Forescout: Why Visibility Must Come First in Network Segmentation

Name: Forescout: Why Visibility Must Come First in Network Segmentation
Uploaded: 2026-08-24T07:19:22-04:00
Duration: 1 min 33 s
Description: In this interview, Paul Kao, Chief Product Officer at Forescout, discusses common risks in network segmentation projects and how to avoid them. Learn why enforcing policies too early can lead to blocking the wrong devices, and why visibility and accura...

Forescout

08/24/2026

0 (0%)

Report Like Favorite

TL;DR

Rushing to enforcement on an uncharacterized network causes segmentation projects to fail by erroneously blocking legitimate devices.
Accurate device visibility and identity-based classification must be established before any segmentation policies are applied.
Healthcare environments highlight why static zone-based segmentation breaks down when medical devices roam dynamically across facilities.

Summary

In this short interview, Paul Kao, Chief Product Officer at Forescout, explains why network segmentation projects so often fail — and what organizations must do differently. The core argument is straightforward but frequently overlooked: jumping straight to policy enforcement on an uncharacterized network is a recipe for disruption. Without first achieving full device visibility and accurate identity-based classification, enforcement policies will inevitably block the wrong devices, creating operational problems rather than solving security ones. Kao introduces the concept of a 'dirty network' — an environment where devices may not be deployed in their intended zones — and argues that layering segmentation policies on top of unverified device inventories compounds risk rather than reducing it. The healthcare sector serves as a compelling use case: smart medical devices like blood pressure monitors and infusion pumps roam dynamically across wards and buildings, making static, zone-based segmentation unworkable. Identity-based segmentation addresses this by classifying devices by type rather than location, enabling policies that follow the device wherever it moves while still protecting it from unauthorized access. This approach represents a meaningful shift from traditional perimeter-based thinking toward dynamic, context-aware network security.

Chapters

0:00 - The Segmentation Enforcement Trap
0:30 - Visibility and Identity Classification First
0:39 - Healthcare as a Segmentation Use Case
1:10 - Identity-Based Dynamic Policy

Key Quotes

0:20 "If you try to apply enforcement policies before having an understanding of what's in that environment, it's going to fail."
0:28 "It's going to erroneously block the wrong device."
1:03 "That's where traditional segmentation fails."

FAQ

Why do network segmentation projects fail?

According to Forescout's CPO Paul Kao, the most common failure is enforcing segmentation policies before achieving accurate device visibility. On a 'dirty network' where devices may not be in their intended zones, premature enforcement will block the wrong devices and disrupt operations.

How does identity-based segmentation differ from traditional approaches?

Traditional segmentation assigns policies based on network zone or location. Identity-based segmentation classifies devices by their type or identity, so policies follow the device as it moves — critical in environments like hospitals where devices roam across wards and buildings.

Categories:

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Becoming Agent Ready with Cyera: Essential Strategies and Insights

Verge.io: Can You Afford Your Next Storage Refresh?

Summer of Satori: FunFoneFarm's Transformation of Fraud into Seamless Integration

Invisible Data: Understanding What Needs Protection

Embrace AI Adoption While Maintaining Robust Security Measures