In short: Zero Networks is a microsegmentation platform that learns how your devices actually communicate, then automatically restricts traffic to what is needed. Privileged pathways such as RDP, SMB, SSH, WinRM and RPC stay closed until the user passes just-in-time MFA. It also segments admin and service accounts and offers secure remote access without open ports.
Why lateral movement matters
Firewalls, email security and endpoint protection all try to stop the first compromise. When one of them misses, an attacker's next step is to move sideways: from a phished laptop to a file server, from there to a domain controller, then everywhere. On a flat network that movement uses the same protocols administrators rely on every day, so it blends in.
Microsegmentation tackles this by allowing only the connections each device actually needs. It is a core part of the zero trust model explained in our zero trust security guide. Historically it was slow and expensive to deploy because someone had to write and maintain thousands of rules by hand. Zero Networks' approach is to automate that work.
How Zero Networks works
- Discover: the platform discovers assets and identities across the network without installing agents or manually tagging assets
- Learn: for 30 days it observes real traffic in learning mode and builds rules from what it sees
- Simulate: generated rules can be tested against real traffic before they are enforced
- Enforce: rules are applied and privileged ports are closed by default, protecting both north-south and east-west traffic
- Verify with MFA: when an administrator needs RDP, SMB, SSH, WinRM or RPC access to a protected asset, the port opens just in time after they pass MFA, then closes again
The network-layer MFA step is what makes the approach practical. Admins are not blocked, they are asked to prove who they are, while an attacker using stolen credentials cannot pass the prompt. Zero Networks also offers an RPC firewall aimed at protecting domain controllers from abuse of remote procedure calls.
The Zero Networks products
| Product | What it protects |
|---|---|
| Network Segmentation | Restricts every asset to the connections it needs, north-south and east-west, and puts just-in-time MFA in front of privileged ports, which blocks a common route for ransomware spread |
| OT and IoT segmentation | Part of Network Segmentation: strictly controls inbound and outbound connections for unmanaged devices that cannot run security software, such as building systems, printers and production equipment |
| Identity Segmentation | Discovers admin accounts, service accounts and AI agents, then, after a 30-day learning period, restricts each one to approved assets and logon types, with MFA on admin logons, limiting what a stolen credential can do |
| Domain controller security (RPC firewall) | Restricts remote procedure calls to domain controllers without interrupting normal operations |
| Secure Remote Access (Zero Networks Connect) | Remote access for staff and third parties with no internet-facing open ports: a port opens only for a verified user's IP address, for a limited time |
A sensible rollout is to start where the risk is highest, usually servers and MFA on privileged ports, then extend to workstations, identities and remote access.
Zero Networks and ZTNA: how they differ
ZTNA and microsegmentation are complementary rather than competing:
- ZTNA controls how users outside the network reach specific applications. Products such as Microsoft Entra Private Access, NordLayer or WatchGuard FireCloud Total Access replace the VPN.
- Microsegmentation controls east-west traffic inside the network, so a device that is already compromised, on site or remote, cannot reach everything else.
Zero Networks covers both through Secure Remote Access, but its distinctive strength is the internal segmentation. Identity-focused tools such as Microsoft Defender for Identity and other ITDR products detect attacks on Active Directory, while Zero Networks prevents many of the connections those attacks need. The two work well together.
Who Zero Networks suits
Zero Networks is a strong fit for:
- Organisations with on-premises or hybrid Windows estates, where Active Directory and file servers are the prize ransomware groups go after
- Manufacturers, healthcare and education with OT and IoT devices that cannot run security agents
- Businesses facing cyber insurance questions about MFA on remote and privileged access
- Organisations giving suppliers remote access, where Secure Remote Access can enforce MFA and limit what each third party can reach
- Teams preparing for penetration tests, since closing lateral paths removes many of the findings an autonomous penetration test typically chains together
It matters less for organisations that are entirely cloud-native, with no internal network beyond laptops talking to SaaS. There, identity controls, endpoint security and SASE carry most of the load.
Deployment, licensing and how we help
Zero Networks does not publish prices. Cost depends on which products you take and how many assets and users they cover, so ask us for a quote.
We help you scope where segmentation gives the most protection first, plan the learning period, review the generated rules with you before enforcement, set up MFA for administrators and roll out Secure Remote Access where it replaces a VPN. Pairing segmentation with managed detection and response and tested cloud backup gives you prevention, detection and recovery. Contact us to discuss your network.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Zero Networks?
Zero Networks is a microsegmentation and zero trust access platform. It automatically learns how devices communicate, restricts traffic to what is needed, puts just-in-time MFA in front of privileged ports and segments admin and service accounts, which stops attackers and ransomware moving across the network.
Is Zero Networks agentless?
Zero Networks says it discovers assets without agent installation or manual tagging, and its segmentation is designed to protect unmanaged devices, including OT and IoT equipment that cannot run security software.
What is microsegmentation?
Microsegmentation divides a network into very small zones, often down to individual devices, and allows only the connections each one needs. It limits lateral movement, so a single compromised device cannot reach the rest of the network.
How does MFA on network ports work?
Privileged pathways such as RDP, SMB, SSH, WinRM and RPC stay closed by default. When an administrator needs to connect, they complete an MFA prompt and access opens just in time, then closes again. An attacker using stolen credentials cannot complete the prompt.
Does Zero Networks replace a VPN?
Its Secure Remote Access product, Zero Networks Connect, is designed to, giving staff and third parties remote access without open internet-facing ports. You can also use Zero Networks mainly for internal segmentation alongside another ZTNA product.