A firewall rule review can show that two networks are supposed to be isolated. A penetration test can determine whether they actually are.
Teams typically document network segmentation through VLANs, firewall policies, security groups, ACLs, and routing rules. Attackers, however, do not care how the architecture diagram is supposed to work. They care about which systems they can reach from a compromised foothold.
A segmentation test begins with a realistic attacker foothold.
The tester may receive a standard employee account, gain access to a representative workstation, or begin from an externally compromised system. From there, the objective is to determine which supposedly restricted systems are actually reachable.
Testing can include network paths, management interfaces, administrative protocols, DNS relationships, firewall exceptions, shared services, and systems that bridge security zones.
The difficult cases are often not obvious firewall failures.
A database may be correctly isolated from the user network while an application server has legitimate access to both networks. An attacker who compromises that server may use it to reach systems on both networks.
Similarly, an administrative jump host may provide access to several protected networks. If its credentials or session can be compromised, the intended segmentation boundary effectively disappears.
Penetration testers can validate these relationships by attempting controlled lateral movement rather than simply scanning for open ports.
The result should demonstrate the effective attack path.
For example:
Compromised workstation → application server → management network → privileged system
That is more useful than a finding stating that a firewall rule is “too permissive.”
The test should also distinguish technical reachability from meaningful compromise. Being able to connect to a host does not automatically mean an attacker can access sensitive resources. The tester needs to establish what the reachable service permits and whether the path can be extended.
Segmentation is ultimately an attack-containment control.
Segmentation is ultimately an attack-containment control. Its purpose is not to make a network diagram look secure. Its purpose is to prevent a compromise in one zone from becoming a compromise of the entire environment.
Penetration testing validates whether that containment survives an attacker actively trying to cross it.
Also Read: Attack-Path Validation: Why Low-Severity Findings Can Become Critical
