Designed & Built by Tory Keit — Systems IT Architect Lead
An interactive, mobile-first tool that answers a deceptively hard question: is your network segmentation actually holding? Tap to verify whether an isolation boundary that should never exist is quietly open — and see the exact rule responsible.
Live demo: https://wonderful-pond-04427e40f.7.azurestaticapps.net
Network segmentation is a core control in Zero Trust, PCI-DSS, NIST, and FedRAMP. But segmentation silently decays: a "temporary" rule for a late-night debug, an exception that outlives its ticket, a jumpbox rule scoped a little too broadly. The diagram still looks correct, but a path is quietly open — and nobody knows until an incident. Verifying it by hand means reasoning through layered NSG rules, priorities, and allow/deny overlaps across an entire environment.
Azure Network Watcher — IP Flow Verify. Instead of manually auditing NSG rules, Azure evaluates the effective ruleset and returns a definitive Allowed / Denied verdict for any source, destination, port, and direction — and names the exact rule that made the decision. Segmentation can be validated continuously and automatically, catching an open path before an attacker does.
- Models a tiered Azure network (Web / App / Data, plus a Management jumpbox).
- One tap runs an IP-Flow-Verify-style check across a boundary that should be closed.
- Animates the forbidden path: a packet travels from source to the Data tier, the tiers alarm red, and a bold ALLOWED verdict names the offending rule.
- Remediate & Re-verify removes the rogue rule and flips the verdict to DENIED — segmentation restored.
- Two scenarios: a blatant "temporary" RDP rule, and a subtler jumpbox over-reach that looks legitimate but bypasses tiering.
Illustrative modeled scenario — not connected to a live tenant. The environment is modeled; the capability (IP Flow Verify) and the workflow are real.
- Pure client-side (HTML/CSS/vanilla JS), no backend, no external libraries.
- Azure Static Web App, Free tier — zero infrastructure cost.
- Mobile-first: fluid sizing across phone sizes, portrait and landscape (rotate for a wider side-by-side view), touch-first controls.
Pairs with PathFinder (identity reachability) as its network-reachability counterpart, and with the Secure Landing Zone (the segmented network being validated).
Illustrative modeled scenario. Real Azure capability. Mobile-first. Runs on Azure free-tier.