Why is a flat network dangerous?
Because nothing stops an attacker who gets in from reaching everything. In a flat network every computer, printer and server sits in the same segment and can connect to every other, so one infected laptop can reach the file server, the backup server, the accounting system and the production machines directly. Segmentation splits the network into zones, such as workstations, servers, backups, guests, printers and cameras, and production, with firewall rules that allow only the connections each zone needs. It does not have to be perfect to help: separating backups and the most important servers from ordinary workstations already blocks the most damaging paths. Flat networks also make detection harder, because everything talks to everything. The NetSenX network map, on every plan, shows who actually talks to whom, which is a good starting point for drawing your zones.