Walk into many older plants and you find one big network where every controller, operator station, historian, and field device shares the same address range and can talk to every other device without anything in the way. That arrangement is called a flat network, and it grew up honestly because it is simple to install and simple to troubleshoot. The problem is that the same openness that makes it easy also means a single infected laptop or one runaway broadcast can reach the entire control system at once. This page explains what a flat OT network actually is, why so many brownfield sites still run one, the specific ways it lets trouble spread, and the first practical moves toward breaking it up.
Flat network in one line: A flat network is an operational technology network with no internal segmentation, so every device sits in a single broadcast domain and can reach every other device directly, without passing through any firewall, router, or access-control boundary. It is risky because there is nothing to contain a problem: malware that lands on one machine can move laterally to all the rest, and a broadcast storm or misbehaving device can flood the whole network at once. The absence of internal boundaries means one foothold or one fault exposes the entire control system.
A network is flat when all of its devices share a single Layer 2 broadcast domain and a single IP subnet with no internal walls between them. Every PLC, HMI, RTU, historian, engineering workstation, and printer is reachable from every other one, and traffic between any two of them travels straight across the switches without ever crossing a router or firewall. There are no VLANs carving it into zones, no firewall rules deciding what may talk to what, and no separation between the control layer and whatever office or vendor equipment has been plugged in over the years. Everything is, in effect, in one room with the doors removed.
This is different from simply having a small network. A site can have hundreds of devices and still be flat if none of them are separated, and a site can have only a dozen devices yet be well segmented if those dozen are split into guarded zones. Flatness is about the absence of internal boundaries, not about size. It also tends to grow quietly: a network that started as a handful of controllers on one switch gets a second switch, then a third, then a link back to the business LAN, and because each addition just extends the same subnet the flatness is preserved even as the footprint expands.
The defining property of a flat network is that reachability is universal by default. Any device can open a connection to any other, any broadcast frame is heard by everything, and any protocol that discovers peers by flooding the wire finds every device on the site. That universal reachability is exactly what makes a flat network convenient to build and dangerous to run, because convenience and exposure are two sides of the same coin here.
Flat networks are the natural result of how control systems are actually built over time rather than a decision anyone consciously made. When a plant was first automated, the network was small and the priority was getting the process running, so everything went on one subnet because that was fastest and there was no obvious reason to complicate it. Segmentation adds switches that must be managed, addressing schemes that must be planned, and firewall rules that must be maintained, and none of that helps the process run on day one, so it gets skipped. The flat design is not laziness so much as the path of least resistance under schedule pressure.
Once the plant is running, the flatness becomes very hard to unwind, which is why brownfield sites in particular stay flat for decades. Re-addressing live controllers or moving them into new zones risks interrupting production, and in many facilities you cannot simply take the process down to reorganise the network. Institutional knowledge fades too, so nobody is fully certain which device talks to which, and that uncertainty makes anyone reluctant to introduce a boundary that might silently block a connection the process depends on. The safest-feeling choice, ironically, is to leave the open network exactly as it is.
Layered on top of this is the way outside connections accumulate. A vendor needs remote access for a support contract, so a link is added. The business side wants production numbers, so the historian is bridged to the office LAN. A new skid arrives pre-wired to expect everything on one subnet. Each of these is reasonable in isolation, and each one is easiest to satisfy by extending the existing flat network rather than by building a properly bounded connection. The cumulative effect is a large, flat control network with several doors to the outside world and no internal walls, which is precisely the shape attackers and worms find most rewarding.
The clearest danger of a flat network is lateral movement. Because every device can reach every other, an attacker or a piece of malware that gains a foothold on one machine, say an engineering laptop or a poorly patched Windows historian, can then scan and connect to everything else with nothing to stop it. Several of the most damaging industrial malware incidents spread this way, jumping controller to controller across networks that had no internal boundaries to slow them. A worm that would be contained to a single zone on a segmented network instead reaches every reachable device on a flat one, and on a flat network everything is reachable.
The second danger is purely operational and needs no attacker at all. On a single broadcast domain, every broadcast frame is delivered to every device, so a cabling loop, a failed switch, or a chatty device can produce a broadcast storm that floods the whole network and drives every controller's network interface into overload at the same time. A flat network gives such a storm no firebreak, so what might have been a local nuisance becomes a plant-wide communications outage. The same universality that lets malware roam lets a broadcast flood saturate everything at once.
The first practical steps toward fixing this do not require ripping the network apart. The usual starting point is to draw an accurate map of which devices actually communicate, because you cannot safely place a boundary until you know what traffic must cross it, and passive traffic monitoring is a low-risk way to build that picture on a live system. From there the highest-value single boundary is almost always separating the control network from the business and outside world with a firewall, often through a demilitarized zone that holds the shared servers like the historian, so nothing on the office side reaches controllers directly. Once that outer wall exists, the interior can be broken into zones with VLANs at a pace the process tolerates, and even a first coarse split, control on one side and everything else on the other, sharply reduces the blast radius compared with leaving the network completely flat.
No, they are almost opposites. A flat network is one internal network with no segmentation, where every device can reach every other, and it usually has connections out to the business LAN or the internet as well. An air-gapped network is one that has no connection at all to outside networks. A network can be both flat and air-gapped, but the term flat describes the lack of internal boundaries, while air-gapped describes the lack of external ones, and in practice most plants that people call air-gapped turn out to have connections they had forgotten about.
A very small, genuinely isolated site with a handful of devices and no outside connections carries far less risk than a large one, but flatness is still a liability the moment any external link appears, because there is nothing inside to contain what comes through it. The most valuable first boundary at any site, regardless of size, is separating the control devices from any business or remote-access connection with a firewall. Internal zoning matters more as the device count and the number of outside links grow, so a tiny truly-isolated network is the one case where staying flat is defensible.
They are related but not the same. A firewall controls traffic crossing between networks, so a network with no firewall typically has an open path to whatever is on the other side of that missing firewall, such as the business LAN. Flatness describes the internal structure: even behind a firewall, a network is flat if all its internal devices sit on one subnet with no VLANs or internal boundaries between them. Fixing flatness fully means both putting a firewall at the edge and segmenting the interior, because the edge firewall alone does nothing to slow a threat that is already inside.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.