Gecina, a European real estate group focused on office property, has had no ransomware incident. That is worth saying first, because what follows is not a breach narrative. What the company found came out of its own penetration tests: recurring weaknesses in the control of east-west traffic between servers and applications. Nothing cinematic. Just the unglamorous finding that inside the infrastructure, communication could move with more freedom than the business needed it to have.
Out of that came a project built with Illumio, now a finalist at the Cybersecurity360 Awards. Microsegmentation deployed across roughly 300 Windows and Linux virtual servers hosting applications, databases and infrastructure services. The approach works at the workload level, using the native firewall of the operating systems, which means no new network appliances and no redesign of the existing architecture. Security moves closer to the individual workload instead of waiting at the edge for somebody to knock.
The part the industry would rather not dwell on
For years the security budget went mostly to the perimeter. Firewalls, intrusion prevention, access controls, all aimed at keeping the attacker out. Then ransomware operators got organised, supply chain compromise became routine, and credential abuse turned the whole model inside out. The attacker does not always break the door down. Often they simply sign in. At that point the perimeter has done its job, and its job turns out to have been the easy half.
Lateral movement is the name for what happens next: the ability to move between systems, applications and servers until the critical assets are in reach. None of this is news. Zero Trust has been preached for at least a decade. And a network that treats every connection already inside it as legitimate by default is a network held together by good manners: an armoured front door, an open plan office behind it. The distance between what the industry says about itself and what it actually switches on is the real subject here, and no award category covers it.
Visibility first, which is also the uncomfortable part
The most instructive phase of the Gecina project is the least marketable one. Before any blocking policy was enforced, the agents were deployed in observation mode only, collecting information on the communication flows that actually existed in the infrastructure. That phase let the team verify application dependencies, update the documentation of legacy systems and build the policies before switching them on. Segmentation was then extended to production gradually, with the option of returning to visibility only mode at any point.
The sequence is the interesting part, more than the product. Observe, verify, update, then enforce. You check what you believe against what the traffic does, and you write down the difference you find, whatever its size. Where an infrastructure has grown by accretion, acquisition and deadline, the documented design and the running traffic are two separate questions, and only one of them can be answered by reading a diagram. Doing it in that order is the alternative to drawing your dependency map by breaking production on a Tuesday morning. Looking also forces decisions, and decisions about legacy applications are the ones nobody volunteers for.
A containment button, not a prophecy
The genuinely interesting piece is the dynamic isolation mechanism based on labels. During an incident a server can be isolated quickly by changing a single label associated with the workload, with no manual intervention across the network. The system stays reachable for forensic analysis and incident response while lateral movement is cut off. A containment button.
There is nothing futuristic about it, and that is precisely why it matters. It turns microsegmentation from a preventive control into an operational instrument of incident response, which is where most Zero Trust architecture diagrams quietly stop. The project then extended the same logic to user endpoints, including laptops used on corporate networks and on public Wi-Fi, with firewall policies adapted to the device’s context and position, working alongside the EDR platforms and reducing the volume of events that reach an analyst. None of this promises that the company will never be stopped. It changes the odds, and changing the odds is the whole trade.
What transfers, and what does not
The model was built in a large enterprise environment, but the mechanics travel. Progressive adoption, no change to the network architecture, centralised policy management: that combination is what makes segmentation feasible in organisations carrying legacy systems and business critical applications that cannot simply be stopped for a weekend. The gradual path is the point, in a phase where a great many companies are opening a Zero Trust programme. And a Zero Trust programme is never easier to shelve quietly than on the first morning an application breaks.
What does not transfer is the discipline. Any vendor will sell you the agents. Nobody can sell you the willingness to watch your own traffic before you start blocking it, and then accept what it tells you about how your infrastructure really works. Resilience is not the promise of preventing every compromise, a promise that was always a sales line rather than a strategy. It is reducing what a compromise is able to cost you, in the knowledge that you do not get to write the final invoice yourself. The perimeter sold as an insurance policy is not a strategy. It is a price list.
Raffaele Di Marzio
All my “insane” books on cybersecurity and governance are here 👇 https://cyberium.limited/bookshelf.html