Forescout eyeSegment — Dynamic Segmentation & Lateral Movement Control

① What Forescout eyeSegment actually is — a cloud policy layer on eyeSight data

Forescout eyeSegment sits above the Forescout platform's asset-discovery engine, eyeSight. eyeSight agentlessly discovers and classifies every IP-connected device — laptops, IP phones, PLCs, medical devices, cloud workloads — and builds a logical taxonomy: each asset gets a label by type, function, owner and risk level.

eyeSegment consumes that taxonomy and adds two things the base platform does not give you: traffic flow visibility (what is actually communicating with what, mapped to the taxonomy labels) and a policy simulation engine (what would change in those flows if you enforced a new rule). This combination means you design segmentation in business terms — 'POS terminals should not reach the engineering subnet' — rather than in raw IP ranges, and you validate the rule's real-world impact before a single packet is blocked.

The product is delivered as a cloud-based application, so there is no additional on-premise server to size and maintain. It reads eyeSight's continuous discovery data and lets multiple administrators collaborate on segmentation design in a shared workspace.

② Traffic flow mapping — seeing the real picture before writing rules

Before eyeSegment, network teams relied on change-control spreadsheets or topology diagrams that were often months out of date. eyeSegment replaces that guesswork with live traffic flow data drawn from Forescout's passive network monitoring. Every communication between two taxonomy labels — say, a guest wireless device talking to a domain controller — is recorded and displayed on an interactive map.

The visualisation is business-readable: instead of 'src 10.4.22.17 dst 10.1.0.5', you see 'Guest Laptop → Active Directory Server'. Flows are ranked by frequency so the team can distinguish baseline (expected) communication from anomalous (unexpected) paths that should be cut. That baseline becomes the raw material for candidate segmentation policies.

Coverage across every domain

eyeSegment visualises flows across campus, data centre, cloud and OT/IoT in a single pane. This matters because a flat OT network where a SCADA controller can reach an engineer's browser-equipped workstation — and vice versa — is the lateral movement dream scenario for ransomware. Seeing those cross-domain flows in taxonomy terms is the first step to closing them.

③ Policy simulation — designing and validating rules before enforcement

Policy simulation is the differentiating feature of eyeSegment. The workflow has three steps. First, you draft a segmentation policy using taxonomy labels: for example, 'Block all traffic from Unmanaged IoT to IT Servers'. Second, eyeSegment runs a simulation — it overlays your draft rule on the real traffic-flow baseline and highlights every communication that would be blocked if the rule were live. Third, you review the impact report, adjust the rule if legitimate traffic would be cut, and only then commit and enforce.

This prevents the classic failure: an administrator writes a broad firewall rule to isolate a factory floor, accidentally severs the communication between a PLC and its engineering workstation, and halts production. With simulation, that break surfaces on a screen before it surfaces in a factory.

Policies are written in terms of segmentation groups rather than IPs, so when a device moves or is re-classified by eyeSight the policy adjusts dynamically — no manual ACL rewrites required. This is the dynamic in dynamic network segmentation.

④ Reducing lateral movement — closing flat-network blast radius across IT, OT & IoT

Lateral movement is the technique attackers use after initial compromise: pivot from a low-value asset (a guest laptop, an unmanaged IP camera) to a high-value target (a domain controller, a SCADA historian). Flat networks make this trivially easy — once inside, everything can reach everything.

eyeSegment addresses this by pushing the committed segmentation policies to existing enforcement points: switches, firewalls, wireless controllers and software-defined networking fabrics. No forklift upgrade needed — the policy layer orchestrates the tools already on the network. The result is that an unmanaged IoT camera can communicate only with its designated video management server; all other paths are closed. An attacker who compromises the camera hits a wall rather than a highway.

Starting the first project

For a first segmentation project, Forescout recommends scoping to a high-risk flat zone — a factory floor or a guest Wi-Fi network that reaches internal servers. Use the traffic-flow map to identify the five to ten unexpected paths that represent the greatest risk, simulate rules to close them, validate, then enforce. This quick-win approach builds team confidence and proof of value before expanding to full enterprise-wide segmentation.