Plenty of Perth offices run everything, staff laptops, the file server, the smart TV in the boardroom, and the office printer, on one flat network where every device can technically talk to every other device. VLAN segmentation is the fix: splitting that single network into isolated segments so a compromised smart TV can't become a path to the file server.
What a VLAN Actually Does
A VLAN (virtual local area network) logically separates devices on the same physical network infrastructure into distinct groups, even though they might share the same switches and cabling. Traffic between VLANs only crosses through a firewall or router, where rules control exactly what's allowed, rather than every device on the network being able to reach every other device by default.
Why a Flat Network Is a Real Risk
On a flat network, one compromised device, a phished laptop, an outdated IoT gadget with a known vulnerability, has a direct path to everything else, file servers, other workstations, backup systems. This is exactly the lateral movement that turns a single infected device into a business-wide ransomware incident, rather than a contained, single-device problem.
What to Actually Segment
- Guest Wi-Fi - the most common starting point, see our guest Wi-Fi guide, but VLANs extend the same logic further.
- IoT and smart devices - smart TVs, printers, security cameras, and similar devices often run outdated firmware and rarely need to talk to core business systems.
- Point of sale and payment systems - keeping these isolated is often a PCI DSS requirement, not just good practice, see our guide to POS system security.
- Server and backup infrastructure - restricting which devices can even attempt to reach critical servers, rather than relying on credentials alone.
Getting Started Without Breaking Anything
Most business-grade firewalls and switches already support VLANs, the capability is often unused because nobody configured it. Start with the highest-value, lowest-risk split, guest Wi-Fi and IoT devices away from everything else, before tackling more complex internal segmentation. This fits naturally alongside a proper Wi-Fi design review and ongoing network monitoring, rather than as a one-off project.
Frequently Asked Questions
Isn't guest Wi-Fi already separate from our main network?
If it's set up properly, yes, guest Wi-Fi is usually the first thing businesses segment. VLAN segmentation extends that same principle further, separating IoT devices, printers, and different departments from each other too, not just guests from staff.
Do we need new hardware to set this up?
Often not, most business-grade switches and firewalls already support VLANs, the capability is frequently sitting unused because it was never configured. Worth checking your existing equipment before assuming a hardware upgrade is required.
Is this only relevant to larger offices?
The principle scales down fine, even a small office benefits from keeping smart TVs, printers, and IoT devices off the same network segment as computers handling financial or client data.
Does segmentation replace the need for a firewall?
No, they work together. VLANs control which traffic can reach which segment, but a firewall (or firewall rules between VLANs) is still what enforces those boundaries and logs what's crossing them.
We can segment your network properly without disrupting how your team already works.
Network Services →Not sure if your network is flat or segmented?
Call 0433 087 091 for a free, no-obligation IT health check.
Book a Free IT Health CheckFor related reading, see Guest Wi-Fi for Perth Businesses, Network Monitoring for Perth Businesses, and POS System Security and PCI Compliance.