* [Topics](/en/topics "Topics")
* [Virtualization](/en/topics/virtualization "Virtualization")
* What is microsegmentation?
What is microsegmentation?
==========================
Published  April 28, 2026•*6*-minute read
Copy URL
Jump to section
---------------
OverviewHow it worksBenefitsMicrosegmentation and virtualizationCommon use casesChallenges and best practicesWhy Red Hat?
Overview
--------
Microsegmentation is a software-defined security technique that divides a datacenter and application environment into small segments to protect individual workloads, such as a single application on a [virtual machine](/en/topics/virtualization/what-is-a-virtual-machine) (VM) or in a [container](/en/topics/containers). In traditional network segmentation, security is often concentrated where the internal network meets the internet. Microsegmentation shifts that focus inward, applying granular security policies to the traffic moving inside the network.  
Through isolation, microsegmentation helps stop attackers from moving between systems if they get past the initial point of entry. This approach is a core component of [zero trust](/en/topics/security/what-is-zero-trust) security, which operates on the principle that communication within the datacenter should be untrusted by default. Instead, every request must be verified based on strict, automated policies.
[VMware admins: Explore Red Hat OpenShift](https://docs.redhat.com/en/learn/learning-paths/high-level-guide-red-hat-openshift-virtualization-vmware-admin/understanding-red-hat-openshift-networking-options-vmware-admin)
How microsegmentation works
---------------------------
Microsegmentation improves network security by protecting individual workloads rather than relying on 1 central point. In a modern datacenter—where a workload can be a VM, a container, or serverless—this approach complements your existing perimeter defenses. It ensures that even if the main network barrier is cleared, every internal component is still protected by its own specific, software-defined boundary.
### Traditional network segmentation vs. microsegmentation
Traditionally, networks were segmented using hardware-based tools like firewalls and virtual local area networks (VLANs). This approach focuses on “north-south” security: traffic entering or leaving the datacenter through a main gateway.
The problem with this model is that it treats everything inside a specific segment as “trusted.” If an application and a database are on the same VLAN, they can usually talk to each other without restriction. If one is compromised, the other is at risk because the security at the network’s entry point has already been cleared.
Microsegmentation addresses “east-west” traffic, which is the communication that happens internally between servers and applications. By applying security policies at the individual workload level, enforcement is independent of the underlying physical network layout or VLAN a server sits on. Instead, software defines security based on the identity of the workload itself.
### The mechanics
Microsegmentation uses 3 core principles to secure a network:
* **Isolation:** Workloads are kept separate unless a rule lets them communicate, contributing to a sovereign digital environment. For example, a development environment can be isolated from a production environment, even if they run on the same physical hardware.
* **Granular control:** Security teams can write very specific rules. For example, instead of saying, “Server A can talk to Server B,” a rule might say, “The web server can talk to the database only via a specific port and only for specific types of data.”
* **Principle of least privilege:**This means giving a workload only the minimum access it needs to do its job. If a service doesn’t need to connect to other systems, microsegmentation ensures it can’t.
### Software-based and policy-driven implementation
Because modern infrastructure is always shifting, you can’t secure it using manual hardware settings. VMs and containers spin up and down too fast for manual work.
Microsegmentation is software based and policy driven. Security policies exist as code. When a new VM or container starts, the system recognizes it and applies the relevant security tags and rules automatically. The security moves with the workload, no matter what physical server or cloud it uses.
[Learn more about software-defined networking](/en/topics/hyperconverged-infrastructure/what-is-software-defined-networking)
Red Hat OpenShift Virtualization learning hub
---------------------------------------------
[Keep reading](/en/technologies/cloud-computing/openshift/virtualization/learn "Keep reading")
Benefits of microsegmentation
-----------------------------
Microsegmentation offers a level of control and visibility that’s difficult, if not impossible, to achieve with traditional hardware-based networking. Here are microsegmentation’s primary benefits for modern IT environments:
### Stronger security and limited lateral movement
The most significant benefit of microsegmentation is containing breaches. In a flat network, an attacker that gains access to 1 low-priority system can often move freely to high-value targets, such as databases containing customer information.
By creating “segments of 1,” microsegmentation ensures that even if a single workload is compromised, the threat is isolated. The attacker is essentially trapped in a digital “room” with no door to the rest of the house.
### Improved compliance and auditability
For industries governed by strict regulations, like healthcare or finance, microsegmentation simplifies the compliance process. It allows organizations to isolate systems that handle sensitive data from the rest of the network.
Because security policies are defined by software, auditors can easily see exactly which users are allowed to access which systems. This level of granular reporting makes it much simpler to prove that sensitive information is protected according to regulatory standards.
### Greater visibility and control over network traffic
You can’t protect what you can’t see. Microsegmentation tools provide deep visibility into “east-west” traffic patterns. Security teams can see exactly how different applications and services interact in real time. This visibility helps identify unusual behavior that might indicate a security threat or performance bottleneck.
### Adaptability to modern IT environments
Traditional security rules are often tied to physical locations, like an IP address or a specific hardware port. In a cloud-native world, those locations change constantly as containers spin up and down.
Microsegmentation is environment neutral. Because the security policy is attached to the workload—not the network hardware—the protection remains consistent whether the workload is running in an on-premise datacenter, a private cloud, or a public cloud environment.
### Simplified management through automation
In a modern, microsegmented environment, security policies are automated. When a new application is deployed, it can automatically inherit the security policies it needs based on its role. This reduces the need for manual configuration by human administrators, which reduces the risk of human error.
[Learn to configure network access with microsegmentation](https://developers.redhat.com/learn/openshift/physical-network-access-micro-segmentation)
Microsegmentation and virtualization
------------------------------------
For years, virtualization was the main source of datacenter efficiency, allowing multiple VMs to run on a single physical server. However, the move to virtualized environments created new vulnerabilities. Traditional hardware firewalls often can’t see the traffic moving between 2 VMs sitting on the same physical host.
Without this internal visibility, security teams can’t always identify or block malicious lateral movement. And as organizations move toward cloud-native architectures and use both VMs and containers, this challenge grows.
### The limits of traditional segmentation in virtualized environments
Traditional segmentation relies on routing traffic out of the virtual host, through a physical firewall, and back into the virtual host to inspect it. This process creates massive performance bottlenecks and latency. It’s an inefficient way to secure a scalable environment. And in a dynamic virtualized environment, IP addresses and locations change frequently. Hardware-based rules are too rigid to keep up with VMs that constantly migrate or scale.
### How microsegmentation supports scalable infrastructure
Microsegmentation solves these inefficiencies by decoupling security from the underlying physical hardware. Instead of forcing traffic to a central firewall, the security policy lives at the virtual network interface of each VM or container.
This allows for:
* **Performance at scale:** Because security checks happen locally within the virtualized layer, there’s no need to send internal traffic on a long loop to external devices.
* **Consistency across environments:** Whether a workload is a traditional VM or a modern container, microsegmentation provides a single way to manage security policies across the entire stack.
* **Mobility:** When a VM moves from 1 physical host to another, its security perimeter moves with it automatically.
By integrating security directly into the virtualization layer, microsegmentation lets you scale your infrastructure rapidly without exposing internal systems.
Common use cases
----------------
Microsegmentation is most effective when applied to specific organizational goals. Common scenarios include:
* **Securing hybrid cloud environments:** Protects applications that span on-premise datacenters and multiple cloud providers with 1 consistent security policy.
* **Regulatory compliance:** Isolates systems that handle sensitive financial or healthcare data (like credit card numbers or patient records) to meet strict audit requirements without having to wall off an entire network.
* **Protecting development and production:** Ensures that a bug or a security gap in a testing environment can’t leak into the live production environment where customer data lives.
Challenges and best practices
-----------------------------
While microsegmentation offers superior security, moving from a traditional network model to a microsegmented one requires careful planning.
### Common challenges
* **Initial complexity:** In a large organization, thousands of connections are happening at any given moment. Mapping these connections to understand what should talk to what can be daunting.
* **Policy management:** As you create more segments, you create more policies. Without the right tools, managing thousands of individual security rules can be hard for human administrators.
* **Integration with existing tools:**Microsegmentation must work alongside your existing security stack and infrastructure without causing performance issues or hidden risks.
### Best practices for success
To overcome common microsegmentation challenges and ensure a smooth rollout, consider these industry best practices:
* **Start small:** Don’t try to microsegment your entire datacenter overnight. Start with a well-defined application or a particular environment. Use these early projects to refine your policy-writing process.
* **Prioritize high-value assets:** Focus your initial efforts on applications that handle sensitive customer data or are critical to business operations.
* **Automate where possible:**Manual rulemaking is the enemy of scale. Use tools that can automatically discover traffic patterns and suggest security policies. Automation ensures that as your environment grows, your security grows with it.
* **Implement continuous monitoring:** You should constantly monitor your network traffic to identify new communication patterns and adjust your policies as your applications evolve.
Why Red Hat?
------------
Red Hat’s modern, modular approach to microsegmentation avoids the complexity and shelfware often associated with bloated, proprietary subscriptions. With [Red Hat® OpenShift® Virtualization](/en/technologies/cloud-computing/openshift/virtualization), you can manage VMs and containers on a single platform with consistent security policies. This lets you scale your infrastructure without being locked in to paying for capabilities you don’t need.   
Built on open source standards, [Red Hat OpenShift](/en/technologies/cloud-computing/openshift) is a modern application platform that supports a zero trust architecture by letting you enforce granular network policies at the workload level. This means every VM and container is isolated by default, protecting against internal threats.
With Red Hat, you gain a flexible, future-ready security solution that integrates easily with your existing environment—without the overhead of a traditional, vendor-locked suite.
[Learn how to migrate VMs from VMware to Red Hat](/en/technologies/cloud-computing/openshift/migrate-vmware-to-openshift-virtualization)
Product
Red Hat OpenShift Virtualization
--------------------------------
A feature of Red Hat OpenShift that seamlessly integrates virtual machines into a modern hybrid cloud infrastructure platform.
[Learn more about this product](/en/technologies/cloud-computing/openshift/virtualization "Red Hat OpenShift Virtualization")
Training and certification for Red Hat OpenShift Virtualization
---------------------------------------------------------------
Explore courses from Red Hat Training and Certification to learn how to migrate, deploy, and manage virtual machines with Red Hat OpenShift® Virtualization.
[Keep reading](/en/technologies/cloud-computing/openshift/virtualization/training-and-certification "Training and certification for Red Hat OpenShift Virtualization")
Keep reading
------------
### How to create a virtual machine with an instance type
Find out how to create a virtual machine with an instance type in Red Hat OpenShift Virtualization using the Red Hat OpenShift console graphical user interface.
[Read the article](/en/topics/virtualization/how-create-virtual-machine-instance-type "How to create a virtual machine with an instance type")
### What is a virtual machine (VM)?
A virtual machine (VM) is an isolated computing environment created from a pool of hardware resources.
[Read the article](/en/topics/virtualization/what-is-a-virtual-machine "article | what is a virtual machine (VM)?")
### What is virtualization?
Virtualization is a technology that allows you to create virtual, simulated environments from a single, physical machine.
[Read the article](/en/topics/virtualization/what-is-virtualization "article | what is virtualization?")
Virtualization resources
------------------------
### Related content
* Blog post
  [Context-aware advisor recommendations in Red Hat Lightspeed](/en/blog/context-aware-advisor-recommendations-red-hat-lightspeed)
* Blog post
  [Building the levee: Why Red Hat’s post-quantum strategy is already in production](/en/blog/building-levee-why-red-hats-post-quantum-strategy-already-production)
* Blog post
  [Building trust through AI red teaming: Red Hat's approach to testing model safety](/en/blog/building-trust-through-ai-red-teaming-red-hats-approach-testing-model-safety)
* Blog post
  [Reducing CVE fatigue with Red Hat Hardened Images and Anchore](/en/blog/reducing-cve-fatigue-red-hat-hardened-images-and-anchore)
### Related articles
* [What is KVM?](/en/topics/virtualization/what-is-KVM)
* [What is AI security?](/en/topics/ai/what-is-ai-security)
* [What is patch management?](/en/topics/management/what-patch-management-and-automation)
* [What is security automation?](/en/topics/automation/what-is-security-automation)
* [What is SOAR?](/en/topics/security/what-is-soar)
* [What's an insider threat?](/en/topics/security/what-are-insider-threats)
* [What is post-quantum cryptography?](/en/topics/security/post-quantum-cryptography)
* [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security)
* [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication)
* [What is secrets management?](/en/topics/devops/what-is-secrets-management)
* [Containers vs. VMs: Similarities, differences, and combined approaches](/en/topics/containers/containers-vs-vms)
* [How to create a virtual machine with an instance type](/en/topics/virtualization/how-create-virtual-machine-instance-type)
* [What is confidential computing?](/en/topics/security/what-is-confidential-computing)
* [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire)
* [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security)
* [What is zero trust?](/en/topics/security/what-is-zero-trust)
* [What is a virtual machine (VM)?](/en/topics/virtualization/what-is-a-virtual-machine)
* [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux)
* [What is access control?](/en/topics/security/what-is-access-control)
* [What's the difference between cloud and virtualization?](/en/topics/cloud-computing/cloud-vs-virtualization)
* [What is virtualization?](/en/topics/virtualization/what-is-virtualization)
* [What is virtualization management?](/en/topics/virtualization/what-is-virtualization-management)
* [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware)
* [How to migrate VMs from VMware to Red Hat OpenShift Virtualization](/en/technologies/cloud-computing/openshift/migrate-vmware-to-openshift-virtualization)
* [KVM vs. VMware](/en/topics/virtualization/kvm-vs-vmware-comparison)
* [What is virtual infrastructure management? And how can automation help?](/en/topics/automation/virtual-infrastructure-management)
* [How to choose a virtualization platform](/en/topics/virtualization/how-to-choose-a-virtualization-platform)
* [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt)
* [What is live migration?](/en/topics/virtualization/what-is-live-migration)
* [Why choose Red Hat for virtualization?](/en/topics/virtualization/why-choose-red-hat-for-virtualization)
* [What is a CVE?](/en/topics/security/what-is-cve)
* [Why migrate virtual machines to Red Hat?](/en/topics/virtualization/why-migrate-your-virtual-machines-to-red-hat)
* [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control)
* [What is kubernetes security?](/en/topics/containers/kubernetes-security)
* [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right)
* [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security)
* [What is CI/CD security?](/en/topics/security/what-is-cicd-security)
* [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS)
* [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM)
* [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking)
* [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform)
* [What is edge security?](/en/topics/security/what-is-edge-security)
* [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience)
* [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management)
* [What is backup and recovery?](/en/topics/security/backup-and-recovery)
* [What is container security?](/en/topics/security/container-security)
* [What is DevSecOps?](/en/topics/devops/what-is-devsecops)
* [What is compliance management?](/en/topics/management/what-is-compliance-management)
* [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops)
* [What is cloud governance?](/en/topics/automation/what-is-cloud-governance)
* [What is a hypervisor?](/en/topics/virtualization/what-is-a-hypervisor)
* [Learn everything you need to know about Open RAN](/en/topics/5g-networks/what-is-open-ran)
* [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security)
* [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference)
* [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices)
* [Security for IoT devices](/en/topics/security/security-for-iot-devices)
* [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam)
* [What is SD-WAN?](/en/topics/edge-computing/what-is-sd-wan)
* [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security)
* [Container and Kubernetes compliance considerations](/en/topics/containers/compliance)
* [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security)
* [What is network virtualization?](/en/topics/virtualization/what-is-network-virtualization)
* [What is a radio access network?](/en/topics/5g-networks/what-is-radio-access-network)
* [What is hyperconverged infrastructure?](/en/topics/hyperconverged-infrastructure/what-is-hyperconverged-infrastructure)
* [What is software-defined networking?](/en/topics/hyperconverged-infrastructure/what-is-software-defined-networking)
* [What is risk management?](/en/topics/management/what-is-risk-management)
* [What is SELinux?](/en/topics/linux/what-is-selinux)
* [What is NFV?](/en/topics/virtualization/what-is-nfv)
* [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security)
* [What is API security?](/en/topics/security/api-security)
* [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization)
* [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services)
* [What is malware?](/en/topics/security/what-is-malware)
* [What is cloud security](/en/topics/security/cloud-security)
* [What is vRAN?](/en/topics/virtualization/what-is-vran)
[More about this topic](/en/topics/virtualization "More about this topic")