In short: Zero Networks Identity Segmentation discovers admin and service accounts, learns how they are used and restricts each one to the assets and logon types it needs, with just-in-time MFA for privileged access. It is agentless and aimed at attacks such as Pass the Ticket and Kerberoasting. Forever Systems licenses it per server and per workstation, billed monthly.
What Zero Networks Identity Segmentation is
Network segmentation controls which machines can talk to each other. Identity segmentation controls which accounts can log on where. Both matter, because most serious breaches involve stolen privileged credentials: a domain admin password or service account that works on every server becomes a master key.
Zero Networks Identity Segmentation discovers your admin, service and other non-human accounts, including accounts used by automation and AI agents, and flags inactive ones. It then learns how each account is actually used and restricts it to the assets and logon types it needs, revoking excessive logon rights. Admin logons are allowed where intended and blocked elsewhere, and privileged access to critical systems can require just-in-time MFA. Zero Networks positions this against credential attacks such as Pass the Ticket, Golden Ticket and Kerberoasting.
What is included
| Capability | What it does |
|---|---|
| Identity discovery | Finds admin, service and non-human accounts and how they are used |
| Inactive account detection | Highlights accounts that are no longer used and could be removed |
| Service account restriction | Limits service accounts to pre-approved assets and logon types |
| Admin logon control | Allows admin logons only where intended |
| Just-in-time MFA | Temporary, MFA-verified access to critical assets for privileged users |
| Automated policy | Rules built from around 30 days of learned behaviour |
| Agentless | No software to install on servers or workstations |
Zero Networks describes it as a way to augment privileged access management and as an alternative to building a tiered administration model by hand.
How it is licensed: servers and workstations
Identity Segmentation is licensed per protected endpoint, with servers and workstations as separate options.
| Option | Licensing unit | Typical use |
|---|---|---|
| Identity Segmentation for servers | Per server | Restrict admin and service accounts on servers, including domain controllers |
| Identity Segmentation for workstations | Per workstation | Stop privileged accounts being used on ordinary user devices, where credentials are most easily stolen |
Both are billed monthly on your Forever Systems invoice. Identity Segmentation can be bought on its own or alongside Network Segmentation, which uses the same console. Ask us for a quote.
Requirements and deployment
Identity Segmentation connects to your directory to discover accounts and logon activity. Like the rest of the Zero Networks platform it is agentless, and it follows the same pattern: discover, learn for around 30 days, review the proposed restrictions, then enforce.
Before enforcing, we work through the findings with you: accounts with more rights than they need, service accounts that log on interactively, and accounts nobody can explain. Some of those are best removed or tidied up in your directory before restrictions go on, which is also good housekeeping for audits. We confirm current directory and platform requirements against Zero Networks' documentation when we scope the project.
Who it suits and how we help
Identity Segmentation suits organisations with an Active Directory estate built up over years, many service accounts, admins who use powerful accounts for everyday work, or an insurer asking for MFA on all privileged access. It works well alongside a password or privileged access manager and directory security assessment tools such as Netwrix PingCastle.
We deploy it, review the account findings with you and handle enforcement and licence changes. Compare other options in identity, MFA and privileged access, or go back to the Zero Networks overview.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is identity segmentation?
It restricts which accounts can log on to which machines and how. Instead of a privileged account working everywhere, it works only on the assets it needs, which limits what an attacker can do with stolen credentials.
Does Zero Networks Identity Segmentation replace PAM?
Zero Networks positions it as a way to augment privileged access management rather than a full replacement. Many organisations use both.
Is Identity Segmentation licensed per user?
No. It is licensed per protected endpoint, with servers and workstations as separate options, billed monthly.
Do I need Network Segmentation as well?
No, but they complement each other. Network Segmentation controls traffic between machines; Identity Segmentation controls which accounts can log on to them.