Assume breach. Contain the attack. Protect the business.

e3 & Illumio Breach Containment and Microsegmentation Services

Organisations invest heavily in preventing cyberattacks.

Firewalls.
EDR.
MFA.
Email Security.
Security Awareness.
Identity Protection.

All of these controls are important.

But there is one uncomfortable question every CEO should also ask:

What happens if an attacker still gets in?

Because a successful attack does not necessarily start with an advanced technical exploit.

It can start with:

• one convincing phishing message;
• a stolen account;
• social engineering;
• compromised credentials;
• a vulnerable endpoint;
• a third-party connection.

Once an attacker has gained a foothold, the next question becomes critical:

How far can they move through your organisation?

e3 helps organisations answer this question using Illumio Breach Containment and Microsegmentation.

The objective is simple:

Assume breach. Limit lateral movement. Minimise impact. Keep the business running.

Illumio positions its platform specifically around breach containment: identifying risk, controlling communication between systems and preventing attackers from moving freely across endpoints, servers, cloud workloads and hybrid environments.

Prevention alone is no longer enough

Most cybersecurity architectures have traditionally been designed around one primary objective:

Keep the attacker out.

That remains important.

But attackers only need to succeed once.

Defenders need to succeed continuously.

A single compromised user, device or application can provide an attacker with an initial foothold.

The real damage often happens afterwards.

Once inside, attackers may attempt to move from:

Laptop → Server → Identity system → Application → Database → Critical business system

This is known as lateral movement.

Illumio is designed specifically to identify and restrict these internal paths so that a compromise in one part of the environment does not automatically become an organisation-wide incident.

What is breach containment?

Breach containment means accepting that not every cyberattack can be prevented and designing your security architecture so that a successful compromise cannot easily spread.

Think of a ship.

A ship is divided into watertight compartments.

If one compartment floods, doors are closed so the entire ship does not sink.

Breach containment applies the same principle to your digital infrastructure.

If one:

• laptop;
• workload;
• server;
• application;
• cloud environment;

becomes compromised, the objective is to prevent the attacker from automatically reaching everything else.

Illumio describes this as containing breaches before they become business disasters.

What is microsegmentation?

Traditional networks are often divided into relatively large security zones.

Once someone has gained legitimate or illegitimate access to such a zone, many systems can still communicate with each other.

Microsegmentation breaks these large trust zones into much smaller security boundaries.

Instead of assuming:

everything inside this network can communicate,

microsegmentation applies the principle:

only systems that actually need to communicate should be able to communicate.

For example:

A finance application may need access to its database.

But that does not mean:

• every employee laptop;
• every web server;
• every cloud workload;
• every test server;

should also be able to communicate with that database.

Illumio allows organisations to visualise communication between systems and then enforce granular policies that permit only required connections.

Microsegmentation in one sentence

Microsegmentation limits which systems can communicate with each other so that an attacker cannot freely move through the organisation after compromising one system.

This makes microsegmentation an important technical foundation for:

• Zero Trust;
• ransomware containment;
• breach containment;
• cyber resilience;
• critical-system protection.

The problem: attackers move laterally

Imagine that an attacker compromises an employee laptop through phishing.

The laptop itself may not contain the organisation’s most valuable information.

The attacker therefore starts exploring.

Can I reach:

• file servers?
• Active Directory?
• databases?
• management servers?
• backup infrastructure?
• production systems?
• OT environments?
• cloud workloads?

Every unnecessary connection becomes a possible attack route.

This is why the initial breach is only part of the problem.

The blast radius determines how serious the breach can become.

Reduce the blast radius

The blast radius describes how far the impact of a compromise can potentially spread.

Without sufficient segmentation:

1 compromised device → many reachable systems → potentially major incident

With effective microsegmentation:

1 compromised device → restricted communication → contained incident

That difference can determine whether an organisation experiences:

• one compromised workstation;

or:

• widespread ransomware;
• operational disruption;
• loss of critical systems;
• large-scale data compromise.

What can we learn from attacks such as ODIDO?

The 2026 cyberattack on ODIDO demonstrates an important reality.

According to ODIDO, the attacker contacted its service team while pretending to be an employee of the IT department. ODIDO states that phishing attacks took place on 5 and 6 February 2026 and that the attack that led to data theft was highly sophisticated. Ultimately, approximately 6.39 million individuals were affected. ODIDO also stated that its core telecom services remained operational.

The important security lesson is not specific to ODIDO.

It is broader:

People can be manipulated. Credentials can be compromised. An attacker may eventually get past preventative controls.

That is why organisations should consider not only:

How do we stop someone getting in?

but also:

What can they reach once they are in?

Would microsegmentation prevent an attack like ODIDO?

Not necessarily.

Microsegmentation does not replace:

• security awareness;
• MFA;
• identity security;
• endpoint protection;
• email security;
• fraud detection.

And it should not be claimed that Illumio would have prevented the specific ODIDO incident.

Its purpose is different.

If an attacker successfully compromises an account, device or workload and then attempts to move further through the environment, microsegmentation can significantly restrict the available paths.

The security model changes from:

“You are inside, therefore you can reach many systems.”

to:

“You may have compromised one asset, but that gives you no automatic trust elsewhere.”

That is the principle of Zero Trust Segmentation.

Social engineering cannot always be stopped

Security awareness is essential.

But even well-trained employees can be deceived by sophisticated attacks.

Attackers may know:

• employee names;
• job functions;
• suppliers;
• internal terminology;
• organisational structures.

AI is making convincing social-engineering attacks even easier to create.

That means organisations should design security under the assumption that, eventually:

one identity or one device may become compromised.

The architecture must therefore prevent that compromise from automatically opening the rest of the organisation.

Assume Breach

This is the philosophy behind Assume Breach.

Assume Breach does not mean giving up on prevention.

It means accepting that prevention cannot provide a 100% guarantee.

A mature cyber-resilience strategy therefore combines:

Prevent → Detect → Contain → Recover

Illumio adds a particularly strong capability around the third step:

Contain.

Illumio itself describes Zero Trust as beginning with an Assume Breach mindset, using least-privilege communication and continuous control to prevent threats spreading laterally.

Illumio Breach Containment

Illumio provides visibility and segmentation across:

• endpoints;
• servers;
• workloads;
• data centres;
• cloud environments;
• containers;
• hybrid environments.

The platform can help organisations:

See

Understand which systems communicate with each other.

Assess

Identify unnecessary connections and potentially dangerous attack paths.

Segment

Create granular communication policies.

Protect

Restrict access to critical systems.

Contain

Isolate compromised systems during an active attack.

Illumio describes this as a unified breach-containment model across hybrid and multi-cloud environments.

You cannot segment what you cannot see

One of the first challenges with microsegmentation is understanding application communication.

Traditional environments often contain thousands or millions of network connections.

Blocking traffic without understanding these dependencies can disrupt the business.

Illumio therefore starts with visibility.

The platform maps communications between:

• workloads;
• devices;
• applications;
• cloud systems.

This creates an application dependency map.

Security teams can see:

Who is talking to whom?

On which ports?

Why is this communication required?

Which communication appears unnecessary?

Only then should segmentation policies be introduced.

Start with visibility, not blocking

At e3 we recommend a phased approach.

Phase 1 — Discover

Understand the existing environment.

Phase 2 — Visualise

Map communication and dependencies.

Phase 3 — Analyse

Identify excessive or unnecessary connectivity.

Phase 4 — Protect critical assets

Start with systems that matter most.

Phase 5 — Introduce segmentation

Gradually implement least-privilege communication.

Phase 6 — Expand

Extend segmentation across the environment.

This reduces operational risk and makes microsegmentation manageable.

Protect your digital crown jewels

e3 recommends connecting microsegmentation directly to the organisation’s digital crown jewels.

These are not only datasets.

They can also include the systems and applications required to create, process or protect critical information.

Examples include:

• ERP systems;
• source-code repositories;
• production systems;
• R&D platforms;
• customer databases;
• identity infrastructure;
• backup systems;
• financial applications;
• OT environments.

One of the first questions should therefore be:

If an attacker compromises an ordinary employee laptop, can they technically reach the systems containing our crown jewels?

If the answer is yes, the organisation may have an unnecessarily large blast radius.

Crown Jewel Ringfencing

An effective first use case for Illumio can therefore be Crown Jewel Ringfencing.

Instead of immediately microsegmenting the entire organisation, e3 identifies the most critical systems and creates stronger boundaries around them.

For example:

Internet → Endpoint → General server environment → Crown Jewel

Each step should require explicitly permitted communication.

The result is an additional layer of protection around the assets whose loss would have the greatest impact.

Ransomware containment

Ransomware becomes particularly damaging when it can move from one system to another.

Attackers may attempt to reach:

• file servers;
• domain infrastructure;
• backups;
• hypervisors;
• production systems.

Microsegmentation reduces the number of communication paths available for this lateral movement.

Illumio specifically positions segmentation as a way to prevent ransomware and other breaches from spreading through hybrid environments.

Protect your backup infrastructure

Backups are one of the most important assets during a ransomware incident.

Attackers know this.

They may therefore attempt to compromise backup infrastructure before encrypting production systems.

A segmentation strategy can restrict which:

• users;
• systems;
• management networks;

are able to communicate with backup infrastructure.

This makes the backup environment substantially harder to reach from an initially compromised endpoint.

Endpoint containment

Lateral movement does not always begin in the data centre.

A compromised employee endpoint can be the first step.

Illumio Segmentation can apply controls to endpoints as well as workloads.

Illumio states that compromised devices can be isolated while communication boundaries are enforced at operating-system level.

This creates the ability to restrict movement from:

endpoint → server

as well as:

server → server

and:

cloud → data centre.

Hybrid and multi-cloud segmentation

Modern organisations no longer operate one network.

Applications span:

• physical servers;
• virtual machines;
• Azure;
• AWS;
• Google Cloud;
• containers;
• endpoints;
• OT environments.

Traditional segmentation based only on network firewalls becomes increasingly difficult in this architecture.

Illumio is designed to provide consistent visibility and segmentation across hybrid and multi-cloud environments.

Microsegmentation without redesigning the entire network

A common misconception is that microsegmentation requires a major network redesign.

Illumio takes a different approach.

Policies can be enforced close to workloads and endpoints rather than requiring every segmentation boundary to be built using additional network firewalls.

Illumio states that its platform can map and segment workloads without requiring organisations to redesign their existing firewall infrastructure.

This can make segmentation substantially more scalable in complex environments.

Zero Trust Segmentation

Zero Trust is often summarised as:

Never trust. Always verify.

From a network perspective, this means that systems should not automatically trust each other simply because they are inside the corporate environment.

Illumio applies this principle to workload and endpoint communications.

Only the communication required for a legitimate business purpose should be allowed.

This is why Illumio also refers to microsegmentation as Zero Trust Segmentation.

Breach Containment versus EDR

Endpoint Detection and Response — EDR — is extremely important.

But EDR and microsegmentation solve different problems.

EDR primarily asks:

Is something malicious happening on this device?

Breach containment asks:

If this device becomes compromised, where can the attacker go next?

These capabilities therefore complement each other.

A strong architecture combines:

EDR + Identity Security + Microsegmentation + Detection & Response

rather than treating them as alternatives.

Illumio Insights

Illumio increasingly combines segmentation with real-time detection and security visibility through Illumio Insights.

Insights uses an AI-powered security graph to understand relationships and potential lateral-movement paths across hybrid environments.

It is designed to help security teams:

• identify risky communication;
• identify attack paths;
• detect lateral movement;
• prioritise threats;
• contain compromised assets.

Illumio expanded these capabilities in 2026 with additional system-wide visibility around lateral-movement risk.

From detection to containment

Security teams often have many detection technologies.

The challenge is that identifying an attack does not automatically stop it.

Consider:

SIEM identifies suspicious activity.

Useful.

EDR detects malware.

Useful.

NDR identifies abnormal network traffic.

Useful.

But if an attacker is actively moving through the environment, someone still needs to restrict that movement.

This creates what can be called the containment gap.

Illumio is specifically designed to close this gap by combining visibility with enforceable segmentation controls.

Cyber resilience: keep the business running

For the board, microsegmentation should ultimately be about more than security architecture.

It is about business resilience.

An organisation should assume that some systems may eventually be compromised.

The goal is to prevent that incident from becoming:

• an organisation-wide outage;
• widespread ransomware;
• loss of critical operations;
• major data compromise;
• prolonged recovery.

This changes the management discussion from:

“Can we guarantee we will never be hacked?”

to:

“Can we continue operating when part of the organisation is compromised?”

The e3 Illumio Services

e3 helps organisations move from the concept of breach containment to an operational microsegmentation architecture.

Our services can cover the complete lifecycle.

1. e3 Breach Containment Assessment

Before implementing microsegmentation, e3 can assess the existing environment.

We examine questions such as:

• Which systems are business-critical?
• What are the digital crown jewels?
• Which communication paths exist?
• Which systems can reach critical applications?
• Where is lateral movement possible?
• Which network zones contain excessive trust?
• Which systems should be ringfenced first?

The result is a prioritised Breach Containment Roadmap.

2. Crown Jewel Risk Review

e3 can combine microsegmentation with our Crown Jewel Risk Review.

First we determine:

What must absolutely be protected?

Then:

Which technical routes provide access to it?

This connects business risk with technical architecture.

Instead of attempting to segment everything simultaneously, organisations can begin with the systems where a breach would have the greatest business impact.

3. Application Dependency Mapping

Before enforcing segmentation, e3 helps map application communication.

This provides visibility into:

• application dependencies;
• network flows;
• protocols;
• ports;
• unexpected communication;
• risky connections.

This becomes the foundation for safe segmentation.

4. Illumio Architecture & Design

e3 can design the Illumio environment based on:

• business requirements;
• network architecture;
• cloud architecture;
• security requirements;
• application dependencies;
• critical assets.

Deliverables can include:

• High-Level Design;
• Low-Level Design;
• policy architecture;
• deployment model;
• segmentation roadmap.

5. Illumio Implementation

e3 can support implementation across relevant environments including:

• endpoints;
• servers;
• data centres;
• cloud workloads;
• containers.

The implementation can be phased so visibility is established before enforcement becomes stricter.

6. Microsegmentation Policy Design

The quality of segmentation depends heavily on policy design.

e3 helps determine:

• which traffic is required;
• which traffic can be removed;
• which applications should communicate;
• which assets require stricter protection;
• which exceptions are justified.

The guiding principle is:

Allow what the business needs. Remove unnecessary trust.

7. Crown Jewel Ringfencing

e3 can create dedicated segmentation controls around the organisation’s most critical applications.

This provides a practical first step towards Zero Trust.

Examples include ringfencing:

• Active Directory;
• backup systems;
• ERP;
• R&D environments;
• source-code platforms;
• customer databases;
• production infrastructure.

8. Ransomware Containment

e3 can design segmentation specifically around common ransomware movement paths.

The objective is to restrict communication that could allow a compromised endpoint or server to reach:

• other endpoints;
• file servers;
• administrative interfaces;
• critical infrastructure;
• backup environments.

9. Illumio Health Check & Optimisation

For organisations already using Illumio, e3 can assess:

• coverage;
• policy design;
• unmanaged assets;
• segmentation maturity;
• exceptions;
• application dependencies;
• critical-system protection.

The result is a roadmap to increase the value of the existing Illumio investment.

10. Managed Illumio Services

Segmentation is not a one-time project.

Applications change.

Cloud workloads appear and disappear.

Infrastructure changes.

New communication paths emerge.

Policies therefore require continuous management.

e3 can support customers with:

• Illumio platform management;
• policy changes;
• segmentation optimisation;
• application onboarding;
• exception management;
• security review;
• incident support;
• reporting.

Incident response with Illumio

Illumio can also become valuable during an active security incident.

When a system is believed to be compromised, security teams need to answer quickly:

What can this system communicate with?

What systems could already be affected?

Can we isolate it?

Illumio provides visibility into relationships and allows compromised systems to be isolated to restrict further lateral movement.

This makes microsegmentation not only a preventive architecture but also an incident-response capability.

From perimeter security to impact reduction

Traditional security asks:

How do we stop the attack?

A cyber-resilient architecture adds another question:

How do we limit the impact when prevention fails?

This is an important change.

Prevention and detection remain essential.

But they should be complemented with:

containment.

Frequently Asked Questions

What is microsegmentation?

Microsegmentation divides an IT environment into small security zones and controls which systems may communicate with each other. This restricts unnecessary communication and makes lateral movement more difficult after an attacker compromises a system.

What is breach containment?

Breach containment is the practice of limiting the spread and impact of a cyberattack after an attacker gains access to part of an environment.

What is lateral movement?

Lateral movement is the process by which an attacker moves from an initially compromised system to other systems, applications or data within an organisation.

Does microsegmentation prevent phishing?

No. Microsegmentation is not a replacement for email security, MFA, identity security or security awareness. Its role is particularly important after a device, identity or workload has been compromised, because it can limit what the attacker can reach next.

Can Illumio stop ransomware spreading?

Illumio Segmentation is designed to restrict unnecessary communication and prevent lateral movement, which can significantly constrain the paths ransomware can use to spread through an environment.

What is Zero Trust Segmentation?

Zero Trust Segmentation applies Zero Trust principles to network and workload communication. Systems receive only the connectivity required for their legitimate function rather than implicitly trusting other systems on the same network.

Is microsegmentation the same as a firewall?

No. Network firewalls remain important, but microsegmentation creates much finer controls between individual workloads, applications and endpoints. Illumio can enforce segmentation without requiring organisations to redesign every network boundary using additional firewalls.

Does Illumio replace EDR?

No. Illumio and EDR are complementary. EDR focuses primarily on detecting and responding to malicious activity on endpoints. Illumio focuses on visibility, segmentation and restricting lateral movement between assets.

Can Illumio protect cloud environments?

Yes. Illumio supports segmentation and breach containment across cloud, data centre, endpoint and container environments.

Where should an organisation start with microsegmentation?

e3 recommends starting with visibility and business-critical systems. Identify the crown jewels, map the communication paths around them and progressively introduce segmentation before expanding across the wider environment.

The CEO perspective

For a CEO, microsegmentation ultimately comes down to four questions:

1. If one employee account or laptop is compromised, how far can an attacker move?

2. Can that attacker reach our most critical business systems?

3. Can we isolate compromised systems without shutting down the entire organisation?

4. Can the rest of the business continue operating during a cyberattack?

If these questions cannot be answered with confidence, the organisation may have a breach containment gap.

You may not be able to prevent every breach. You can limit its impact.

Hackers only need one successful entry point.

A phishing message.

A compromised identity.

A vulnerable laptop.

A supplier connection.

Prevention will always remain essential.

But cyber resilience requires an additional assumption:

At some point, someone may get in.

The next question determines how serious the incident becomes:

What can they reach?

e3 and Illumio help organisations reduce that answer.

Assume breach.
Contain lateral movement.
Protect the crown jewels.
Minimise the impact.
Keep the business running.

Talk to e3 about Illumio Breach Containment and Microsegmentation.

CONTACT E3

Do you recognize your organization in our vision on data protection and DLP?
We would be happy to meet, learn more about your environment and explore how we can help protect your critical data.

Get in touch with e3 Benelux and let’s secure your business together.