Flattening the blast radius of an office network does not take a forklift upgrade. Five phases, run one at a time, take most mid-sized firms from a single broadcast domain to identity-aware segments without downtime.
Phase one: inventory what you have
You can't segment what you can't see. Start by mapping every device, VLAN, and trust relationship. Most firms find printers, cameras, and a forgotten server sharing the same flat network as finance and the backups.
Phase two: group by trust, not by floor
Segment around what a device is allowed to reach, not where it sits. Finance, operations, guest, and IoT each become their own zone with explicit rules between them. This is the same posture we apply in our security work.
Phase three: cut over one segment at a time
Move the highest-value zone first, prove it, then repeat. Each phase is reversible and runs in a maintenance window, so production traffic is never at risk while the network changes shape underneath it.
