# How do we check that network segmentation actually works?

Test it from both sides, then watch real traffic. From a host that should not get in, try to reach the protected segment with a simple connection test, and from inside the protected segment, check what it can reach outwards. Review the firewall rules between segments for broad allow rules, old exceptions and rules nobody can explain. Then watch, because rules drift: every change ticket, new application and supplier visit can add an exception, and the connections that actually cross a boundary are the real proof. Repeat the test after network changes and at least once a year. NetSenX shows host-to-host communication on monitored segments on its network map and flags new sessions that do not match a host's normal as lateral movement, on every plan, so an unexpected path between segments is visible the first time it is used. A path that exists but is never used is invisible to any passive sensor.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/how-to-check-that-network-segmentation-works

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What does "assume breach" mean in practice?](https://netsenx.com/en/faq/what-does-assume-breach-mean)
- [Can network access control (NAC) replace network monitoring?](https://netsenx.com/en/faq/can-network-access-control-replace-monitoring)
- [Does a VPN contradict zero trust?](https://netsenx.com/en/faq/does-a-vpn-contradict-zero-trust)
- [What is zero-trust network access (ZTNA)?](https://netsenx.com/en/faq/what-is-zero-trust-network-access-ztna)
- [Is a firewall still needed if we have zero trust or SASE?](https://netsenx.com/en/faq/is-a-firewall-still-needed-with-zero-trust-or-sase)