lgkm.org

Field notes · 22 October 2026 · Network and segmentation

Blast radius belongs in the board pack

In plain words: Boards should ask one simple question: if a burglar gets into one room, how many of the important rooms can they reach? Network and segmentation, explained simply

In short

From one compromised laptop, a flat network reaches eight systems including all three critical ones; a segmented network reaches two and none of the critical ones
From one compromised laptop, a flat network reaches eight systems including all three critical ones; a segmented network reaches two and none of the critical ones

Why boards should care now

Boards are being asked to own cyber risk, not just hear about it. The UK's Cyber Governance Code of Practice, published in April 2025, asks directors to "identify, prioritise and mitigate risks associated with critical technologies and services" and to make sure there is a tested plan for responding and recovering. In the United States, the SEC's 2023 rules require listed companies to describe the board's oversight of cyber risk every year, and to disclose a material incident within four business days of deciding it is material. Directors who sign those statements need more than a count of closed tickets.

The NCSC's Cyber Security Toolkit for Boards makes the same point from another side: board members should be able to name the main threats and say how they would affect the business's objectives. The effect on the business is decided less by how the attacker got in than by how far they could go once inside.

Speed is the reason

Intruders do not wait. CrowdStrike measures "breakout time", the time an attacker takes to move from the first compromised machine to another one inside the organisation. In its 2026 report the average for criminal groups fell to 29 minutes in 2025, down from 48 minutes the year before, and the fastest it saw was 27 seconds. Those are one vendor's figures, but the direction matches what responders describe: by the time a person reads the first alert, the attacker may already be on the second machine.

So detection alone cannot be the board's comfort. What limits the damage in those first minutes is what the network and the identity systems allow without anyone deciding anything. That is a design property, and it can be measured before an incident rather than discovered during one.

What to report

My own suggestion is three numbers, each tied to the short list of services the business has already called critical:

  1. Reach. From a typical user device, and from each internet-facing system, how many critical systems can be reached on the network? Report it as "x of y". A flat network scores y of y; the aim is zero, through a small number of approved paths.
  2. Coverage. What share of critical services sit behind enforced segmentation rules, not rules that only report? Report-only mode is the right way to start (see Labels before rules) but it stops nothing.
  3. Time to contain. How long it takes, in a test, to cut off one compromised machine or account once it is spotted. Put it next to the breakout time above. If isolation takes four hours and breakout takes half an hour, the board should know.

Each number should come from a test, not a diagram: an attack simulation or a red-team exercise that starts from a real foothold and records what it could reach. Diagrams describe the network people meant to build; tests describe the one they have.

What it changes

Reported this way, segmentation stops being a technical project with a long tail and becomes a risk reduction the board can watch. "Critical systems reachable from a laptop went from 12 of 12 to 3 of 12 this quarter" is a sentence a director can understand, question and compare with next quarter. It also gives the security team a better argument for funding than another count of findings, which ties in with Vulnerability counts are the wrong number. The NACD and Internet Security Alliance board metrics ask which controls deliver "the greatest risk reduction per dollar invested"; a reach number that falls after a segmentation project is one way to answer.

Blast radius is not only a network idea. An over-privileged service account or an agent with standing access has a blast radius too, and the same "x of y" works for identities. But the network is the easiest place to start, because the paths can be tested today.

What to do on Monday

LabelSim on this site shows the blast radius of a labelling scheme before any real policy changes, which is a cheap way to see what the reach number could become.

Sources

Follow with the feed

Personal work and my own view, not my employer's. Sources are public.