A firewall rule review can show that two networks are supposed to be isolated. A penetration test can determine whether they actually are.
Network segmentation is often documented as a collection of VLANs, firewall policies, security groups, ACLs, and routing rules. Attackers, however, do not care how the architecture diagram is supposed to work. They care about which systems they can reach from a compromised foothold.
A segmentation test therefore begins with a realistic starting position.
The tester may receive a standard employee account, gain access to a representative workstation, or begin from an externally compromised system. From there, the objective is to determine which supposedly restricted systems are actually reachable.
Testing can include network paths, management interfaces, administrative protocols, DNS relationships, firewall exceptions, shared services, and systems that bridge security zones.
The difficult cases are often not obvious firewall failures.
A database may be correctly isolated from the user network while an application server has legitimate access to both networks. That server then becomes a potential pivot point.
Similarly, an administrative jump host may provide access to several protected networks. If its credentials or session can be compromised, the intended segmentation boundary effectively disappears.
Penetration testers can validate these relationships by attempting controlled lateral movement rather than simply scanning for open ports.
The result should demonstrate the effective attack path.
For example:
Compromised workstation → application server → management network → privileged system
That is more useful than a finding stating that a firewall rule is “too permissive.”
The test should also distinguish technical reachability from meaningful compromise. Being able to connect to a host does not automatically mean an attacker can access sensitive resources. The tester needs to establish what the reachable service permits and whether the path can be extended.
Segmentation is ultimately an attack-containment control.
Its purpose is not to make a network diagram look secure. Its purpose is to prevent a compromise in one zone from becoming a compromise of the entire environment.
Penetration testing validates whether that containment survives an attacker actively trying to cross it.
