---
title: "The warehouse tablet can reach the finance server"
url: "https://sovereos.com/blog/the-warehouse-tablet-can-reach-the-finance-server"
description: "Networks built one device at a time end up flat: every printer, camera and guest can talk to everything. How that fails, and what a designed network looks like."
---

# The warehouse tablet can reach the finance server

October 8, 2026·3 min read·Editorial team

A young network technician sorts colour-coded patch cables in an open server rack, with a laptop and a coiled green cable on a cart beside him.

Picture a forty-person distributor. The warehouse has rugged tablets for picking orders. The office has a file server with the finance share on it. Reception has guest Wi-Fi with its own name and password. There is a recorder for the security cameras, three printers, a screen in the meeting room and a door controller somebody installed when the company moved in.

Now ask a simple question: can the warehouse tablet open a connection to the finance server? In a network that was built by addition, the answer is almost always yes. Not because anybody allowed it, but because nobody ever said no.

The cause is not negligence. A single flat network is what you get by default when nobody designs one: each device is plugged into the nearest free port, gets an address, and works. That is exactly the problem. Nothing breaks, so nothing tells you.

## How flat networks fail

**One weak device reaches everything.** A printer on old firmware, a camera still on its factory password, a laptop that opened the wrong attachment. On a flat network any of them is a foothold with a view of the whole estate, and ransomware spreads along precisely these open paths.

**Guest Wi-Fi that is not a guest network.** A separate network name on the same underlying network is a convenience, not a boundary. Visitors, contractors and their infected phones sit next to your servers.

**Devices nobody manages.** Cameras, door controllers, meeting room screens, the building’s heating controller. They are computers, rarely updated, often installed and maintained by another supplier, and usually invisible to whoever looks after the laptops.

**Remote access through one hole.** A port forwarded on the router years ago so a supplier could connect, or a single remote access appliance everybody depends on, often with its own accounts that never appear in the company directory and never get removed when people leave.

**No map.** Nobody can say what talks to what. Without that, nobody can tell normal traffic from abnormal, and every change to the network is a careful guess.

## What a designed network looks like

The fix is not exotic equipment. Most business-grade switches, access points and firewalls can do everything below. What is missing is the design and the decision.

**Zones by purpose.** Staff devices, servers, guests, unmanaged devices such as cameras, printers and screens, and the management interfaces of the network itself. Each gets its own segment.

**Default deny between zones.** Traffic between segments is allowed by rule, and each rule has a reason written next to it. The warehouse tablet needs the stock system. It does not need the finance share, and now it cannot reach it.

**Unmanaged devices in a pen.** A camera reaches its recorder. A printer receives print jobs. Neither needs to start a conversation with anything else, and neither should be able to.

**Remote access tied to identity.** Access is granted per person and per application through the company directory, with a second factor, so a leaver loses it together with everything else and no port stays open for a supplier who finished their project long ago. This is one more reason [identity is the real lock-in](https://sovereos.com/blog/identity-is-the-real-lock-in): whoever controls the directory controls who gets in from outside.

**A map that is kept up to date.** One diagram and one list of rules, updated whenever anything changes. It is the first document the next engineer will need, and the one that lets you [replace a supplier](https://sovereos.com/blog/nobody-can-price-the-exit) without archaeology.

## Do it in stages

Segmenting a live network in one weekend is how companies discover which undocumented dependency the accounting software had. The order that works: watch the traffic first and write down what actually talks to what; create the zones and move devices into them with permissive rules; then tighten one rule at a time, during working hours, with somebody on hand to notice what stopped.

It is slower than a big-bang cutover, and it is the version that does not end with the old flat network quietly restored on Monday morning because the invoices would not print. The network is one of the layers in our approach to [owned IT for mid-sized companies](https://sovereos.com/), and it is usually the one with the most surprises.

## A test for this afternoon

Two checks, half an hour in total.

First, connect a laptop to the guest Wi-Fi and try to open the file server’s address, or the admin page of one of the printers. If either answers, guests are on your office network.

Second, log in to the router or firewall and list every port forward and every remote access account. Next to each one, write who asked for it and whether they still need it. Any line you cannot fill in is the first rule you get to delete.

-   network segmentation
-   remote access
-   IoT
-   security

## Keep reading

-   [How to build an agent factory for company IT, stage by stage](https://sovereos.com/blog/how-to-build-an-agent-factory-for-company-it)
-   [Your agent factory runs at a vendor. Who owns what it learns?](https://sovereos.com/blog/who-owns-your-agent-factory)