By default, every device plugged into the same switch or connected to the same Wi-Fi can usually "see" every other device on that network. In a small office with one flat network, that means a guest's laptop, the office CCTV system, the finance team's PC, and the file server are all technically reachable from each other. A VLAN (Virtual LAN) is how you stop that.
What a VLAN actually does
A VLAN splits one physical network into separate logical networks, even though everything might run through the same switches and cabling. Devices on different VLANs can't talk to each other by default — you have to explicitly allow specific traffic between them through the firewall or router, which means one compromised or unwanted device doesn't automatically have a path to everything else.
How a typical office gets segmented
- Servers VLAN — file server, AD server, and other core infrastructure, reachable only by staff devices that need it
- Staff/Windows PCs VLAN — regular work devices
- Guest Wi-Fi VLAN — visitors get internet access only, with zero path to internal systems
- CCTV VLAN — cameras and DVR/NVR isolated from the rest of the network, since IP cameras are frequently targeted and rarely get security updates
- IP Phones VLAN — voice traffic kept separate so it isn't affected by, or a path into, data traffic
A real deployment
On a second-floor office buildout for a financial advisory firm, I set up the rack, cabling, and switches from scratch, then configured separate VLANs for IP phones, guest Wi-Fi, servers, CCTV, embedded terminal devices, and Windows PCs. On top of that, a proxy server was configured so certain machines could reach only the internal application they needed — no general internet access at all. That combination (VLAN segmentation + controlled outbound access) is what actually limits damage if any one device gets compromised.
Do you need this for a small office?
If you have CCTV, guest Wi-Fi, or IP phones alongside your regular business network — yes. These are exactly the devices most likely to be outdated, poorly secured by their manufacturer, or accessible to people outside your staff (guests, delivery staff walking past a camera's network port). Separating them from your core business data is one of the highest-value infrastructure changes for the cost involved — mostly configuration time on switches you likely already own.