Black Hat 2025 puts microsegmentation and defense in motion to the test

At a glance

What this is: Black Hat 2025 discussions highlighted that microsegmentation and defense-in-motion models are being pulled into focus because attack speed, lateral movement, and reactive operations still outpace many organisations' controls.

Why it matters: For IAM, NHI, and security teams, the key issue is that identity-based access and workload segmentation now have to work together to limit blast radius before detection catches up.

By the numbers:

• Global cybersecurity spending is projected to reach $212 billion this year, according to Zero Networks.
• Publicly reported data compromises increased around 11% year over year in the first half of 2025, according to Zero Networks.
• The average cost of a data breach has increased 15% globally in the last five years, according to Zero Networks.
• Only 5% of organisations currently leverage microsegmentation, according to Zero Networks.

Context

Black Hat 2025 was used here as a lens on a broader governance problem: many organisations still rely on detection-heavy security models even as attackers move faster than human response cycles. In a network built on cloud services, branch sites, workloads, and identities, containment has to happen before the blast radius expands.

Microsegmentation matters because it changes how access is allowed across East-West traffic, not just how threats are observed at the edge. That makes the topic relevant to IAM and NHI programmes as well, because identity-based access and workload-level privilege now converge in the same operational control plane.

Key questions

Q: What fails when organisations rely on prevention instead of containment?

A: Prevention-only strategies fail when an attacker gets past the first control, because broad connectivity and standing privilege let the incident spread faster than defenders can respond. Containment limits blast radius, protects critical services, and preserves operational continuity even when one identity, host, or supplier account is compromised.

Q: Why does microsegmentation reduce the impact of compromised credentials in hybrid environments?

A: Microsegmentation helps because credential theft alone should not grant broad east-west movement. By limiting which workloads, ports, and applications can talk to each other, teams shrink the paths an attacker can use after initial access. That matters most in hybrid estates where perimeter defenses are no longer enough and internal trust assumptions are easier for attackers to exploit.

Q: What are the signs that a network security model is too reactive?

A: Common signs include heavy reliance on alerts, long investigation cycles, broad internal reach, and control gaps between user access and workload access. If defenders only learn about compromise after internal movement has started, the model is reactive rather than containment-led.

Q: How should teams govern identities when access is managed through a shared platform?

A: Teams should govern the shared services first, then the products that consume them. That means one model for audit, lifecycle, policy, and correlation across all identity types. If those services are inconsistent, product-level controls will drift and investigations will fragment across systems.

Technical breakdown

Why detection-first network security breaks down

Detection-first architectures assume defenders will observe malicious activity quickly enough to intervene before meaningful spread. In practice, breakout times can be measured in seconds while investigation and confirmation often take days, so the control gap is not visibility alone but response latency. Endpoint tooling can catch events, but it does not prevent an attacker from moving between internal assets once credentials, trust, or service pathways are available. That is why East-West control has become central to modern containment design. The article frames this as a shift away from chasing alerts and toward shrinking the reachable environment after initial compromise.

Practical implication: treat network containment as a primary control, not a recovery step after detection fails.

How microsegmentation constrains lateral movement and workload access

Microsegmentation divides the internal network into smaller policy zones so that a compromise in one workload does not automatically open paths to others. The important security effect is blast-radius reduction, especially in flat or highly connected environments where credentials and trust relationships otherwise create broad reach. Modern implementations combine automated tagging, deterministic policy generation, and identity-based access controls so rules can follow workloads as they move. That matters because static perimeter rules age poorly in hybrid environments. For NHI and workload identity programmes, the same logic applies to service accounts and machine identities that should not have broad east-west freedom by default.

Practical implication: align workload and identity permissions to segmentation boundaries so a single compromise cannot traverse the estate.

Where identity-based access and defense in motion intersect

The article's strongest identity angle is not user login, but the way identity, device posture, and application identity are used to shape runtime network access. That is a governance issue as much as a network issue, because access decisions must stay consistent across changing workload states, user contexts, and application flows. Defense in motion means security controls reinforce each other rather than sitting as isolated products. For organisations running NHI-heavy and hybrid environments, this makes identity-bound authorization a live control plane concern, not a back-office directory issue. It also explains why microsegmentation and Zero Trust guidance increasingly appear together in operational planning.

Practical implication: govern identity-based network access as a runtime policy problem, not a one-time architecture decision.

Threat narrative

Attacker objective: The attacker aims to expand a foothold into broad internal access by moving laterally before defenders can contain the breach.

1. Entry occurs through the same kinds of speed and trust gaps that let attackers outrun detection controls and reach internal assets before teams can react.
2. Escalation happens when the attacker can move laterally across weakly segmented East-West paths and exploit broad internal trust relationships.
3. Impact follows when internal reach is not constrained, allowing compromise to spread beyond the initial foothold and increasing the breach blast radius.

Breaches seen in the wild

• Miasma and Hades Supply Chain Worms: Self-propagating supply chain worms Miasma and Hades compromise npm, PyPI, and Azure credential stores.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Microsegmentation is now a governance control, not a network luxury. The article's central lesson is that internal segmentation determines whether compromise becomes a contained event or an enterprise-wide problem. As environments span cloud, data centers, and branch networks, policy must follow the asset and the identity, not a static perimeter. Practitioners should treat segmentation as part of access governance, not as an optional network redesign.

Defense in motion is the right framing for hybrid estates. Point solutions that operate in isolation create blind spots when workloads, identities, and traffic patterns change constantly. A containment model that synchronises firewalls, segmentation, and identity-based policy is more defensible than a model that waits for detection. Practitioners should assess whether their controls actually reinforce each other across East-West and identity-driven access paths.

Identity-based segmentation is the missing bridge between IAM and network security. The article shows that user, device, and application identity now influence runtime access decisions inside the network, not just at login. That makes access governance a live operational discipline for both human and non-human identities. Practitioners should ensure segmentation policy is anchored in identity context, or the control will drift out of sync with real access behaviour.

Containment-first cyber resilience is replacing the old assumption that detection can always arrive in time. The article reflects a market shift toward controls that limit spread before analysts finish triage. That shift is especially important where alert overload and short breakout times make manual response unreliable. Practitioners should redesign resilience around blast-radius reduction, not post-alert recovery.

What this signals

Containment-first design is becoming the practical answer to alert fatigue. When breakout time is measured in seconds and analyst response takes far longer, the governing question is no longer how fast teams can detect every event. It is how much damage they can prevent once an attacker is already inside.

Microsegmentation is the control that gives Zero Trust operational teeth inside the network. Zero Trust language without East-West enforcement remains aspirational in hybrid environments. The programme implication is straightforward: if internal traffic is still broadly trusted, the architecture has not yet moved from policy to enforcement.

For practitioners

• Rebuild internal trust boundaries Map where workloads, service accounts, and applications can still reach each other without explicit containment policy, then remove broad east-west paths first.
• Tie segmentation to identity context Use user, device, and application identity to drive runtime access decisions so network policy follows the actual subject of access.
• Prioritise blast-radius reduction Rank segmentation projects by the environments where lateral movement would cause the highest operational impact, especially in hybrid estates.
• Test containment under alert pressure Exercise whether teams can limit spread when detection is late, false positives are high, and response windows are already compressed.

Key takeaways

• The article frames microsegmentation as a containment control that limits lateral movement when detection is too slow to stop spread.
• The supporting evidence points to a widening operational gap between rising cyber spend, faster breakout times, and overloaded security teams.
• For practitioners, the implication is to redesign internal access around blast-radius reduction, identity context, and runtime enforcement.

Key terms

• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Defense in Motion: Defense in motion is an operating model where network, identity, and policy controls continuously adapt as traffic, workloads, and user context change. The goal is to keep protections aligned with the current environment rather than rely on static perimeter rules that age quickly.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity controls to the broader security programme that has to keep pace with hybrid environments.