Along these lines, overlay VPNs can be used behind the firewall to segment the internal network, e.g. to isolate developers -- finance -- task workers. This limits the scope of any breach and makes it easier to contextualize activity.