Micro-Segmentation Calculator

worst case policies = workload groups²; real policies = observed flows × rules per flow + one intra-group rule per group. If every group could talk to every group, including itself, you would need groups² policies — 576 for 24 groups. Real estates are sparse: flow discovery typically shows well under a third of that mesh in use, so the achievable policy count is observed flows times the rules each flow needs, plus one intra-group allow per group.

The n² figure is why micro-segmentation projects fail when driven from architecture diagrams; the gap between n² and observed flows is exactly the lateral movement you remove, and it is also the risk register for what you might break.

This calculator takes 4 inputs: Workload groups (labels / tiers), Distinct group-to-group flows observed, Policy rules per allowed flow, Total workloads to enforce on. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

At least one full business cycle — 30 days is the common floor — so that month-end batch jobs, backup windows, quarterly reporting and DR tests all appear in the flow data. Enforcing on two weeks of observation is the classic way to break a monthly finance close.