A ransomware incident does not need to reach every machine to stop production. If an attacker gains access through a compromised office account, a shared warehouse device or an unpatched engineering workstation, the design of the network determines how far that incident can travel. That is the practical difference when considering segmented networks versus flat networks in a manufacturing environment.
For many businesses, the network has grown alongside the factory. New PCs, printers, ERP terminals, Wi-Fi access points, scanners and machine connections have been added when needed. The result can be a flat network where almost every connected device can communicate with every other device. It may appear simple to manage, but it gives faults, malware and unauthorised users far more room to move.
A segmented network puts deliberate boundaries between systems with different risks and operational roles. Done properly, it protects production continuity without making day-to-day work harder for your teams.
What is a flat network?
A flat network is a single, broadly accessible network environment. Office PCs, production devices, servers, guest Wi-Fi, printers and sometimes older machine controllers may all sit on the same network range with few restrictions on communication between them.
This arrangement is common in smaller manufacturers because it is quick to set up and straightforward when everything needs to connect. An engineer can access a machine, an office user can print to a shop-floor printer, and a new device may work with minimal configuration. The problem is that convenience is often based on implicit trust: if a device is connected, it can potentially see and reach a wide range of other systems.
That creates several operational risks. A virus introduced through an email attachment can spread to file shares and production-adjacent systems. A compromised password can provide a route to critical servers. An outdated controller that cannot be patched may be exposed to devices that have no business communicating with it. Troubleshooting is also harder because traffic from every area of the business shares the same space.
Flat networks are not automatically careless. In a very small, low-risk environment with few devices and no connected machinery, they can be workable for a period. But as soon as ERP, MRP, remote access, industrial equipment and multiple user groups are involved, the risk and recovery cost rise sharply.
What is a segmented network?
Network segmentation divides the network into separate zones. Each zone has a defined purpose, and rules control what traffic can pass between zones. These boundaries may be created using VLANs, firewalls, access control lists and separate Wi-Fi networks. The technology matters, but the operating model matters more: access should be allowed because there is a clear business need, not simply because it is technically possible.
A manufacturer might separate office users, servers, production systems, engineering devices, guest Wi-Fi, voice services and management tools. A device on the guest network should not be able to discover an ERP server. An office laptop should not have unrestricted access to a CNC machine or legacy controller. An external specialist needing machine access should connect through a controlled route, rather than directly into the wider production network.
Segmentation is not about isolating every device from everything else. Production relies on communication between systems. It is about identifying essential data flows, permitting them securely and blocking the rest.
A practical manufacturing example
Consider a business where office staff access an ERP system, warehouse teams use handheld scanners, engineers use programming laptops, and several older machines run unsupported operating systems. On a flat network, each of these assets could provide an entry point into the others.
With segmentation, the ERP server can sit in a protected server zone. Office users can access the required application ports, while production devices receive only the connections needed for data collection or job status updates. Older machinery can be placed in a restricted operational technology zone, with access limited to authorised engineering devices. If remote support is necessary, it can be routed through a jump machine with monitored, controlled sessions.
If one user device is compromised, the attacker faces boundaries rather than an open route across the organisation. That does not remove the need for endpoint protection, backups or user awareness training. It reduces the blast radius when another control fails.
Segmented networks versus flat networks: the business impact
The clearest comparison is not technical complexity. It is how each model affects downtime, cyber exposure and the ability to make controlled changes.
A flat network is easier to deploy initially. There are fewer rules to define, fewer connections to test and less planning required. That simplicity can be attractive when production deadlines are pressing. However, it can become expensive in operational terms when a network incident affects systems that were never meant to be connected so openly.
Segmented networks require design work. Someone needs to understand which systems communicate, who owns them, which applications are business-critical and what happens if a connection is blocked. Older equipment may have undocumented dependencies, and vendor support arrangements can complicate changes. This is why segmentation should be planned around production processes, not imposed as a generic IT exercise.
Once established, segmentation gives IT teams more control. They can apply tighter security to sensitive areas, investigate unusual traffic more easily and make changes with less risk of disrupting unrelated systems. It also supports clearer accountability when third-party machine suppliers, software providers and internal teams all have a role in keeping systems running.
Where segmentation delivers the greatest value
Protecting legacy machinery
Unsupported operating systems and older industrial controllers often cannot be treated like modern office PCs. They may not support current security software, regular patching may be impractical, and a poorly timed update can affect a production process.
Segmentation provides a compensating control. By restricting which devices can communicate with legacy equipment, you reduce exposure without interfering with the machine itself. The goal is not to pretend old technology is risk-free. It is to contain that risk while creating a realistic lifecycle plan.
Limiting ransomware spread
Ransomware commonly relies on lateral movement: moving from the first compromised device to other systems, accounts and data stores. A flat network makes that movement easier to attempt and more difficult to spot.
Network boundaries slow an attacker down. Firewall rules, separated credentials, restricted administration paths and protected backup environments can prevent one incident from becoming a factory-wide outage. Recovery is still needed, but the scope may be limited to a user group or individual zone instead of every connected system.
Supporting compliance and customer assurance
Many manufacturers are working towards Cyber Essentials, ISO-aligned controls or more formal customer security requirements. Segmentation is not a certificate by itself, but it demonstrates that access to sensitive systems is considered, controlled and reviewed.
It also supports better evidence. Defined network zones, documented rules and access logs make it easier to show how critical data and production systems are protected. For businesses handling customer designs, controlled technical information or commercially sensitive production data, that matters as much as the firewall configuration itself.
How to move from flat to segmented without disrupting production
The safest approach is phased. Attempting to redesign every connection in one weekend creates unnecessary operational risk, particularly where machine interfaces and ERP integrations are involved.
Start by mapping the environment. Identify devices, network connections, operating systems, application dependencies, suppliers with remote access and the systems that would stop production if unavailable. This discovery work often reveals unmanaged switches, forgotten Wi-Fi networks, shared administrator accounts or devices that nobody realised were internet-facing.
Next, agree sensible zones based on how the business works. A typical design separates office IT, servers, production technology, engineering access, guest devices and network management. The exact structure depends on the site, machinery and data flows. A single-site engineering firm does not need the same design as a multi-location manufacturer with centralised applications.
Then test the required connections before enforcing restrictions. Monitoring traffic can show what is genuinely needed between zones and what is merely background noise. Rules should be introduced in stages, with production owners involved in testing. If a machine supplier needs remote access, provide a controlled route with named accounts, multi-factor authentication and approval rather than leaving a permanent open connection.
Finally, treat segmentation as an ongoing control. New devices, software changes and supplier visits can create new requirements. Documentation, reviews and change control keep the design useful rather than allowing it to drift back into a flat network over time.
Common mistakes to avoid
The first mistake is assuming VLANs alone equal security. VLANs create separation, but meaningful protection depends on controls between them. Without firewall rules and properly managed access, the boundary may provide little real protection.
The second is isolating systems without consulting the people who run them. Production managers, engineers and machine suppliers understand operational dependencies that may not appear in an asset list. Their input prevents security changes from causing avoidable stoppages.
The third is treating remote access as an exception. Third-party support is often necessary, especially for specialised machinery. It should be designed into the security model through a jump machine or controlled remote-access process, with access granted only when required.
For manufacturers across Hampshire, West Sussex and Surrey, Syn-Star approaches network segregation as part of continuity planning: protect critical systems, maintain legitimate production access and make recovery from an incident more manageable.
A well-segmented network will not stop every cyber attack or equipment fault. It gives your business more time, more visibility and more control when something does go wrong. That is a far better position than discovering that a single compromised laptop has an unimpeded path to the systems keeping your factory running.
