Once you decide an OT network needs to be broken into zones, there are two fundamentally different ways to draw the walls: build them out of separate hardware, or build them out of configuration on shared hardware. The first is physical segmentation, where a zone gets its own switches and its own cabling; the second is logical segmentation, where zones are created with VLANs and firewall rules on equipment that others also use. Both keep traffic in one zone from freely reaching another, but they differ sharply in strength, cost, and flexibility. This page compares the two methods head to head and shows how real designs layer them together.
Physical vs logical segmentation in one line: Physical segmentation separates networks using distinct hardware, meaning each segment has its own switches and its own cabling with no shared equipment, so the only way traffic crosses between them is through a deliberate connection point. Logical segmentation separates networks using configuration on shared hardware, primarily VLANs that divide one switch into isolated virtual networks and firewall rules that control what crosses between zones. Physical separation is stronger and simpler to reason about but costs more in hardware and is less flexible, while logical separation is cheaper and far more flexible but depends on configuration being correct and equipment being trustworthy.
Physical segmentation means that separate networks are built from separate equipment, full stop. Each segment has its own switches, its own cabling, and its own physical infrastructure, and there is no shared device that any two segments both depend on. If a control network and a business network are physically segmented, they are two distinct sets of hardware, and a frame simply has no path from one to the other unless someone has deliberately installed a connection between them, such as a firewall or a data broker, at a controlled point. The strongest form of physical separation is the air gap, where there is no connection at all.
The great strength of physical segmentation is that its isolation does not depend on configuration being correct. A VLAN keeps traffic apart only as long as every switch is configured properly and nothing is misconfigured or compromised; a physical gap keeps traffic apart because the wires are not there, and no software mistake can create a path that does not physically exist. This makes physically separated networks much easier to reason about and to trust, and it is why the most safety-critical systems, such as certain protection and shutdown networks, are often kept on entirely separate hardware from everything else, so that no failure or attack on the general network can reach them.
The cost of that strength is money and rigidity. Duplicating switches, cabling, and sometimes entire runs of infrastructure for each segment is expensive, and it grows more expensive as the number of segments rises, so full physical separation for many fine-grained zones is often impractical. It is also inflexible: moving a device from one segment to another, or creating a new zone, can mean pulling new cable and installing new hardware rather than changing a setting. And there is a subtle trap, which is that any connection added between two physically separate networks, a single cable, a dual-homed server, a maintenance laptop bridging both, quietly undoes the separation, so physical segmentation only holds as long as its discipline is maintained.
Logical segmentation creates separate networks out of configuration on shared hardware rather than out of separate hardware. The core tool is the VLAN, which lets a single managed switch, or a set of them, carve its ports into several virtual networks that behave as if they were physically separate even though they share the same switch. Devices on different VLANs cannot reach each other at the Layer 2 level even though they are plugged into the same switch, and traffic that needs to cross between VLANs is forced through a controlled point, typically a firewall or a router with rules, where it can be inspected and permitted or denied. Firewall zones then define what is allowed to cross between the segments.
The advantages of logical segmentation are cost and flexibility. Because it reuses existing switches, you can create many zones without buying a parallel set of hardware for each, which makes fine-grained segmentation economically realistic in a way that physical separation of the same number of zones would not be. It is also flexible: moving a device to a different zone or creating a new zone is a configuration change on the switch rather than a cabling job, so the segmentation can evolve with the plant. This is why logical segmentation is the workhorse method for dividing the interior of an OT network into functional zones, where the sheer number of desired boundaries makes physical separation impractical.
The trade is that logical segmentation is only as good as its configuration and the equipment enforcing it. A VLAN provides no isolation if a switch is misconfigured, and shared hardware means a compromise or fault in the switch itself can potentially affect multiple segments at once, since they all live on the same device. Logical separation also does not protect against everything physical separation does; a serious flaw in the shared switch's software, for instance, could in principle let traffic leak between VLANs that a physical gap would have made impossible. For these reasons logical segmentation demands disciplined configuration management, backups of switch settings, and trust in the hardware, and it is generally treated as strong containment rather than as the absolute guarantee an air gap provides.
In practice the two methods are not a choice between one or the other but a spectrum that good designs combine, matching the strength of the boundary to the importance of what it protects. A common pattern is to use physical separation for the highest-stakes and outermost divisions and logical separation for the many finer divisions inside them. The connection between the control network and the outside world, for example, is frequently a hard boundary enforced by dedicated firewall hardware and often a physically separate demilitarized zone, because that is the boundary most worth making unambiguous, while the interior of the control network is then divided into functional zones with VLANs because there are too many such zones to justify separate hardware for each.
Safety and criticality push specific systems toward the physical end of the spectrum regardless of cost. A safety instrumented system or a critical protection network is a case where designers often accept the expense of separate switches and cabling so that the isolation cannot be undone by a configuration error, because the consequence of that system being reached is severe enough to justify the strongest available separation. Meanwhile the routine operational zones, separating cameras from controllers from vendor equipment from the business reporting path, are almost always logical, because the goal there is containment and manageability rather than absolute guarantee, and VLANs deliver that at a fraction of the cost.
For a distributed SCADA operation feeding a cloud platform such as Merobix, this layering also shapes how remote sites connect back. The path from a remote site over the public internet or a carrier network is secured with encryption and firewall policy, a logical boundary, because you cannot run private cable to every well pad, while a critical local safety function at that site may still sit on its own separate hardware within the site. The useful way to think about it is that physical and logical segmentation are complementary layers rather than competitors: physical separation gives you boundaries that no software mistake can breach where the stakes justify the cost, logical segmentation gives you as many well-managed boundaries as the plant needs at a cost it can bear, and a well-designed OT network uses each where its particular strengths fit, then keeps both under the configuration discipline and monitoring that make any segmentation trustworthy over time.
A well-configured VLAN provides strong isolation, but it is not equivalent to physical separation, because a VLAN's isolation depends on the switch being configured correctly and its software being sound, whereas a physical gap has no path at all for traffic to cross. In most operational zoning, VLANs are considered good enough and are the practical choice given cost and flexibility. For the highest-stakes systems, such as safety or protection networks, many designers still prefer physical separation precisely because it cannot be undone by a configuration mistake or a switch compromise, which a VLAN in principle could be.
Choose physical segmentation for the boundaries where the consequence of a breach is most severe and where you want isolation that no software error can defeat, such as separating a safety instrumented system or a critical protection network from the general network, and often for the outermost boundary between the control system and the outside world. Choose logical segmentation for the many interior functional zones where the goal is containment and manageability and where separate hardware for every zone would be impractical and expensive. Most real networks use physical separation sparingly for the critical boundaries and logical separation broadly for everything else.
Yes, and this is one of the main ways physical separation quietly fails in practice. If a server has one interface on each of two physically separate networks and is configured or compromised to forward traffic between them, it creates a path between networks that were supposed to have none, undoing the separation without any cable being run between the two networks directly. This is why physically separated networks must be guarded against inadvertent connections of every kind, including dual-homed hosts, maintenance laptops plugged into both, and stray cables, since any one of them can breach a gap that the infrastructure itself preserves.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.