Segmenta

Walkthrough

The console,
screen by screen.

Five screens, in the order you would actually meet them. No form, no email address, no scheduling link.

Every application, and what it talks to.

Hosts and containers grouped into the applications they serve, with each edge coloured by whether policy actually covers it. This is the first screen most people have ever seen of their own network.

Traffic · Map 13 apps · 20 hosts · 47 edges
Exchange6 hosts11 edges
Directory2 hosts9 edges
Platform1 host · 4 containers7 edges
Backup1 host5 edges
Virtualisation6 hosts15 edges
Edge colour: allowed · would be blocked · blocked · ignored

What would stop, before anything stops.

Every observed flow classified against the policy you are about to deploy. This is the screen that decides whether segmentation is a project or a problem — and it is available in Learning, before you enforce anything.

Traffic that would stop today 8,071 flows have no rule
SRV-HYP-04 → SRV-FILE-01 udp/3343 cluster heartbeat7,394,421 seen
APP-WEB-02 → SRV-SQL-01 tcp/1433 w3wp.exe → sqlservr.exe3,596,077 seen
docker:mail-api → SRV-DC-01 udp/53 resolver1,204,882 seen
SRV-BKP-01 → SRV-HYP-04 tcp/902 backup agent988,140 seen
Each row becomes a rule, an exception, or a deliberate block 168 open decisions

The rule, and the evidence for it.

Segmenta proposes the tightest rule the evidence supports and shows you what it saw, how far it narrowed, and how much of the application that one rule would cover. Nothing is applied without you.

Suggested rule evidence: 3,596,077 flows
Web tier → Database
protocol / porttcp/1433
observed from4 hosts, 21 days
owning processw3wp.exe
narrowed torole → role, single port
Accept, adjust the scope, or decline covers 18% of this app

Where the work actually is.

Coverage is measured per observed flow, not per rule written — so a rule that matches nothing does not move the number. Sorted by what needs a human, not alphabetically.

Where the work is 11 scopes · 20 hosts
Exchange5%
Directory8%
Platform56%
Backup91%
Web tier98%
Coverage — flows a live rule actually carries 32% fleet-wide

Four steps, protected a wave at a time.

The console tracks the same four steps the marketing page describes. Nothing is enforced until the last one, and the last one goes a host, a scope or a rollout wave at a time — starting with something forgiving.

Your path to protection step 3 of 4

1 · See your network

20 devices

2 · Group by app

20 /20 grouped

3 · Approve traffic

20 of 20 ready

4 · Turn on protection

0 /20 protected

Protect devices as they settle — one host, one scope, or the fleet

What this is, exactly

These are renderings of the real console screens, with anonymised hostnames and illustrative figures — not a live system, and not a mock-up of something we intend to build. Every screen here exists in the product today.

A live read-only sandbox — the actual console, seeded with synthetic traffic, no signup — is the version of this page we want. It needs a read-only tenant role and a security review before it can face the internet, so it isn't here yet. In the meantime the fastest way to see the real thing is a trial: thirty days, about twenty minutes to install, and it is your own network rather than ours.

Questions

About seeing it for real.

The shortest route to a screen with your own data on it.

Can I get a live demo?

Yes — talk to us and we will walk you through the real console on a call. There is no obligation and no scoping questionnaire first.

How long until I see my own network?

About twenty minutes. Install the agent on a few hosts, and the dependency map starts drawing itself from live traffic straight away.

Do I have to enforce anything to try it?

No. Learning observes and classifies without enforcing, for as long as you want. Every screen above except the last works in Learning.

Is there a sandbox I can click around in?

Not yet. It needs a read-only tenant and a security review before an unauthenticated console can face the internet, and we would rather ship it late than ship it carelessly.

See it on your own network instead.

A 30-day trial, about twenty minutes to install, and nothing is enforced until you say so.

Start a 30-day trial See pricing