VLANs are not segmentation: what practitioners need to know

At a glance

What this is: This article argues that VLANs provide basic network separation, but they are not true segmentation because they do not inherently prevent lateral movement or enforce fine-grained access.

Why it matters: For IAM and security practitioners, the key issue is that logical separation alone does not equal access governance, so network boundaries still need policy enforcement, identity-aware controls, and containment.

By the numbers:

• VLANs remain one of the most popular network segmentation methods, leveraged by 30% of organizations today.

Context

A VLAN is a logical network partition, not a security decision engine. It can separate broadcast domains and keep traffic organised, but it does not automatically enforce who or what may talk to what across the environment.

That distinction matters because modern attack paths exploit weak internal boundaries, not just exposed edges. In mixed enterprise, cloud, and hybrid environments, VLANs are often treated as segmentation when they are really only one input to it, and that creates governance gaps around lateral movement and policy drift.

Key questions

Q: What breaks when manufacturing networks rely on VLANs for segmentation?

A: VLANs create broad trust zones, so once an attacker enters a segment, they can often move laterally to other reachable devices inside the same zone. In manufacturing, that is especially dangerous because OT assets often share infrastructure and cannot all be protected with agents or frequent redesign. The control fails when location is treated as trust.

Q: Why do VLANs still leave lateral movement risk inside internal networks?

A: Because VLANs separate broadcast domains, not trust decisions. If routing rules, allow-lists, or inter-VLAN policies are too permissive, an attacker who reaches one endpoint can often move to adjacent systems without hitting a meaningful authorization check. The risk grows in dynamic environments where manual VLAN policy drifts.

Q: How do security teams know when VLAN-based controls are too coarse?

A: A practical sign is when the team can describe network segments but cannot explain the exact policy that prevents one compromised internal host from reaching another. If exceptions are common, policies are inconsistent, or segmentation depends on manual maintenance, the control is too coarse for modern east-west risk.

Q: What should organisations do when they need stronger internal segmentation than VLANs provide?

A: They should move toward microsegmentation or identity-aware policy for critical assets, then keep VLANs as an organisational layer rather than the primary control. That approach gives the team finer-grained enforcement, better blast-radius control, and a more realistic Zero Trust posture for internal traffic.

Technical breakdown

How VLANs separate traffic at Layer 2

A VLAN groups devices into a logical broadcast domain on the same physical infrastructure. Devices inside the same VLAN can communicate directly, while traffic to other VLANs must traverse a router or Layer 3 switch if inter-VLAN communication is allowed. That makes VLANs useful for organisation and basic isolation, but the control is structural rather than contextual. VLAN membership, tagging, and trunking decide where traffic can flow, not whether a specific user, workload, or device should be trusted. In modern environments, that distinction is critical because network placement alone does not express identity, intent, or privilege.

Practical implication: treat VLAN assignment as topology, then enforce access policy separately at the point where traffic is permitted to cross boundaries.

Why VLANs fail as a segmentation boundary

VLANs break down when the policy attached to them becomes too broad, too static, or too manually maintained. The article describes allow-rules accumulating until the design resembles Swiss cheese, which means the intended isolation is weakened by exceptions, misconfiguration, and operational drift. Because VLANs are coarse-grained, they can leave east-west paths open inside a Layer 3 environment even when administrators believe the network is segmented. This is why compromise of one internal endpoint can still lead to reachability of another system in the same trust zone. The control failure is not the VLAN itself, but the assumption that VLAN membership equals meaningful containment.

Practical implication: review inter-VLAN rules as attack paths, not just as network plumbing, and remove implicit trust between internal segments.

Microsegmentation and identity-aware enforcement

Microsegmentation narrows trust much further by assigning unique policy boundaries to workloads, applications, virtual machines, or devices rather than to broad network groups. The article contrasts this with legacy segmentation approaches because modern control depends on who or what is communicating, not just where the packet came from. Identity-aware access controls make this more precise by binding policy to workload or device identity and continuously enforcing least privilege. That is why microsegmentation aligns more closely with Zero Trust than VLANs do: it reduces blast radius at the communication layer instead of relying on static network placement alone.

Practical implication: move critical east-west controls to identity-aware policy so containment survives subnet changes, hybrid drift, and internal compromise.

Threat narrative

Attacker objective: The attacker’s objective is to move laterally inside the network and reach additional internal systems without being stopped by broad VLAN boundaries.

1. Entry occurs when an attacker compromises a device inside an environment that relies on VLANs for internal separation.
2. Credential or access abuse then lets the attacker operate within the same trust zone because VLAN boundaries do not inherently enforce granular authorization.
3. Escalation follows through lateral movement across overly permissive internal paths, expanding reach from one endpoint to adjacent systems.
4. Impact is wider internal spread of the attack because the network design offered organisation but not true containment.

Breaches seen in the wild

• HPE Aruba Instant On hard-coded credentials: Hard-coded admin credentials in HPE Aruba Instant On access point firmware let anyone bypass login (CVE-2025-37103); no exploitation reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

VLAN sprawl creates a segmentation illusion: the operating risk is not merely weak configuration, but a governance model that mistakes network grouping for access control. VLANs can organise traffic, yet they do not express device trust, workload identity, or least privilege. Practitioners should treat broad internal network boundaries as an interim design, not a containment model.

Identity-aware segmentation is the real control gap: once east-west traffic matters, policy must follow the communicating workload or device rather than the subnet label. That is where identity, NHI governance, and network control intersect. A segmented network that cannot bind traffic rules to identity still leaves internal trust too broad for modern attack paths.

False containment increases blast radius: when teams believe VLANs provide isolation, they often delay stronger controls until after drift or misuse appears. The article’s core lesson is that containment has to be engineered at the enforcement point, not inferred from topology. Practitioners should prioritise policies that continue to work when the network changes.

Network topology is not a security boundary: the useful distinction here is between structural separation and enforceable authorization. VLANs deliver the first, but modern security programmes need the second if they want to stop lateral movement and internal spread. Practitioners should assume that every broad internal boundary requires compensating control.

Microsegmentation closes the gap that VLANs expose: the article’s architecture discussion points toward a stronger model where policy is granular, dynamic, and aligned to the asset being accessed. That does not eliminate the value of VLANs, but it does relegate them to an enabling layer. The practitioner conclusion is clear: use VLANs for organisation, not as the final security claim.

What this signals

VLAN-based security often creates governance debt: the more teams rely on broad internal network labels, the harder it becomes to prove what is actually protected and why. That is a control-design problem, not just a configuration problem, and it becomes more acute as hybrid estates and east-west traffic increase.

Identity-aware enforcement is the durable answer: when internal reachability matters, segmentation has to follow the asset and the trust decision, not the subnet. That is why network teams and identity teams need a shared model for policy ownership, especially where workloads move faster than network design cycles.

VLANs are useful scaffolding, not final segmentation: the right programme view is to keep them for organisation while shifting real containment to finer-grained controls. Practitioners should expect segmentation maturity to be measured by how well the environment resists lateral movement, not by how tidy the VLAN map looks.

For practitioners

• Audit internal trust zones for implicit access Map where VLAN boundaries are being treated as access controls and identify paths that still allow east-west movement between internal systems.
• Remove broad inter-VLAN allow rules Review firewall and router rules between VLANs, then eliminate exceptions that create persistent lateral movement paths or undocumented reachability.
• Introduce identity-aware segmentation for critical workloads Bind traffic policy to workload or device identity so segmentation continues to work when subnets, cloud locations, or host placement change.
• Prioritise microsegmentation where blast radius is highest Start with sensitive applications and high-value internal services where a compromised endpoint would otherwise have broad reach.

Key takeaways

• VLANs improve internal organisation, but they do not by themselves provide trustworthy containment against lateral movement.
• The central risk is a false sense of segmentation when broad network labels are treated as a substitute for enforced access policy.
• Teams that need stronger control should pair VLANs with microsegmentation or identity-aware enforcement for critical assets.

Key terms

• VLAN: A virtual local area network is a logical grouping of devices that share the same Layer 2 broadcast domain even when they sit on the same physical switch fabric. It improves traffic organisation, but it does not by itself provide fine-grained access control between devices or guarantee containment after compromise.
• Inter-VLAN Routing: Inter-VLAN routing is the Layer 3 function that allows traffic to move between VLANs through a router or Layer 3 switch. It is operationally necessary in many networks, but it also creates the policy chokepoint where weak rules or excessive exceptions can undermine the intended isolation between segments.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.