Network segmentation for Indian SMEs: flat networks, VLANs, firewall rules and the 77 ransomware attacks that make lateral movement costlier.
Network segmentation separates systems so that a compromise of one does not become a compromise of all. India recorded 77 ransomware attacks between January and June 2026 (Cyble CRIL, reported by Fortune India, 23 July 2026), and the ransomware model still begins with one endpoint, a stolen credential and lateral movement across a flat network. For a small business the practical version is three segments, enforced in the cloud firewall and on the endpoints rather than by new hardware: staff devices, servers, and finance or customer data systems.
Because initial access is cheap and the damage is decided later. The initial access is often a phished credential, an unpatched internet-facing service, or a supplier with access, and none of those is dramatic. What turns an inconvenience into a business-ending event is the ability of that foothold to reach the finance systems, the file server and the backup repository in a single authenticated session. A flat network gives that session everything. A segmented network forces the attacker to either escalate, which leaves traces, or move through a control point that logs. In March 2026 an Ernakulam hospital lost over 800GB of patient data, and in the same month a Kochi hospital was listed by the same ransomware group, which is the pattern of operators exploiting exactly this reach.
Three logical zones, enforced with software. Zone one, staff and guest devices on the office Wi-Fi and on any personal hotspot, which by policy reach the internet and nothing else. Zone two, servers and infrastructure, reachable only from specific administrative ports and from a jump host, not from a user's laptop directly. Zone three, crown-jewel systems, meaning the finance application, the file share with contracts and customer data, and the backup platform, reachable only from the servers in zone two and from a named administrator. Most Indian SMEs can build this in the cloud firewall, on the Wi-Fi controller and in the endpoint agent, for a fraction of the cost of a new network refresh, and the design work itself is what needs a specialist.
Test it from the position the attacker reaches first, which is a compromised workstation, not from the internet. Attempt to reach the file server, the finance application, the backup console and the domain controller from a staff laptop, and attempt to reach the internet in a way that reveals exfiltration. Most Indian engagements find that a staff laptop can reach the backup console and, through it, the entire backup history, which converts ransomware from an incident into an extinction event. A segmentation test is a fixed-price exercise at AAVETech at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a retest after your changes, and the output is the exact rule set to apply.
In a larger enterprise the same principle is expressed as micro-segmentation with zero-trust policy on flows rather than on locations, and it is usually delivered through the data centre firewall, the cloud firewall and the endpoint agent working together. The pattern worth copying is the compliance matrix: Indian cyber insurance underwriters and CERT-In-driven audits increasingly ask how many segments exist, what sits in each, and what rule permits traffic between them. A written segmentation map with the allowed flows is what turns a design into evidence, and it is what an auditor and an insurer will both ask for.
| Segment | Contains | Permitted inbound |
|---|---|---|
| Staff and guest | Laptops, phones, personal hotspots | Internet only |
| Servers | Application and file servers, jump host | Admin ports from servers zone only |
| Crown jewels | Finance, contracts, backup console | Named admins and servers zone only |
Network segmentation separates systems so that a compromise of one does not become a compromise of all. India recorded 77 ransomware attacks between January and June 2026 (Cyble CRIL, reported by Fortune India, 23 July 2026), and the ransomware model still begins with one endpoint, a stolen credential and lateral movement across a flat network. For a small business the practical version is three segments, enforced in the cloud firewall and on the endpoints rather than by new hardware: staff devices, servers, and finance or customer data systems.
Almost certainly not. Segmentation is a policy applied by the cloud firewall, the Wi-Fi controller and the endpoint agent, and it can be implemented on the hardware a small business already owns. A physical refresh is a hardware decision; segmentation is a design decision.
The backup console and backup repository. In most Indian networks a staff laptop can reach the backup server, which means an attacker who gets one workstation can delete the entire recovery history and convert a recoverable incident into an existential one.
From a staff laptop, try to reach the file server, the finance application, the backup console and the domain controller, and try to reach a file-sharing service on the internet. If any of those succeed from a user device, the network is flat in practice regardless of what the diagram says.
At AAVETech a fixed-price network penetration test and segmentation review runs at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround, a retest included, and a written rule set your administrator can apply.
It works if the segmentation is defined by device role and identity rather than by network location, which means the enforcement belongs in the cloud firewall and the endpoint agent. A personal phone on a home hotspot should land in the same segment as an office laptop, and both should be unable to reach the crown jewels.
Read the full guide on AAVETech: Does Network Segmentation Actually Matter for a Small Business?.
Send us your current network diagram and firewall rule export, and we will return a fixed-price segmentation design and test scope.
Talk to an analyst about this.