Newly released Dragos Segmentation helps you uncover unintended access to critical systems and validate that your boundaries hold.
Segmentation validation starts with knowing what your network allows, not what your diagram says. The two drift apart because industrial environments change. People have work to do. A vendor needs access to finish an installation. An engineer needs a connection to restore operations during an outage. Each request has a reason, and each rule is added to meet an operational need. Then the work finishes and the rule stays.
Other permissions still serve a purpose, but the environment around them has changed. An approved group grows from two hosts to an entire subnet. A new remote connection creates a route around the jump host. Over time, previously reasonable decisions allow access that was never intended.
Other permissions still serve a purpose, but the environment around them has changed. An approved group grows from two hosts to an entire subnet. A new remote connection creates a route around the jump host. Over time, previously reasonable decisions allow access that was never intended.
Those connections extend across control systems, engineering workstations, and the supporting systems that keep operations running, the full extended operational technology (xOT) environment. The same access that supports everyday work can also unintentionally give an attacker a route into OT. Once inside, overly broad permissions can allow lateral movement toward critical systems. The boundaries shown on a diagram need to be enforced by the firewall, router, and switch configurations controlling that access. Knowing what those configurations permit lets teams find and close unintended paths before they are used maliciously.
The risk is big enough that regulators now expect it. NERC CIP, Australia’s SOCI rules, TSA security directives, and the EU’s NIS2 each ask for it differently, but each of those want you to show that access is controlled and your security measures work. Knowing what the configurations permit, and why, is where that evidence starts.
Whether you’re looking at segmentation because of a security concern, a regulatory requirement, or simply to understand what your network allows, start with this: could your team answer these questions today?
- Identify your most critical systems. Which systems does your operation depend on, and what needs access to them? What other things have access to those very systems?
- Gather the configurations. Which firewalls, routers, and switches control that access? Is anything missing from the set?
- Compare intended and permitted access. Do the configurations allow only the connections you expected? Check the paths that haven’t carried traffic, too. Remember, just because they have not carried traffic in the past, does not mean that it can’t.
- Find the rule behind the path. Which rule allows unexpected access? Does it still serve the purpose it was created for?
- Decide with the owner. Should the permission stay, be narrowed (think zero trust), or be removed? Who has come in as a new employee? Who has changed roles and who has left the organization. If it must stay for now, what control and review date go with that decision?
- Verify the change. Once the network owner makes the change, did the unwanted path close? Can the systems that need access still connect?
These questions are simple to ask and hard to answer. The answers are spread across many devices and years of rule changes, which is why they so often go undiscovered and unanswered. If that sounds familiar, you’re not alone: 81% of Dragos architecture reviews found poor IT/OT segmentation.
Dragos Segmentation answers the questions above: what can reach your critical systems, why that access exists, and whether changes have closed unwanted paths. It builds on configuration analysis technology trusted for years in NERC CIP-005 audits, analyzing firewall, router, and switch configurations from more than 25 supported vendors to build a topology model, reveal permitted paths, and trace unexpected access to the rules behind it.
Dragos Segmentation runs on a Dragos SiteStore and can be added to a Dragos Platform subscription or licensed on its own. No sensors are required. Importing configuration files manually generates no traffic on the OT network, so you can assess sensitive, brownfield, and air-gapped environments without affecting operations.
What does that look like in practice? The demo below walks you through how to find permitted access, identify the rule allowing it, and check whether a change closed the unwanted path. Policy Manager flags broadly permissive rules, and the Connectivity Matrix shows which subnets can connect. Selecting a connection reveals the rules allowing it, giving you the detail needed to ask the owner: does this source still need to reach this destination, using this service?
Once the network owner makes a change in your organization’s own tools, importing the updated configurations lets you compare versions and check the result. You can then generate a Segmentation Report to document what was analyzed. Best Practice and NERC CIP-005 reports are also available, so evidence comes from current configurations instead of being rebuilt by hand before each audit.
Watch the Dragos Segmentation demo to see that workflow.
If you already use Dragos, or know us for OT network monitoring, you’ve seen one side of the picture: which systems are connecting. Dragos Segmentation adds the other side: which systems can connect. License both in the Dragos Platform and you get the two views against one asset inventory, which makes questions like these a lot easier to work through:
- Can’t patch an identified vulnerable controller? Check in Dragos Segmentation to see whether anything can still reach it that shouldn’t.
- Investigating an alert on an engineering workstation? Monitoring shows what it has been talking to. Segmentation validation shows what else it could reach.
- Identified a legacy device nobody documented? Check in Segmentation whether it’s isolated or exposed.
Monitoring tells you what is happening. Segmentation tells you what could happen. Together, you see how your OT network is used, and how it could be used by someone who shouldn’t be there.
People still need to get work done. Vendors need access, equipment needs maintenance, and connections will change. You need a way to check what that leaves open.
Dragos Segmentation helps you see what can reach your critical systems, decide what access still belongs, and verify that changes do what you intended.
