A hub-and-spoke network is a design where one central hub connects multiple branch sites or systems that do not communicate directly. In network and security terms, the hub routes traffic, policy, or management between spokes, creating a controlled path that can simplify oversight, segmentation, and access control.
How Hub-and-Spoke Networks Work
A hub-and-spoke network places a central routing point between multiple branch networks, systems, or sites that are intentionally kept from talking directly. That design creates a single transit path for traffic, policy enforcement, and oversight, which makes the topology easier to reason about than fully meshed connectivity.
The model is common in enterprise networking, cloud networking, and managed service environments because it concentrates control in one place. Instead of every spoke building a direct trust relationship with every other spoke, the hub becomes the controlled intermediary for reaching shared services, security inspection points, or egress paths.
That centralization is useful, but it also means the design depends heavily on the hub’s availability, policy correctness, and capacity. If the hub is misconfigured or overloaded, the network can become fragmented, overly permissive, or difficult to recover.
Security Value and Segmentation
The main security value of a hub-and-spoke design is that it can reduce lateral movement and limit unnecessary connectivity. When spokes do not directly peer with one another, the architecture makes it easier to place inspection, logging, and access controls at the hub before traffic reaches other environments.
This structure is often used to support segmentation, centralized firewalling, shared services, and controlled egress. In practice, the hub can become the policy enforcement layer for routing decisions, network ACLs, private endpoints, and transit controls. For cloud-specific design patterns, Cloud Network Security Guide covers the related VPC, endpoint, and egress-control patterns in more depth.
Because the hub sits on the critical path, its security posture influences every spoke attached to it. A weak hub can turn a segmented design into a broad trust corridor, while a well-governed hub can simplify enforcement across many distributed sites or workloads.
Common Failure Modes
Hub-and-spoke networks fail when the central point becomes too trusted, too crowded, or too complex to govern. The most common issues are misrouted traffic, overly broad route advertisement, accidental exposure between spokes, and bottlenecks caused by all traffic transiting the same control plane or shared device.
A second failure mode is hidden dependency. Teams may assume that spoke isolation exists because the topology is simple, but the actual security outcome depends on route tables, firewall rules, endpoint policies, and the strength of the hub itself. If any of those controls drift, the design can quietly lose its intended boundaries.
Centralization also creates a recovery problem. If the hub fails, loses connectivity, or is changed incorrectly, multiple branches can lose access at once. That makes testing, redundancy, and change control especially important in hub-centered architectures.
Where It Is Used
This topology is widely used in WAN design, branch connectivity, cloud landing zones, and hybrid networks where central oversight is preferred over peer-to-peer complexity. It is especially attractive when organisations want consistent security controls, shared inspection, and predictable routing for many distributed locations.
In cloud environments, the hub often connects private subnets, inspection appliances, shared services, and egress gateways. In traditional enterprise environments, it may be a data center core, SD-WAN hub, or regional transit layer that aggregates branches and enforces a common policy baseline.
Because the design is architecture-first rather than product-specific, it can be implemented in many ways. The security outcome depends less on the label “hub-and-spoke” than on how strictly the hub governs trust, segmentation, and traffic handling across the spokes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Hub-and-spoke networks concentrate traffic control at boundaries and transit points. |
| AC-4 — Information Flow Enforcement | The topology exists to govern which spokes may exchange traffic through a central path. | |
| Recommendation — Enforce boundary filtering and controlled inter-zone routing at the hub. Define and enforce allowed information flows between spokes through the hub. | ||
| NIST CSF 2.0 | PR.AA-05 — Network Integrity and Segmentation | Hub-and-spoke is a segmentation pattern that limits lateral connectivity and centralizes path control. |
| Recommendation — Use segmentation controls to keep spoke traffic constrained to approved hub-mediated paths. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | The design relies on managed routing, firewalling, and network-device governance at the hub. |
| Recommendation — Maintain central network infrastructure rules and review hub routing and filtering regularly. | ||
Practitioner Guidance
Why practitioners should care: Hub-and-spoke is not just a routing pattern, it is a trust-design choice. The hub becomes the place where isolation can be preserved or accidentally erased, so ownership of routes, policies, and shared services needs to be explicit.
What to watch for: Watch for direct spoke-to-spoke paths, permissive transit rules, and unmanaged exceptions that bypass the hub. Those shortcuts usually indicate that the topology is drifting away from its intended control model.
Practitioner takeaway: Treat the hub as a security boundary, not merely a transport node, and validate that every spoke-to-spoke communication path is intentional.
Related resources from NHI Mgmt Group
- What is the difference between a hub-and-spoke VPN and a mesh network for internal access control?
- How do organisations decide between a centralised model and a hub and spoke model for data governance?
- What breaks when remote teams rely on a traditional hub and spoke VPN model?
- What is the difference between hub-and-spoke federation and app-centric trust?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org