network level. It pairs naturally with behavioral detection, which identifies the threat, and with continuous access verification, which governs who and what can connect.
On its own, segmentation does not detect an attack, and detection on its own does not contain one. The power comes from combining them: a system that can both recognize an intrusion by its behavior and immediately shrink the network around it to stop the spread. That combination is what turns the attacker's most important stage, lateral movement, into their biggest obstacle, and it is a central reason microsegmentation has become a standard recommendation in guidance on defending against ransomware.
Why it has historically been hard, and what changed
If microsegmentation is so effective, a fair question is why every network is not already segmented this way. The honest answer is that, done the traditional way, it is hard. Defining precise rules for which of thousands of systems may talk to which others, then maintaining those rules as the environment constantly changes, is an enormous manual effort. Get a rule wrong and you break a legitimate workflow; leave it too loose and you lose the protection. Many segmentation projects stall under this weight, which is why plenty of networks remain flatter than their owners would like.
What has changed is the move toward automated, identity- and behavior-aware segmentation. Rather than hand-writing every rule, modern approaches learn how systems actually communicate, propose policies from that observed behavior, and adapt as things change, which removes much of the manual burden that made segmentation so painful. In a healthcare setting this matters doubly, because the device fleet is large, varied, and cannot be interrupted. Automated microsegmentation that can learn a patient monitor's normal communication and enforce it, then tighten instantly if the device is compromised, delivers the protection without the unmanageable upkeep, which is what finally makes fine-grained segmentation practical at hospital scale.
See also
Sources
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.