Your office probably runs on one WiFi network. The front desk computer, the conference room display, a visiting client's phone, the credit card terminal, and the shared drive holding five years of client files all connect to it. That setup is called a flat network, and it is one of the most common, most correctable security gaps in small offices across every regulated industry.
A flat network places every device in the same broadcast domain with no internal barriers. If one device is compromised, an attacker can move laterally to every other device without crossing a meaningful obstacle. Separating your network into segments — at minimum, an isolated guest WiFi and a dedicated zone for payment terminals or sensitive systems — limits that movement and is achievable without a dedicated IT team.
What makes a flat network dangerous?
On a properly segmented network, device groups are separated by logical or physical barriers. Traffic between segments requires explicit permission to cross. On a flat network, no such barriers exist.
The practical consequence: a visitor who connects to your business WiFi and triggers a malware infection — by clicking a phishing link on their phone, for example — can expose your internal devices to that malware's scanning and propagation routines within minutes. A compromised printer, which runs its own operating system and is rarely patched, can become a foothold for reaching your accounting software or the shared folder holding client records.
This technique is called lateral movement. It is a standard phase of most network intrusions, and a flat network removes every internal obstacle to it.
Firms in regulated industries carry a compounding exposure. If a breach occurs and a forensic review finds the network had no segmentation, that architectural gap may be treated as foreseeable — relevant in HIPAA enforcement discussions, under state data protection statutes, and in breach notification obligations to clients and courts.
Does Microsoft 365 Business Premium protect against this?
Microsoft 365 Business Premium includes Defender for Business for endpoint protection, Intune for device management, and Azure Active Directory (now Entra ID) for identity controls. These are appropriate tools for a small firm without a dedicated IT department, and they address a meaningful portion of your attack surface.
What they do not address is your local network topology. Defender for Business protects the devices it manages. It does not see or control traffic between an unmanaged device — a visitor's laptop, a contractor's personal phone, a legacy point-of-sale terminal — and your internal systems. Network segmentation addresses that gap directly.
Three segmentation steps for a small office
Separate guest WiFi — and verify it is truly isolated
Most routers and wireless access points include a guest network feature. Enable it. A correctly configured guest network routes traffic directly to the internet and prevents guest devices from communicating with your internal network.
Two cautions before you consider this done. First, confirm that AP isolation or client isolation is enabled in your access point settings — some equipment creates a separate guest SSID that still shares the internal broadcast domain, which provides no real protection. Second, some lower-cost routers implement guest networks incompletely. If you cannot verify isolation through your equipment's documentation, replace the router or add a business-grade access point that supports the feature correctly.
Isolate payment terminals and sensitive systems
A payment terminal that can reach your file server or accounting software on the same flat network is an unnecessary risk. These devices should communicate only with what they require — typically a payment processor's external endpoint — and nothing else. The same logic applies to medical devices, HR systems, and any system holding regulated data.
Three approaches, in order of increasing complexity:
- Physically separate router: connect sensitive devices to a second router plugged into your ISP modem. No VLAN knowledge required, and easier to implement correctly than a misconfigured VLAN.
- VLAN on a managed switch: a cleaner architecture using a single physical infrastructure with logical separation. Requires managed switch hardware and someone who can configure it correctly.
- Firewall rules between segments: adds explicit access control on top of physical or logical separation, and works in combination with either approach above.
Start with the approach you can implement and verify correctly. An improperly configured VLAN that appears to segment but does not is worse than a simple second router done right.
Restrict access to local servers and storage
If your office has a local file server or a network-attached storage device, it should not be reachable from the general office network without explicit reason. Place it on a dedicated segment and create firewall rules that permit only the specific devices that require access.
If you use SharePoint and OneDrive through Microsoft 365 Business Premium, your primary file storage is cloud-hosted — which reduces local exposure. Any local backup appliances, legacy servers, or on-premise systems, however, remain fully exposed on a flat network.
A practical segmentation checklist
Confirm each item before treating your network as adequately segmented:
- Guest WiFi is enabled and AP isolation is confirmed active
- A guest device cannot reach any internal IP address on your business network
- Payment terminals and POS systems are on a separate network segment from office workstations
- Any local file server or NAS is on a restricted segment with explicit access rules
- Default admin credentials on routers, switches, and access points have been changed from manufacturer defaults
- Firmware on all network equipment is current
- A record exists of which devices belong to which segment
- A knowledgeable resource has reviewed and documented the configuration
None of these steps require a large budget. Most require access to a knowledgeable resource, a structured block of time, and documentation of what was done and why. That last item — documentation — is also what you will need if a regulator, insurer, or opposing counsel asks whether reasonable controls were in place.
