Architecture and segmentation
Zero-trust network design, segmentation and micro-segmentation planned around business services and their trust boundaries.
Capability 04
Network Security
Protect connectivity across every trust boundary. Segmentation, transport controls and passive detection, designed layer by layer and tested end to end, including the industrial networks most tools cannot touch.
- Delivered as
- Assessment, project or programme
- Works with
- Network, security operations and OT engineering teams
- Related perspectives
- Security is not a firewall. It is seven stacked decisions
- Segmentation is the control you already own
The challenge
The control existed, just not at the layer that got hit.
Most estates have firewalls, TLS and MFA. Fewer can say who owns the controls at each layer of the network, when they were last tested end to end, and which business process stops if a layer fails. Attackers do not need a layer with no control; they need one with no clarity.
Network security is seven stacked decisions, from physical access to application traffic, and increasingly it has to include the east-west traffic between your own systems and the industrial or clinical networks where nothing can be probed.
What we deliver
Offerings.
Take one offering on its own, or combine them into a programme with a named lead and agreed exit criteria.
Firewall and rule-base assurance
Rule review, cleanup and change control across every vendor you run, so the rule base is one you can defend.
Secure remote and identity-aware access
Access to the estate tied to identity and device posture rather than to the network a user happens to be on.
Passive network detection and forensics
Rhinexa Sentinel deployed from a mirror port, tuned to your estate, and forwarded into the SIEM and workflows you already run.
OT and industrial network security
Zones and conduits in the IEC 62443 model, mirror-only visibility, and controls that cannot become a risk to the line.
Layer-by-layer validation
Segmentation, transport, session and wireless controls tested as an attacker would test them, with the findings mapped to owners.
Approach
How an engagement runs.
A named practice lead from scoping to close, with deliverables agreed before work starts.
Map
Layers, flows, owners and the business processes behind them, in one view.
Design
Target segmentation and control set per layer, with the evidence each must produce.
Implement
Engineer the controls under your change process, vendor by vendor.
Validate
Test end to end, then repeat as the estate changes.
Outcomes
What changes for you.
Measured outcomes from real engagements will be published here once clients consent.
Segmentation that holds
Boundaries designed around business services and tested, not drawn once.
A rule base you can defend
Every rule with an owner and a reason, reviewed on a cycle.
Evidence of what crossed the wire
Independent network records that survive when host logs do not.
Platform · Rhinexa Sentinel
See what crosses your network.
Passive detection and correlation from a copy of your traffic, with a tamper-evident record. Never in the path.
Explore Rhinexa Sentinel
Sample dataQuestions
Frequently asked.
Do you work with our existing firewall vendors?
Yes. We work with whatever you own. Where we recommend a change we say why, and we have no obligation to any vendor's product.
Is passive detection safe on OT networks?
Reading a mirror copy of traffic transmits nothing toward your devices. That is how industrial and clinical networks are watched without becoming a risk to them.
Does Rhinexa Sentinel replace our NDR or SIEM?
No. It sits alongside them and forwards findings into your existing workflow. It adds the independent, tamper-evident record that host logs cannot give you.
How long does a segmentation programme take?
It depends on the estate. We start with the crown-jewel services and deliver value segment by segment rather than waiting for a complete redesign.