# Is a DMZ still useful for a small company?

Yes, whenever you host something that the internet or another untrusted network must reach. A demilitarised zone (DMZ) is a separate network segment between the outside and your internal network, where you put systems that must accept outside connections, such as a web server, a mail relay, a remote-access gateway or a file-transfer server. If one of them is compromised, the attacker is in the DMZ, and firewall rules stop them from opening connections into the internal network. The same idea separates office and production networks in factories. Many small companies no longer host public services themselves, and then the DMZ is small or unnecessary; but the moment you forward a port to an internal server, you have a DMZ problem without the DMZ. Keep DMZ hosts patched and minimal, and allow only the specific inward connections they need. On a monitored segment, NetSenX flags lateral movement and scanning from a DMZ host towards internal hosts, on every plan.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/is-a-dmz-still-useful

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Can we segment a small office network without buying new hardware?](https://netsenx.com/en/faq/how-to-segment-a-small-office-without-new-hardware)
- [How do we protect our domain controller or directory server?](https://netsenx.com/en/faq/how-to-protect-the-domain-controller)
- [Does zero trust mean monitoring employees?](https://netsenx.com/en/faq/does-zero-trust-mean-monitoring-employees)
- [Is zero trust realistic for a small business?](https://netsenx.com/en/faq/is-zero-trust-realistic-for-a-small-business)
- [How do we check that network segmentation actually works?](https://netsenx.com/en/faq/how-to-check-that-network-segmentation-works)