In a typical 30-person SME we visit after an incident, the network almost always looks the same: one shared 192.168.1.0/24, in which the receptionist's PC can see the production server, the cash register can see the accounting server, and the printer in the corridor can see everything else. If ransomware enters through any one of these, it covers everything with an IP address within four hours.
Network segmentation isn't a CISO conference topic. It's one of the cheapest and most underrated defensive controls in an SME — and at the same time the one most often missing. Most of the companies we work with have decent backups, MFA enabled, even some training. And then they have a flat network in which everyone sees everyone, and the first serious attack costs weeks of work.
This post is about what segmentation actually looks like in a 30-person company, what it isn't (despite being sold as such), and which zones are worth separating first.
Flat network = free highway for ransomware
A "flat network" means that every device in the company — employee computers, file server, ERP, printers, cameras, VoIP phones, the TV in the meeting room, someone's personal laptop plugged in "just for a moment" — all live on one subnet. Each can open a connection to any other. No isolation, no limits, no logs.
From an attacker's perspective this is a dream infrastructure. Get one foothold — usually an employee computer that clicked an infected attachment — and you can:
- Scan the whole network for open shares (SMB, RDP, SQL databases).
- Log into service accounts that "have to access everything".
- Encrypt files on the file server the workstation has drives mapped to.
- Take over more machines through known OS bugs or weak passwords.
All of this traffic happens inside the network, under the edge firewall's radar — because the firewall watches the boundary with the outside world, not traffic between reception and the server room. That's why modern ransomware doesn't need many hours: it just needs the network to be one big open room.
Segmentation turns that room into an apartment with doors. After the break-in, the intruder is still inside — but no longer everywhere at once.
A 27-person joinery and one email on a Friday
At one of our clients — a 27-person joinery making bespoke furniture — the bookkeeper clicked on Friday afternoon on an email that looked like an invoice from a regular plywood supplier. ZIP with a macro. The antivirus reacted on the workstation, but too late — the process had already launched a script that started scanning the network.
The company had the configuration typical for the industry: a single 192.168.0.0/24 LAN with office computers, a file server with CAD projects, a Comarch Optima server, a CNC controller in the workshop (Windows XP, because nobody ever updated it — "it works, don't touch it") and a few network shares with passwords like "company2018". Within four hours the ransomware had encrypted the file server, the Optima database and — most painfully — the CNC config files. Production stopped.
Recovery took 5 business days: the file server backup was from the previous night (weekly copy), Optima from a daily copy, but the CNC configurations had to be rebuilt from the operators' memory and paper notes. Production losses — by the owner's estimate — exceeded 60 000 zł, not counting what they paid us for the rebuild.
After the incident we set up simple segmentation with them: four VLANs (office, servers, workshop/OT, guests), rules on an internal firewall limiting traffic between them to what was actually needed, isolation of the CNC controller from office traffic, separate admin accounts for the servers (not accessible from office computers). Hardware cost — one new entry-class router/firewall (MikroTik/Fortinet) — around 4 500 zł. Configuration work — two days.
Half a year later another employee clicked another bad email. The ransomware encrypted one computer. The rest of the network didn't notice. Recovery: three hours, including coffee.
This isn't a story about magic. It's a story about the same attack costing 60 000 zł plus a week of downtime in an unsegmented network, and one laptop reimage in a segmented one.
What segmentation actually means in a 30-person company
In a corporation, segmentation usually means microsegmentation, zero-trust, SASE and a five-year project with consultants. In an SME, something much simpler is enough: dividing the network into a few zones, with traffic between them deliberately limited.
Technically you do this with VLANs on a managed switch (most switches under 2 000 zł already support this) and rules on an internal firewall — most often the same edge router you already have. You don't need a new server rack. You need awareness of what really has to talk to what, and a decision that the rest — doesn't.
Three simple questions worth asking for every pair of devices in the company:
- Does computer X really need access to server Y? If yes — on what port and protocol?
- Is the access constant, or only sometimes?
- What happens if computer X gets infected — how far does the intruder go?
Most answers are "actually, it doesn't need to". The meeting-room tablet has no reason to see the file server. Reception's computer doesn't need access to the ERP database. The printer doesn't need to chat with the database. These "don't need to" answers are exactly the blocking rules worth writing down.
5 zones worth separating in an SME
This isn't the only valid split — but it works for a typical 10–50 person SME and can be implemented in two days.
- Office zone (employee computers). All laptops and desktops in admin, sales, accounting. They have internet access and access to selected application servers (ERP, CRM, file shares), but not to the production network and not to IoT devices or printers from other zones.
- Server zone. ERP, database, file server, mail server (if on-prem), domain controller. From outside this zone, access only through specific application ports. Administration (RDP, SSH, panel) only from a dedicated computer/jump host, not from every desk.
- Production / OT zone. Machine controllers, HMI panels, registers, barcode scanners, warehouse terminals. Often old systems that can't be patched. Rule: no internet access (beyond necessary vendor servers), no access from desks, no access from guests.
- Guest and private Wi-Fi zone. Guests, employees' private phones, smart TVs, the Wi-Fi coffee machine. Internet only, zero access to anything inside. Separate SSID on a separate VLAN — ten minutes of configuration on a typical access point.
- IoT / print zone. Printers, cameras, alarms, IoT. These devices notoriously have unpatched vulnerabilities. Keep them apart and only let them talk to specific management servers.
These five zones cover 90% of segmentation needs in a typical SME. You can split them further (e.g. accounting separate from the rest of the office), but those are nuances — the biggest gain comes from separating these five.
What isn't segmentation, even though it's sold as one
The industry sells plenty of things under the "segmentation" label that sound good but don't solve the problem. The most common confusions:
- A second Wi-Fi with a different password. If both SSIDs land in the same LAN, you simply have two names for the same highway. Real segmentation requires that the second SSID lives in its own VLAN with its own rules.
- "We have a firewall, we're safe". An edge firewall watches the internet boundary. It doesn't see internal traffic. Ransomware that's already inside spreads between computers under its radar.
- VLANs without firewall rules. A VLAN alone only separates layer 2 (broadcast). If the router between VLANs forwards everything, you have a flat network again — just with more configuration.
- "Antivirus on every machine". Antivirus saves the single machine that happens to get "lucky". It doesn't save a network in which trust is global. AV and segmentation aren't alternatives — they're different layers.
- An expensive "NGFW" with UTM, IPS, sandbox. All those features are valuable, but if a flat network sits behind it, you've spent 25 000 zł on a gateway the ransomware doesn't even need to bypass — it lives quietly inside.
Each of these has its place as part of the puzzle. None replaces a conscious split of traffic into zones.
Where to start this week
If you run a 10–50 person SME and this list makes you realise "we have a flat network", the good news is: the first real risk reduction can be done over two evenings. In this order:
- Draw the network on paper. What you have: how many switches, how many access points, where the servers live, where the controllers, where the printers. You can't plan a split without it.
- Separate guest Wi-Fi. The simplest step and an immediate gain. Separate SSID, separate VLAN, internet only. One hour on a typical Ubiquiti/MikroTik/Aruba Instant access point.
- Separate the production/OT network. If you have anything industrial (CNC, registers, terminals, lab devices), keep it on its own VLAN with no internet access and office access only on specific ports. This is what saves production when the office goes down.
- Turn off SMBv1 and password-less shares. A classic from 2017–2024 — most mass infections still spread that way. Ten minutes per computer.
- Audit your admin accounts. A daily-driver computer should not be logging in as a domain admin. Split daily accounts from admin accounts and only allow admin from one controlled place.
- Plan a full segmentation rollout. After these first steps you've already captured ~50% of the benefit. The rest is worth spreading across 2–3 weekends with preparation (buying a managed switch if you don't have one, designing VLANs, writing firewall rules).
Segmentation doesn't stop ransomware. Ransomware will get in eventually — through phishing, through a tainted update, through a compromised supplier. But segmentation decides whether you lose one computer and three hours, or the whole company and a week. That's the difference you can't buy after the incident — you buy it now, while nothing is happening.
If you want to set this up in your company but aren't sure whether to start with a switch, the firewall, or a network map — we help SMEs break this kind of thing down regularly. The first call is free and takes half an hour.
Ransomware doesn't encrypt the whole company because it's clever. It encrypts because the whole company sits in one room.