Network Segmentation Testing

Your network is segmented. But does the segmentation actually work?

Firewalls, VLANs, ACLs, and zone controls are only as effective as their configuration – and configuration drifts. AMATAS network segmentation testing provides definitive, evidence-based confirmation that your isolation controls work as intended, across IT, OT, and cloud environments.

Most organizations believe their network is segmented. Few have tested whether that segmentation can be bypassed. Misconfigured firewall rules, overlooked VLAN hops, implicit trust between zones, and undocumented access paths frequently allow traffic to cross boundaries that should be impassable. For PCI DSS compliance, segmentation testing is mandatory – the cardholder data environment must be demonstrably isolated from the rest of the network. For OT environments, a breach of the IT/OT boundary can have physical consequences.

AMATAS network segmentation testing provides the evidence that your controls work – or identifies exactly where they don’t.

Environment coverage

Segmentation testing across IT, OT & cloud

Segmentation exists at every layer of your infrastructure – and each layer has its own failure modes. We test all three.

IT network segmentation

Validation of zone isolation across your corporate network – between user segments, server zones, management networks, and DMZ environments.

VLAN isolation & hopping attempts
Firewall rule bypass testing
DMZ to internal network access
Management network isolation
PCI DSS cardholder data environment isolation

OT segmentation

Non-disruptive validation of IT/OT boundary controls – confirming that corporate network access cannot reach operational technology systems.

IT/OT boundary validation
DMZ jump host security testing
Industrial protocol exposure testing
Remote access path validation

Cloud environment segmentation

Validation of isolation between cloud workloads, accounts, VPCs, and environments – and between cloud and on-premise networks.

VPC & subnet isolation testing
Security group & ACL bypass attempts
Cross-account access validation
Cloud-to-on-premise boundary testing
Container & Kubernetes namespace isolation

What we test

Segmentation controls assessed in every engagement

Firewall rule validation

Verification that firewall rules enforce intended zone isolation – including rule ordering, implicit denies, and legacy permit entries.

VLAN isolation

Testing for VLAN hopping vulnerabilities – DTP exploitation, double-tagging attacks, and trunk port misconfigurations.

Cross-zone traffic testing

Systematic verification of what traffic can pass between each defined zone pair – building a complete reachability matrix.

Protocol tunneling

Attempts to bypass segmentation by tunneling restricted protocols through permitted ones – DNS tunneling, ICMP tunneling, and HTTP encapsulation.

Implicit trust paths

Identification of undocumented trust relationships, routing anomalies, and access paths that exist outside the intended segmentation design.

Jump host security

Validation that jump hosts and bastion servers used to cross zone boundaries are correctly hardened and cannot be abused as pivot points.

Manual testing

Expert-led attempts to bypass segmentation controls using VLAN hopping, firewall rule exploitation, protocol tunneling, and other techniques that automated tools cannot simulate.

Automated testing

Systematic scanning from each zone to verify which hosts, ports, and services are reachable across boundaries – providing broad, evidence-based coverage of your segmentation controls.

When to use it

The right moments for network segmentation testing

PCI DSS compliance

PCI DSS requires annual penetration testing of your segmentation controls to confirm cardholder data environment isolation.

OT environments

Before connecting IT and OT networks – or after changes to the IT/OT boundary – to confirm critical systems remain isolated.

After network changes

New firewall rules, VLAN reconfigurations, or cloud migrations can silently break segmentation – validate after every significant change.

Post-incident validation

After a breach or security incident, confirm that remediation has restored intended segmentation and closed the exploited path.

Compliance support

Regulatory frameworks this service supports

Network segmentation testing is a specific requirement under several major frameworks – our reports are structured to satisfy auditor evidence requirements directly.

FAQ

Network segmentation testing - common questions

Is network segmentation testing required for PCI DSS?

Yes – PCI DSS Requirement 11.4.5 requires annual penetration testing of segmentation controls for organizations that use segmentation to reduce the scope of their cardholder data environment. The test must confirm that the CDE is effectively isolated from out-of-scope networks, and the results must be retained for audit purposes. Our reports are structured specifically to satisfy this requirement.

How is segmentation testing different from a standard network penetration test?

A standard network penetration test focuses on exploiting vulnerabilities within a network to demonstrate impact. Segmentation testing focuses specifically on the boundaries between network zones – systematically verifying that traffic cannot cross those boundaries in unauthorized ways, regardless of whether the systems on either side are vulnerable. Many organizations need both: penetration testing to find exploitable weaknesses, and segmentation testing to confirm their isolation controls hold.

Can segmentation testing be conducted safely in OT environments?

Yes – OT segmentation testing uses passive and low-impact techniques specifically designed to avoid disrupting operational systems. We focus on boundary validation – testing whether traffic can cross from IT into OT environments – rather than active exploitation within the OT network itself. We work closely with your OT team to define safe testing boundaries and coordinate on timing to minimize any operational risk.

How often should segmentation testing be conducted?

PCI DSS requires annual segmentation testing at minimum, and after any significant changes to segmentation controls or the environments they protect. For OT environments, we recommend testing after any changes to the IT/OT boundary. For cloud environments, segmentation should be validated after major architecture changes, new account creation, or significant changes to security group and VPC configurations.

Ready to validate your network segmentation?

Talk to our team – we’ll scope the right assessment for your IT, OT, and cloud environments and compliance requirements.

Often combined with segmentation testing

Network Penetration Testing

Full internal and external network penetration testing – finding exploitable vulnerabilities across your infrastructure.

Firewall & Configuration Assessment

Expert review of firewall rules and configurations – identifying the misconfigurations that segmentation testing exposes.

Cloud Penetration Testing

Cloud-native segmentation and isolation testing for AWS, Azure, and GCP environments.