Decide

Policy you don't
have to write.

Segmenta reads what your fleet actually does and proposes the least-privilege rules that would cover it — each one with the evidence behind it. You accept, adjust, or decline.

Suggested rulecovers 18% of this app

FromWeb tier4 hosts

ToDatabaseSRV-SQL-01

Port: tcp/1433
Seen: 3,596,077 flows · 21 days
Process: w3wp.exe → sqlservr.exe
Narrowed to: role → role, one port

AcceptAdjustDecline

Nothing applies until you accept

The four moves Map Decide Enforce Prove

From traffic to policy

Watch a policy write itself.

Segmenta starts from what your hosts actually do, not from a diagram someone drew. Scroll to watch it go from raw traffic to an enforced policy.

Map Every host, and every real connection between them.
Roles Hosts become roles: web tier, app, database.
Rules A rule for each flow you mean, nothing else.
Enforce Everything outside the rules is blocked.

The hard part, done

From two million flows to a handful of decisions.

Segmentation projects don't stall on the firewall. They stall on turning hundreds of thousands of observed connections into rules a human is willing to sign off. That is the part Segmenta automates.

Observe

Every flow on every managed host, attributed to the process and the container that opened it.

Group

Hosts and containers are grouped into the roles they play, so a rule describes a job rather than an address.

Narrow

Each candidate rule is narrowed to the tightest form the evidence supports — a role, a named network, a single port.

Propose

What survives is a small set of decisions, each carrying the flows that justify it and the reason it stopped where it did.

Intent, not addresses

You say which roles may talk.

A rule names a role on each side — "the web tier may reach the database on 1433" — and Segmenta compiles it into concrete firewall rules on every host that plays those roles. Add a server to the role and it inherits the policy; retire it and the rules go with it.

Roles are reusable across the fleet, per application
Rules survive an address change, a rebuild, or a new container
No hand-written per-host rulesets to drift out of date

Suggested rule evidence: 3,596,077 flows

Web tier → Database

protocol / porttcp/1433

observed from4 hosts, 21 days

owning processw3wp.exe

narrowed torole → role, single port

Accept, adjust the scope, or decline covers 18% of this app

Show your working

Every suggestion carries its evidence.

A recommender you can't interrogate is a recommender you won't trust with your firewall. Each decision shows what it saw, what it ruled out, and why it stopped where it did.

The traffic behind it

Which flows, from which hosts, over what period, and how many times — not a confidence score with nothing under it.

How far it narrowed

Whether it landed on a role, a named network or an address, and what evidence stopped it going tighter.

What it held back

Flows deliberately excluded — scanner noise, probe traffic, candidate-gathering chatter — are disclosed, never silently dropped.

What it would cover

How much of the application's observed traffic this one rule accounts for, so you can see the shape of the remaining work.

Questions

About the suggestions.

What the engine will and won't do on your behalf.

Does it apply rules automatically?

No. Every suggestion waits for a human. There is no auto-apply, because a recommender that writes your firewall without asking is a recommender that will eventually take production down.

What if the traffic it learned from was malicious?

That is why the evidence is on every row. Segmenta proposes rules from what it saw; deciding whether what it saw should have been happening is the operator's job, and the console is built to make that judgement quick rather than to remove it.

Will it suggest a rule for something that only happened once?

It is deliberately reluctant to. Breadth across hosts and consistency over time weigh on every suggestion, and thin evidence is labelled rather than hidden. A single failed burst, a scan or a sweep is held back and disclosed rather than turned into policy.

Can I write rules by hand as well?

Yes. Suggestions are a starting point, not a cage — you can author rules directly at any scope, and hand-written and suggested rules compile through exactly the same path.

What happens when my network changes?

Rules describe roles, so a new host joining a role inherits the policy and a retired one takes its rules with it. New traffic that nothing covers surfaces as a new decision rather than silently being allowed.

Start a trial Talk to us

Let the traffic write the first draft.

Thirty days, with the policy suggested for you.

Start a 30-day trial See pricing

No credit card · nothing is enforced until you say so

Policy you don'thave to write.