What should organisations prioritise first, segmentation or identity-based access control?

Prioritise identity-based access control when your environment is defined by cloud workloads, service accounts, and machine identities that move faster than network boundaries. Segmentation still matters, but identity gives policy a stable reference point for who or what should be allowed to connect. That makes least privilege easier to enforce and easier to audit.

Why Prioritisation Usually Starts with Identity

When environments are built around cloud workloads, service accounts, and API-driven automation, identity-based access control usually gives the first meaningful reduction in exposure. Segmentation still matters, but it is easier to enforce a least-privilege policy when access decisions are tied to a stable identity rather than to shifting network locations. That is why identity policy often becomes the more durable control plane for modern estates.

Identity also scales better across hybrid and multi-cloud systems, where traffic paths change faster than firewall rules can be safely maintained. The practical aim is not to replace segmentation, but to stop granting access on assumptions that the network perimeter will stay meaningful. The Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which shows how quickly access creep becomes the real problem when identity is not the first control to tighten.

In practice, teams usually discover that the network was never the strongest trust boundary after an access review, an audit, or a credential incident exposes how much authority had already accumulated.

How the Two Controls Work Together in Practice

Identity-based access control answers the question, “Should this principal be allowed to act?” Segmentation answers, “Even if it is allowed, where should that action be reachable?” In other words, identity sets the permission boundary, while segmentation narrows blast radius. For cloud workloads and machine identities, that order matters because the identity is the stable object you can govern, rotate, revoke, and audit consistently.

A sensible implementation sequence is to start with the identities that can reach the most sensitive systems, then apply segmentation where lateral movement or broad east-west access would create unacceptable blast radius. That usually means service accounts, automation roles, API keys, and workload identities first, then network controls for shared platforms, legacy systems, and high-value segments. The most effective model is policy based on who or what the workload is, combined with network constraints on where it may connect.

Use identity to define least privilege at the principal level, not just at the subnet level.
Use segmentation to constrain high-value zones, shared services, and legacy dependencies.
Audit access against identity ownership and lifecycle, including revocation and rotation.
Measure whether network rules are still doing useful work, or only preserving old trust assumptions.

The same NHIMG guide reports that only 5.7% of organisations have full visibility into their service accounts, which is a strong signal that identity governance is often the weaker starting point. These controls tend to break down when teams rely on static network zones for systems that already authenticate and authorise at the application layer.

Common Variations and Edge Cases

Tighter identity control often increases operational overhead, so organisations have to balance access precision against administrative cost and change velocity. That trade-off becomes sharper in legacy estates, industrial networks, and environments with flat internal addressing, where segmentation may still provide the fastest containment gain even if identity is the longer-term answer.

Current guidance suggests using segmentation first only when identity is immature, impossible to integrate, or too inconsistent to support reliable enforcement. In those cases, network boundaries can buy time and reduce exposure, but they should not become the final trust model. The better long-term pattern is to make segmentation reinforce identity decisions, not substitute for them.

Another edge case is third-party or cross-environment access, where network placement alone gives a false sense of control. If a principal can authenticate from anywhere, the question is not whether it sits inside a segment, but whether its authority is narrowly bounded enough to survive compromise. Organisations that treat segmentation as the primary answer in these cases often end up with brittle rules and unclear ownership of access exceptions.

Risk and Threat Considerations

The main risk is misplaced trust: if organisations prioritise segmentation before identity in identity-heavy environments, they may protect the network while leaving over-privileged principals untouched. That creates a weak control posture because an authenticated principal can often move across environments without needing to defeat perimeter controls first.

Failure mechanism: Attackers commonly abuse stolen credentials, service accounts, or API keys to operate as legitimate principals. Once access is obtained, weak identity governance can make lateral movement, privilege expansion, and unauthorized data access easier than attempting to break network segmentation directly.

Impact: The result is wider blast radius, slower detection of misuse, and harder revocation after compromise. Organisations can end up with access paths that are technically segmented but still effectively open because the identity layer was not controlled tightly enough.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-01 — Identity and Credential Lifecycle	Identity-first access control depends on governing non-human credential lifecycle and revocation.
	NHI-03 — Authorization and Least Privilege	The question is about which control best enforces least privilege in modern environments.
	NHI-08 — Visibility and Monitoring	Identity-based control only works when principals and their access paths are visible and auditable.
Recommendation — Govern service account and workload credential lifecycle before relying on network boundaries. Apply least-privilege authorization to every workload and machine identity. Inventory non-human identities and monitor their access paths for anomalous use.
CIS Controls v8	5 — Account Management	Prioritising identity control maps directly to managing accounts, service accounts, and access review.
	6 — Access Control Management	Least privilege and access enforcement are the core decision in this comparison.
Recommendation — Inventory, govern, and remove unnecessary accounts and access paths first. Enforce least privilege at the identity layer before leaning on segmentation.
NIST Zero Trust (SP 800-207)	4 — Policy Engine and Policy Administrator	Identity-based access control is central to policy-driven Zero Trust decisions.
Recommendation — Use policy-driven identity decisions as the primary access enforcement point.

Practitioner Guidance

What to prioritise: Start with identity-based access control when workloads, automation, and machine identities are central to the environment. Use segmentation as the containment layer around high-value systems, not as the primary trust model for modern application access.

Decision rule: If a principal can authenticate across multiple environments or automate actions at scale, tighten identity governance first; if a system cannot support reliable identity enforcement, use segmentation as a compensating control while you reduce that dependency.

What to verify: Confirm that service accounts, API keys, and workload identities are owned, revocable, and reviewed on a lifecycle basis, and that network segmentation still maps to a real security objective rather than inherited topology.

Practitioner takeaway: The best first control is the one that reduces the most authority with the least ambiguity, and in modern environments that is usually identity, with segmentation used to contain what identity cannot fully prevent.