diff --git a/pkg/io/confio/sg.go b/pkg/io/confio/sg.go
index cadf8232..a96bd8ba 100644
--- a/pkg/io/confio/sg.go
+++ b/pkg/io/confio/sg.go
@@ -53,7 +53,7 @@ func sgRemote(nameToSGRemoteRef map[string]*vpcv1.SecurityGroupRuleRemoteSecurit
 	st := rule.Remote.String()
 	switch t := rule.Remote.(type) {
 	case *netset.IPBlock:
-		if t.Size() == 1 { // single IP address
+		if ipString := t.ToIPAddressString(); ipString != "" { // single IP address
 			return &vpcv1.SecurityGroupRuleRemoteIP{
 				Address: &st,
 			}
diff --git a/pkg/io/csvio/sg.go b/pkg/io/csvio/sg.go
index aa320afe..1d680572 100644
--- a/pkg/io/csvio/sg.go
+++ b/pkg/io/csvio/sg.go
@@ -74,7 +74,7 @@ func sgPort(p interval.Interval) string {
 func sgRemoteType(t ir.RemoteType) string {
 	switch t := t.(type) {
 	case *netset.IPBlock:
-		if t.Size() == 1 {
+		if ipString := t.ToIPAddressString(); ipString != "" {
 			return "IP address"
 		}
 		return "CIDR block"
diff --git a/pkg/io/mdio/sg.go b/pkg/io/mdio/sg.go
index 8535fb19..53b519e3 100644
--- a/pkg/io/mdio/sg.go
+++ b/pkg/io/mdio/sg.go
@@ -88,7 +88,7 @@ func sGPort(p interval.Interval) string {
 func sGRemoteType(t ir.RemoteType) string {
 	switch t := t.(type) {
 	case *netset.IPBlock:
-		if t.Size() == 1 {
+		if ipString := t.ToIPAddressString(); ipString != "" {
 			return "IP address"
 		}
 		return "CIDR block"