In short: Zero Networks is an automated, agentless microsegmentation platform. It learns how your network is used, builds least-privilege rules, closes admin ports behind just-in-time MFA and restricts privileged accounts. Forever Systems supplies Network Segmentation, Identity Segmentation, OT/IoT segmentation and Zero Networks Connect remote access, licensed per server, workstation, OT device or Connect licence and billed monthly.
What Zero Networks does
Once an attacker or a piece of ransomware has a foothold on one machine, the damage usually comes from what happens next: moving sideways to other workstations and servers over remote management protocols such as RDP, SMB, WinRM and RPC, using stolen admin credentials. Microsegmentation stops that by allowing each device to talk only to what it genuinely needs. Traditionally it has been hard to do, needing agents on every machine, months of rule writing and network redesign.
Zero Networks automates the job. Its platform:
- Learns first: it observes real network connections over a learning period of around 30 days and builds rules from actual traffic, rather than from asset tags or manual grouping, and proposed rules can be modelled against real traffic before they are enforced
- Enforces without agents: policy is applied using the host-based firewalls already built into your devices, and switch access control lists for devices that cannot be touched, such as OT equipment
- Closes admin ports by default: privileged protocols stay blocked until a user passes just-in-time multi-factor authentication, then open for a limited time to approved assets only
- Restricts identities: admin and service accounts are limited to the machines and logon types they actually need
The same platform also provides remote access, so staff and suppliers can connect without a VPN exposed to the internet.
The Zero Networks products we supply
| Product | What it protects | Licensing unit |
|---|---|---|
| Network Segmentation | Network traffic between workstations and servers, with MFA on admin ports | Per workstation or per server |
| Identity Segmentation | Admin and service account logons on workstations and servers | Per workstation or per server endpoint |
| OT and IoT segmentation | Operational technology and IoT devices that cannot run agents | Per device |
| Zero Networks Connect | Remote access for staff and third parties, with no open inbound ports | Per Connect licence |
The products share one console and policy engine, so most organisations start with network segmentation on their servers and add workstations, identity segmentation and remote access over time.
How Zero Networks is licensed
Zero Networks licences are counted by what you protect, and each product is billed monthly on your Forever Systems invoice:
- Servers and workstations are licensed separately for Network Segmentation and for Identity Segmentation, because servers typically carry more sensitive services and admin access
- OT and IoT devices are licensed per device segmented
- Connect is licensed per licence, sized to the people who need remote access
You do not have to protect everything at once. A common starting point is domain controllers and critical servers, which is where lateral movement does most harm. Pricing depends on the mix of servers, workstations, devices and users, so ask us for a quote. See per-user vs per-device licensing for how mixed licence models work.
Buying Zero Networks through Forever Systems
Segmentation changes how your network behaves, so the project matters as much as the licence. When you buy through us we:
- Scope: count servers, workstations and OT devices and agree what should be segmented first.
- Deploy: connect Zero Networks to your environment and identity provider and start the learning period.
- Review rules: go through the proposed policies with you before anything is enforced.
- Enforce in stages: move groups of assets into protection and switch on MFA for admin access.
- Run it: handle exceptions, new assets and licence changes as your estate grows.
Zero Networks sits on the same account and invoice as the rest of your software, and you can add servers, workstations or Connect users without a new contract.
Who Zero Networks suits
Zero Networks suits organisations with a Windows domain and a meaningful number of servers, those whose cyber insurer or auditor is asking about MFA for privileged access and lateral movement controls, manufacturers and others with OT networks to separate from IT, and anyone wanting to retire an internet-facing VPN. It complements rather than replaces endpoint protection: see EDR, XDR and MDR products. For other zero trust access options, browse SASE, ZTNA and business VPN and identity, MFA and privileged access.
Explore Zero Networks
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Zero Networks need an agent on every device?
No. Zero Networks is agentless for segmentation: it manages the host-based firewalls already on your machines and, for OT devices, uses access control lists on your existing switches. Zero Networks Connect uses a lightweight client for remote users.
How is Zero Networks licensed?
Network Segmentation and Identity Segmentation are licensed per workstation and per server, OT and IoT segmentation per device, and Connect per licence. All are billed monthly through Forever Systems.
Will segmentation break our applications?
Zero Networks learns real traffic for around 30 days and builds rules from what it sees, and we review those rules with you before enforcement, which keeps the risk of blocking legitimate traffic low.
What is just-in-time MFA?
Admin ports such as RDP, SSH and WinRM stay closed until a user completes multi-factor authentication. The port then opens for a limited time to approved assets and closes again automatically.
Can we start with just our servers?
Yes. Many organisations start with domain controllers and critical servers, then extend to workstations, identity segmentation and remote access.