# How do we limit what a compromised laptop can reach?

Assume one laptop will be compromised and decide in advance how little it should be able to touch. Ordinary laptops rarely need to talk to each other, so block laptop-to-laptop traffic with the client firewall or switch settings; let them reach servers only on the ports their applications use; keep backups, management interfaces and the domain controller's admin paths out of their reach; and make sure the user is not a local administrator, so that malware cannot easily switch off protection or harvest other accounts' passwords. On the VPN, give each group access only to what it needs. Then check the result with real traffic, because a rule set on paper often has gaps. NetSenX shows which hosts talk to which on monitored segments and flags new host-to-host sessions that do not match a laptop's normal as lateral movement, along with scanning and beaconing, on every plan, so you see where a compromised laptop could still reach.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/how-to-limit-what-a-compromised-laptop-can-reach

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Should our servers be allowed to connect to any address on the internet?](https://netsenx.com/en/faq/should-servers-be-allowed-to-browse-the-internet)
- [How do we write segmentation rules without breaking things?](https://netsenx.com/en/faq/how-to-build-allow-rules-from-real-traffic)
- [Is a DMZ still useful for a small company?](https://netsenx.com/en/faq/is-a-dmz-still-useful)
- [Can we segment a small office network without buying new hardware?](https://netsenx.com/en/faq/how-to-segment-a-small-office-without-new-hardware)
- [How do we protect our domain controller or directory server?](https://netsenx.com/en/faq/how-to-protect-the-domain-controller)