Your segmentation matrix has twelve zones and you can probe only a slice of the pairs - which?

## The unit of measurement Segmentation testing goes wrong at the first step, when people count devices or zones instead of directed pairs. The claim being tested is always of the form "traffic originated in **A**, toward a destination in **B**, on service **S**, is denied". Change any of the three and you have a different claim with a possibly different answer. - **Direction matters.** Rules are usually written one way; return traffic is handled by state, not by a mirrored rule. A-to-B denied tells you nothing about B-to-A, and the interesting direction for containment is often the one nobody wrote a rule for. - **Service matters.** A pair denied on one port and permitted on another is a common and correct configuration. A single-port probe that passes is a single-port result. - **Source position matters.** Two hosts in the same nominal zone can sit behind different enforcement if the addressing grew unevenly. Twelve zones give 12 x 11 = 132 ordered pairs. Multiply by even a small service set and the matrix is thousands of cells. Nobody probes it all, which is why the question is a prioritisation question and is asked at senior level. ## How to spend a fixed budget **First: pairs where denial is a claim someone is relying on.** Somewhere there is a statement - in a risk register, a contract, an insurance questionnaire, a card-scheme scoping document - that says a segment is isolated. Those cells are not optional, because their failure is both a real exposure and a false statement made to somebody. In the retail estate this is branch or store network into the card-processing segment, and anything into the backup and management networks. **Second: low-trust, unattended sources.** A branch on consumer broadband with no on-site staff, a guest network, a vendor-maintenance segment, a device VLAN full of appliances nobody patches. An intruder does not start where you have the best controls; they start where the door is closest. Directed pairs *out of* those segments are worth more than pairs out of a well-run datacentre zone. **Third: pairs a change touched.** A firewall policy push, a routing change, a new overlay, a subnet re-use, a site turn-up. Change is what makes a green cell go stale, so change should pull cells forward in the queue rather than waiting for the rotation. **Then rotate the rest** on a stated interval, so every cell carries an age and no cell is permanently unmeasured. The rotation is what converts "we tested some things" into a coverage property you can state. ## The pair nobody probes The reason this framing matters is that the gap and the exposure are the same cell. A tester who probes the pairs they think are important tends to probe the pairs the designer already thought about - which are the pairs most likely to be correctly configured. The valuable cells are the awkward ones: the segment created for a project three years ago, the pair between two branches rather than branch-to-hub, the direction from a datacentre zone *back down* into a store, the management segment reached from a place management was never supposed to be reached from. An intruder enumerating from inside has no such bias; they try everything and stop at the first success. This is why the display rule is not cosmetic. A matrix must have three states, not two: **denied as expected**, **reachable**, and **unknown**. Unknown must be visually as loud as reachable. A dashboard that renders untested pairs as blank or white looks like a passing estate, and the cells an intruder will use are exactly the ones rendered invisible. ## Where the probes must live Originating from a central tester measures the central tester's position. If the tester sits in a management zone with broad permissions, it will find things reachable that a store host never could, or find things unreachable purely because of its own posture. The measurement only reflects the claim if the traffic starts where the claim starts - inside the source segment. That is what forces the distributed probe fleet and is the main reason this evidence costs real money. ## The costs to be honest about - A probe endpoint in every segment, including the segments created next quarter, and an onboarding step so new segments are not silently outside the matrix. - Probing looks like scanning. Coordinate it, keep its source addresses and windows known, and expect that suppressing it must be narrow rather than a blanket exemption for the probe hosts. - A cell's result is perishable, so the matrix needs an age column and a policy on how old a green cell may be before it reverts to unknown. - Someone has to act on a reachable cell. A matrix that turns red and produces no work is a reporting exercise, and the next assessor will ask what happened to the last one.