# Can we segment a small office network without buying new hardware?

Often, yes, at least in part. Check what you already have: many business routers and firewalls support VLANs and rules between them, many managed switches do too, and most Wi-Fi systems can run a separate guest network with client isolation. If your switches are unmanaged, start with what does not need them: a guest Wi-Fi with isolation for visitors and personal devices, the host firewall on every PC and server set to allow only what is needed, laptop-to-laptop traffic blocked, and file shares limited to the groups that use them. Replace unmanaged switches gradually, starting where servers and backups sit. Write down what you separated and why, so that the next person does not undo it. Then check that it works with real traffic. NetSenX shows which hosts talk to which on monitored segments, on every plan; one agent on a SPAN or TAP port, which needs a switch that can mirror or a TAP, counts as one device for that segment.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/how-to-segment-a-small-office-without-new-hardware

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [How do we protect our domain controller or directory server?](https://netsenx.com/en/faq/how-to-protect-the-domain-controller)
- [Does zero trust mean monitoring employees?](https://netsenx.com/en/faq/does-zero-trust-mean-monitoring-employees)
- [Is zero trust realistic for a small business?](https://netsenx.com/en/faq/is-zero-trust-realistic-for-a-small-business)
- [How do we check that network segmentation actually works?](https://netsenx.com/en/faq/how-to-check-that-network-segmentation-works)
- [What does "assume breach" mean in practice?](https://netsenx.com/en/faq/what-does-assume-breach-mean)