Segmenta

Segmenta vs doing it yourself

You can absolutely
do this by hand.

Every host already has a firewall. Nothing stops you writing the rules yourself — and for a small enough estate, you should. This page is about where that stops working.

The short version

The firewall was never the hard part.

Windows Defender Firewall and nftables are both perfectly capable of enforcing least privilege. The reason most internal networks are still flat is not that the tooling is missing. It is that nobody knows every dependency, and the rules rot the week after you write them. Those are the two problems worth paying to avoid.

Side by side

Where the two differ.

Only the axes where there is a real difference. Anywhere both approaches do the same thing, it isn't in this table.

Segmenta By hand
Knowing what to allow Drawn from observed traffic, with the owning process on every flow. Ask around, read the docs, guess, and find the rest in production.
Writing the rules Proposed for you and narrowed to the tightest form the evidence supports. By hand, per host, per port, forever.
Knowing what will break A list of every flow that would stop, before you enforce. You find out when someone calls.
Keeping them current Rules describe roles, so a rebuilt or re-addressed host keeps its policy. Every change is a manual edit somewhere, and the drift is invisible.
Proving it Coverage measured per observed flow, and an attributable change record. A spreadsheet, and a degree of faith.
Cost A$20 per server per month, after a 30-day trial. Free, plus however many days a year this actually takes you.
When it wins Once you have more hosts than you can hold in your head. A handful of hosts with a stable, well-understood set of dependencies.

Honestly

Which one you should actually buy.

We are a small, young product. There are real situations where the manual approach is the right answer, and pretending otherwise would waste your time and ours.

Choose the manual approach if

  • You have a handful of hosts and you know every dependency by heart
  • Your estate barely changes from one quarter to the next
  • You already have working config management and the discipline to use it
  • You genuinely enjoy this and have the time for it

Choose Segmenta if

  • You've started this twice and it stalled at the discovery stage both times
  • You can't say with confidence what your servers talk to today
  • The rules you wrote last year no longer match the network
  • You need to show someone that segmentation is real, not intended

Questions

Doing it yourself.

The version of this argument we actually believe.

Isn't this just a wrapper around the OS firewall?

Enforcement uses the firewall that is already on the host, yes — deliberately, because that means no appliance and no traffic to reroute. What you are paying for is the part before and after: knowing what to allow, and knowing it is still true next quarter.

Could I build this myself?

The observation part, roughly. Collecting flows is not the hard bit. Turning hundreds of thousands of them into a small number of rules a human will sign off, and keeping that honest as the network changes, is where the work actually is.

At what size does hand-writing rules stop working?

In our experience somewhere around the point where no single person can list every dependency from memory — often a few dozen hosts. Below that, scripts and discipline genuinely do the job.

What if I only want the map?

Then use the trial for it. Thirty days on up to ten servers is long enough for the map to show you what your network actually does. Nothing is enforced unless you ask, and nothing obliges you to continue.

What this compares

This page compares Segmenta with hand-written firewall rules, which is the honest answer to “what are you actually competing with” for most estates under fifty hosts. If your conclusion after reading it is that you should do this yourself, that is a perfectly good outcome — use the trial for the map and write the rules yourself, with a much better idea of what they should say.

Use the map, even if you write the rules yourself.

Thirty days, ten servers. Nothing is enforced that you didn't ask for.

Start a 30-day trial See pricing