Without internal segmentation, a successful intrusion can spread from one endpoint or server to many others because ZTNA does not govern east west traffic. Attackers can move laterally, reach sensitive data, and expand access beyond the original entry point. In practice, the failure is blast radius control: the environment still behaves like a connected flat network once an intruder is inside.
Why ZTNA Does Not Contain East West Movement on Its Own
ZTNA is strongest at controlling who can reach an application from outside a trust boundary. Once an attacker is already inside, that control no longer solves the internal movement problem unless the network is also segmented. The practical failure is that ZTNA can reduce initial exposure while leaving internal reachability largely unchanged.
That distinction matters because many organisations treat perimeter replacement as if it were also internal containment. It is not. Without segmentation, authenticated access to one internal system can still become a bridge to adjacent systems, management interfaces, file shares, databases, or services that were never meant to be broadly reachable.
For teams comparing trust-boundary controls, ZTNA and internal segmentation address different layers of the attack path. ZTNA limits ingress to specific applications or services, while segmentation constrains what an already-present actor can enumerate, connect to, or pivot toward. NIST SP 800-207 Zero Trust Architecture is useful here because it emphasises least privilege and explicit policy, but those ideas still need internal enforcement to limit lateral movement. For workload-to-workload environments, the same principle is reflected in Guide to SPIFFE and SPIRE, which ties identity-based service access to strong east west controls.
What Fails Operationally When the Internal Network Stays Flat
When segmentation is absent, the internal environment behaves like a broad connected zone rather than a set of bounded compartments. That means a single compromised endpoint, server, or application account can expose far more of the environment than its business function requires. The issue is not only reachability, but also the ease of discovery: once inside, attackers can map services, probe open ports, and find paths that were never intended for routine users.
Flat internal networks also weaken containment during incidents. If logs, shares, admin tools, backup services, or adjacent subnets are reachable from the foothold, defenders often have to assume wider compromise sooner and isolate more aggressively. In practice, this increases response cost because the security team must validate far more internal paths before it can trust that movement has stopped.
ZTNA can still be valuable in this model, but only as one boundary control among several. It does not replace internal access zoning, and it does not convert an open east west environment into a segmented one. In environments with infrastructure or OT-style exposure, the segmentation expectation is even more explicit in NIST SP 800-82 Rev 3, OT Security Guide, which treats segmentation as a core containment and safety control. Broad control baselines such as NIST SP 800-53 Rev 5 Security and Privacy Controls also reinforce internal access control and configuration discipline as separate requirements, not assumptions embedded in remote access design.
Why Blast Radius, Not Perimeter, Becomes the Real Metric
The question to ask is not whether ZTNA reduced inbound exposure. It is whether the environment can still confine a compromised foothold to a small, observable zone. If the answer is no, then the main defect is blast radius control. Sensitive systems may remain one jump away from the original entry point, and a breach that should have been local can become cross-system compromise.
That is why practitioners often evaluate ZTNA success alongside segmentation, internal authorization boundaries, and service-to-service reachability. In mature designs, a compromised user session or host should not imply broad east west access by default. Ultimate Guide to NHIs, Standards is relevant when internal movement depends on workload or service credentials, because it frames identity and access controls as part of the same containment story rather than a separate topic.
Practitioner Guidance
What to verify: Test whether a foothold in one subnet or application tier can reach adjacent tiers, admin paths, backup systems, and data stores without additional segmentation controls. If it can, ZTNA is only limiting entry, not containment.
What changes at scale: The larger and flatter the environment, the more important it becomes to define internal trust zones by workload sensitivity and operational role, not just by user authentication state. Otherwise, one compromise becomes a discovery problem across the whole environment.
Practitioner takeaway: Treat ZTNA as an ingress control, not a lateral-movement control; if you care about blast radius, you still need internal segmentation and explicit east west policy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Internal segmentation and east west restriction are core information-flow controls. |
| SC-7 — Boundary Protection | ZTNA plus segmentation is a boundary-protection problem spanning internal and external paths. | |
| Recommendation — Enforce internal flow restrictions to limit lateral movement between trusted zones. Segment internal trust zones and restrict paths between them. | ||
| NIST Zero Trust (SP 800-207) | SC-7 — Resource Access as Authorized | Zero Trust requires explicit access decisions, but internal segmentation is still needed for containment. |
| Recommendation — Apply explicit policy to internal resource access and do not rely on perimeter trust. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Segmentation and network zoning are operational network controls that reduce blast radius. |
| Recommendation — Implement network segmentation to separate critical systems and limit reachability. | ||
| MITRE ATT&CK | T1021 — Remote Services | Lateral movement commonly exploits reachable internal services after initial access. |
| Recommendation — Hunt and restrict internal service paths used for lateral movement. | ||
Related resources from NHI Mgmt Group
- What breaks when organisations rely on default passwords and weak network segmentation for payment systems?
- What breaks when organisations rely on broad network access instead of workload-level segmentation?
- What breaks when organisations leave legacy technology on the network without segmentation?
- What breaks when organisations rely on traditional prevention and detection without segmentation?
