Teams should choose based on where trust decisions can be enforced most reliably. Micro-segmentation can work in smaller, static environments, while software-defined perimeters fit traditional boundary models. Identity governance and IAM scale better in cloud and SaaS settings because they verify identity continuously, automate provisioning, and support least privilege without relying on network fences.
How to choose the control by trust boundary
The practical choice starts with where enforcement can happen consistently. Micro-segmentation is strongest when east-west traffic is the main control point and the environment is stable enough to model tightly. Software-defined perimeters work when you want to hide services until a trust decision is made. Identity governance becomes the better default when access must follow the person, workload, or application across cloud and SaaS.
That is why Zero Trust Architecture is not a single product decision. It is an enforcement design decision: network controls protect reachable paths, while identity governance controls who or what should be allowed to reach them at all. In modern environments, NIST SP 800-207 Zero Trust Architecture is useful because it frames trust as an explicit policy problem, not a perimeter assumption.
Ultimate Guide to NHIs is relevant here because the same trust decision often applies to non-human access that must be governed across systems, not just contained on the network.
Where each approach fits operationally
Micro-segmentation is most effective when you can define relatively static zones, inspect traffic paths, and tolerate some operational overhead to get tight lateral-movement control. It is a strong fit for smaller estates, regulated enclaves, or workloads with clear communication patterns. The trade-off is that it can become brittle when the application map changes often.
Software-defined perimeters fit a traditional boundary model better. They reduce exposure by making resources effectively invisible until a policy decision is satisfied, which can simplify access to specific applications or environments. The limitation is that they still depend on a network-centric view of trust, so they are less complete when users and services move fluidly across cloud and SaaS.
Identity governance and IAM scale best when trust needs to follow the subject rather than the subnet. Continuous verification, provisioning, recertification, and least-privilege enforcement are easier to operationalise when the control plane is identity-first. For that reason, the 2026 Infrastructure Identity Survey is useful as a current signal that organisations are pushing access decisions toward identity governance and least privilege.
For teams building cloud and SaaS Zero Trust, NHI lifecycle management and key NHI risks are useful complements because they show why access review, rotation, and offboarding matter once identities become the real enforcement surface.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207), NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC — Identity Management, Authentication and Access Control | Zero Trust control choice hinges on how access is enforced and least privilege is maintained. |
| Recommendation — Map trust decisions to identity-driven access controls and revoke unnecessary access paths. | ||
| NIST Zero Trust (SP 800-207) | AC-1 — Policy Enforcement Point and Access Control | Zero Trust Architecture depends on policy enforcement at the point of access. |
| Recommendation — Place enforcement where trust can be checked continuously before granting access. | ||
| NIST SP 800-63 | IAL/AAL/FAL — Identity Assurance, Authenticator Assurance and Federation Assurance | Identity governance in Zero Trust depends on strong identity and authentication assurance. |
| Recommendation — Use higher assurance authenticators and federation controls for access decisions. | ||
| CIS Controls v8 | 6 — Access Control Management | Choosing identity governance requires consistent provisioning, review and revocation controls. |
| Recommendation — Implement access review and revocation processes to keep privileges current. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Secret Management | Cloud and SaaS Zero Trust often fails when machine access still depends on unmanaged secrets. |
| Recommendation — Inventory and rotate machine secrets so identity decisions remain enforceable. | ||
Practitioner Guidance
What to prioritise: Start by mapping which control can actually deny access at the point of decision. If the application is reachable mainly through well-defined network paths, segmentation or an SDP-style model may be enough; if the bigger problem is persistent entitlement sprawl, stale access, or cross-platform access review, identity governance should lead.
What to verify: Do not assume a network control is stronger just because it is more visible. Verify whether policy can still be enforced when users shift locations, services scale up, or SaaS and cloud integrations change faster than network zones can be redesigned. If the answer is no, identity-first controls should carry the load.
Practitioner takeaway: The right Zero Trust mix is usually not either-or, but choosing the control plane that most reliably expresses and revokes trust for the environment you actually operate.
Related resources from NHI Mgmt Group
- How should security teams choose between Zero Trust and Defense in Depth for identity governance?
- What do security teams get wrong about Zero Trust and identity governance?
- How should security teams choose between network-level access tools and application-layer zero trust controls?
- How should security teams design a Zero Trust identity architecture around continuous verification instead of static access rules?
