StarLabs Glossary / Cybersecurity & Network Terms
VLAN (Virtual LAN)
One physical office network, split into separate zones that cannot freely talk to each other.
A VLAN (virtual local area network) is a way of dividing one physical network into several separate logical networks using the same switches, cables and Wi-Fi access points. Devices in one VLAN, such as guest phones, cannot reach devices in another, such as the accounts PC, unless a firewall rule allows it.
How it works
In a basic office network, every device sits on the same flat network. The receptionist’s laptop, the CCTV recorder, the smart TV, a visitor’s phone and the file server can all see each other. If any one of them is infected, the attacker can reach everything else.
A VLAN fixes this by tagging network traffic with a VLAN number. Managed switches and access points read the tag and keep each group separate, as if they were plugged into different switches. Traffic only passes between VLANs through a router or firewall, where you decide what is allowed.
A typical small-office layout looks like this:
| VLAN | Who or what is on it | Typical rule |
|---|---|---|
| Staff | Company laptops and desktops | Can reach servers, printers and the internet |
| Servers | File server, NAS, accounting system | Accepts connections only from staff devices |
| Guest Wi-Fi | Visitors and personal phones | Internet only, nothing internal |
| Devices / IoT | CCTV, door access, printers, smart TVs | Limited access; cannot start connections to staff PCs |
| Voice | IP desk phones | Prioritised so calls stay clear |
To use VLANs you need equipment that supports them: managed switches, business-grade access points and a router or firewall that can route and filter between VLANs. Most consumer routers supplied with home broadband plans cannot do this properly.
What it means for your business
VLANs are one of the most cost-effective security upgrades for an office network. They keep guests off your internal systems, stop a hacked camera or printer becoming a route to your files, and limit how far ransomware can spread. Network segmentation is also something CSA’s Cyber Trust mark and its OT security guidance look for. StarLabs designs and sets up office networks with sensible VLANs, firewall rules and Wi-Fi to match.
Common questions
Is a guest Wi-Fi network the same as a VLAN?
A properly isolated guest Wi-Fi is usually built using a VLAN. Some cheaper routers offer a “guest” network that is not fully separated, so it is worth checking.
Do VLANs slow the network down?
Not noticeably on modern business equipment. They can actually improve performance by reducing unnecessary broadcast traffic and letting you prioritise voice calls.
What is the difference between a VLAN and a VPN?
A VLAN separates devices inside your office network. A VPN creates a secure tunnel for people or sites connecting to your network over the internet.
Is your office network one big flat network?
StarLabs can segment it so guests and gadgets stay away from your data.
Sources: CSA press release, 15 April 2025, CSA Cyber Trust and Cyber Essentials infographic
Reviewed by the StarLabs technical team · Last checked 18 October 2026
← Cybersecurity & Network Terms · ← All terms · Common questions
