What Is a Flat Network?
A flat network is one where all devices share the same IP address range (subnet) with no logical separation between them. In practice, it's the default state of almost every router you can buy — plug it in, connect devices, everything gets a 192.168.1.x address, and every device can talk to every other device directly.
For a home network, this is fine. For a business with servers, printers, IoT devices, guest Wi-Fi, and staff workstations all on the same network, it's a significant security exposure.
How Attackers Exploit Flat Networks: Lateral Movement
The attack technique is called lateral movement. Once an attacker establishes a foothold on any device — whether through a phishing email, an unpatched vulnerability in a printer firmware, or a compromised remote access session — they use that initial access to explore and pivot across the network to higher-value targets.
On a flat network, there is nothing stopping this exploration. The compromised device can directly communicate with:
- File servers and NAS devices — to exfiltrate data or deploy ransomware
- Other workstations — to harvest credentials or spread malware
- Backup systems — to delete backups before triggering ransomware (making recovery impossible without paying)
- Management interfaces — routers, switches, firewalls — to persist access or create additional backdoors
Network printers are some of the most commonly compromised devices in SMB environments. They run embedded firmware with long patch cycles, they're rarely monitored, and they're often forgotten in security assessments. On a flat network, a compromised printer has the same access to your file server as your most privileged staff workstation.
Real Attack Paths on Flat SMB Networks
A staff member clicks a malicious email attachment. Ransomware executes on their workstation. On a flat network, it immediately begins encrypting every file share it can find — which, because all devices are visible, is all of them. With VLAN segmentation and least-privilege firewall rules between segments, the ransomware would be limited to what that workstation's VLAN can access, not the entire server infrastructure.
A smart TV or security camera with an unpatched vulnerability is compromised. On a flat network, the attacker can now use that device to scan and probe other devices — including servers and workstations — without ever passing through the perimeter firewall. The entry point was a low-value device; the target is high-value data.
A visitor connects to the "guest" Wi-Fi network — which, on a flat network, is the same network as the staff devices. If the guest's device is compromised (or if the guest is deliberately hostile), they now have network-level access to staff workstations, file servers, and printers without anyone noticing. Flat networks make this trivially easy.
The Fix: VLAN Segmentation with Firewall Control
VLANs (Virtual Local Area Networks) create logical separation between groups of devices on the same physical network infrastructure. Devices in different VLANs cannot communicate with each other directly — any traffic between VLANs must pass through the firewall, where explicit rules determine what is and isn't allowed.
For a typical Melbourne professional services office, the minimum segmentation we recommend:
| VLAN | Devices | Internet access | Can reach | Cannot reach |
|---|---|---|---|---|
| VLAN 10 — Staff | Laptops, desktops, docking stations | Full | VLAN 40 (servers, explicit rules) | VLAN 20, 30 (IoT, Guest) |
| VLAN 20 — IoT | Printers, cameras, smart devices, access control | Restricted / blocked | Specific print queues only | Staff, servers, guest |
| VLAN 30 — Guest | Visitor devices, contractor laptops | Internet only | Internet only | All internal VLANs |
| VLAN 40 — Servers | File servers, NAS, backup appliances | Restricted (updates only) | By explicit firewall rule only | IoT, Guest, internet (generally) |
The key principle: traffic between VLANs is denied by default. Permitted access is explicit and logged. A printer in VLAN 20 cannot initiate a connection to a server in VLAN 40 — even if it's compromised and trying to. The only traffic that flows between VLANs is what the firewall rules explicitly allow.
VLAN Segmentation and the ACSC Essential Eight
The Australian Cyber Security Centre's Essential Eight framework includes "Restrict Administrative Privileges" and "Limit Exposure" as core controls. VLAN segmentation directly supports these controls by ensuring that the blast radius of any single compromise is limited to the segment the compromised device is in.
For Essential Eight Maturity Level 1 — the minimum baseline — network segmentation is expected. For businesses pursuing higher maturity levels, more granular segmentation (per-application firewall rules, micro-segmentation) is progressively required.
On a Windows device, open a command prompt and type
ipconfig. Look at your IP address and subnet mask. If every device in your office has an IP address in the same range (e.g., 192.168.1.x) with the same subnet mask (255.255.255.0), your network is flat. A segmented network will show different IP ranges for different device types.What Segmentation Requires to Implement
VLAN segmentation requires hardware that supports it — specifically a managed switch and a firewall capable of inter-VLAN routing with access control. The good news is that the hardware most Melbourne businesses already use (or should be using) supports this:
- FortiGate firewall — fully supports VLAN interfaces and inter-VLAN firewall rules. Setting up four VLANs on a FortiGate takes a few hours of configuration, not a hardware upgrade.
- Managed switch — any managed switch (Ubiquiti USW, Aruba 2530, or similar) supports 802.1Q VLAN tagging. Unmanaged switches (the cheap ones without a web interface) do not support VLANs and would need replacing.
- Wi-Fi access points — both Ubiquiti UniFi and Aruba support multiple SSIDs per AP, each mapped to a different VLAN. A single AP can broadcast "OfficeStaff" (VLAN 10) and "GuestWiFi" (VLAN 30) simultaneously.
If you're already running a FortiGate and a managed switch — which is our standard recommendation — implementing basic VLAN segmentation is a configuration exercise, not a hardware replacement project. Most offices can be segmented in a single day of work, including testing.
The Bottom Line
A flat network is the default state of most SMB networks, and it significantly increases the impact of any security incident. VLAN segmentation doesn't prevent attackers from getting in — but it stops them from moving freely once they're there. For ransomware protection alone, the difference between a contained incident and a full-business encryption event can come down to whether devices were segmented.
If you're not sure whether your network is flat or segmented, we can check as part of a network or security assessment. If it's flat and you're running business-critical data, we'll tell you what it takes to fix it — and how quickly we can do it.