Breach security in critical industries needs identity-based containment

At a glance

What this is: This is an analysis of breach security in healthcare, pharmaceutical, and manufacturing environments, with the core finding that identity-based microsegmentation is framed as the practical control for shrinking blast radius when attackers reach lateral movement.

Why it matters: It matters because IAM, PAM, NHI, and security architecture teams need containment models that work after initial compromise, not just perimeter controls that assume the attack stays outside.

By the numbers:

• Attacks can reach lateral movement in as little as 27 minutes after initial compromise.
• The average time to identify and contain a breach still hovers around 258 days.

Context

Breach security is the discipline of limiting what an attacker can reach after the first control failure. In healthcare, pharmaceutical, and manufacturing environments, the problem is not only initial access but the speed at which an intruder can turn that access into lateral movement across flat or weakly segmented networks.

Elisity's article argues that identity-based microsegmentation changes the containment model by binding access to user, workload, and device identity rather than to network location alone. That matters in environments where medical devices, industrial systems, and legacy platforms cannot be treated like ordinary endpoints.

The operational question for practitioners is whether their current breach security model can still contain an incident after credentials, sessions, or devices are already inside the network. In these sectors, the answer increasingly depends on blast-radius control rather than perimeter confidence.

Key questions

Q: What breaks when a critical industry network is left flat after compromise

A: Flat internal networks turn a single foothold into an enterprise-wide problem because the attacker can pivot laterally without encountering meaningful internal boundaries. In healthcare, pharma, and manufacturing, that usually means one compromised user, device, or service can reach systems that should never share the same trust level. The failure is containment, not just detection.

Q: Why does lateral movement create such a high risk for manufacturing and healthcare networks?

A: Lateral movement is dangerous because a single foothold can turn into broad access across connected systems, including OT controllers and medical devices that are hard to patch or monitor. In manufacturing, that can interrupt production. In healthcare, it can affect patient care and sensitive data. The mix of legacy systems, trust relationships, and limited visibility gives attackers room to expand quietly.

Q: How do teams know if microsegmentation is actually working?

A: Microsegmentation is working when a compromised workload cannot reach anything outside its explicit policy boundary. The best signal is not the existence of a segmentation design, but the reduction in reachable assets after compromise. If east-west traffic still flows broadly, the control is not changing attacker economics.

Q: What should organisations do when identity and operational technology both share the same network

A: They should treat shared network space as a containment risk and define access boundaries around identity and function instead of simple connectivity. OT and medical systems often cannot absorb the same controls as standard endpoints, so the governance model has to isolate them without breaking operations. That requires policy that respects operational constraints while narrowing trust.

Technical breakdown

Why lateral movement is the breach security bottleneck

Lateral movement is the stage where a single compromise becomes a multi-system incident. Once an attacker has a foothold, they look for trust paths, shared credentials, flat subnets, and overbroad access relationships that let them pivot to higher-value systems. In healthcare and manufacturing, those paths are often created by legacy infrastructure, mixed IT and OT estates, and device populations that cannot be managed like standard endpoints. The key technical problem is not just ingress, but the absence of enforced east-west boundaries that stop reuse of that foothold. Practical implication: map and reduce lateral paths before assuming perimeter detection will be fast enough.

Practical implication: map and reduce lateral paths before assuming perimeter detection will be fast enough.

How identity-based microsegmentation changes containment

Identity-based microsegmentation replaces broad network trust with explicit policy around identity, role, and asset type. Instead of allowing a device or workload to talk because it sits in a subnet, the control evaluates what the identity is and what it is permitted to access. That is especially relevant for environments with medical devices, OT systems, and mixed infrastructure, where static IP-based segmentation tends to break down under operational pressure. The architectural shift is from perimeter routing to governed communication paths. Practical implication: build policy around identity and business function, not around network position alone.

Practical implication: build policy around identity and business function, not around network position alone.

Why dynamic policy matters in critical industries

Breach security in these sectors fails when policy updates lag behind operational change. Dynamic policy automation matters because healthcare, pharma, and manufacturing networks are too volatile for manual rule management to keep pace with new assets, temporary connections, and changing risk signals. The article's point is not that automation replaces governance, but that containment policy has to adjust as the environment changes or it becomes stale. That makes enforcement and visibility part of the same control loop. Practical implication: treat policy drift as a containment failure, not just an administrative issue.

Practical implication: treat policy drift as a containment failure, not just an administrative issue.

Threat narrative

Attacker objective: The attacker aims to turn one initial compromise into broader access that disrupts operations, exposes sensitive data, or both.

1. Entry occurs when an attacker gains an initial foothold through compromised credentials, social engineering, or another access path that bypasses perimeter assumptions.
2. Credential or session misuse then enables the attacker to traverse trusted internal relationships and probe for systems with broader operational value.
3. Escalation follows as the attacker pivots across flat or weakly segmented networks toward records, research systems, or OT-connected assets.
4. Impact occurs when the intrusion reaches enough systems to disrupt care delivery, production, or confidential data handling at scale.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity-based containment is now a breach security requirement, not an optimisation. The article shows that modern attacks move faster than most organisations can detect and respond, which means the practical control question is containment after initial access. In critical industries, flat networks and permissive east-west traffic turn a single compromise into an operational event. Practitioners should treat blast-radius reduction as a primary security objective.

Lateral movement is the control gap that most breach programmes still under-estimate. The guide makes clear that the decisive failure is not only entry, but the internal trust structure that lets attackers pivot once inside. That is why segmentation built on static network assumptions is increasingly brittle in healthcare, pharmaceutical, and manufacturing estates. Identity must become part of the containment model, or the network keeps doing the attacker's work.

Identity-based microsegmentation is strongest where legacy operations limit other controls. OT devices, medical systems, and long-lived industrial assets often cannot support invasive agents or rapid patch cycles, so containment has to be enforced above the device layer. That shifts governance toward what each identity can reach, rather than what each host can run. The implication is that containment architecture must fit operational reality, not idealised endpoint coverage.

Blast radius, not breach detection, becomes the decisive metric. The article ties business impact to the speed and spread of lateral movement, which means programme owners need to ask how much of the environment remains reachable after one compromise. That is a different governance question from alerting alone. Security leaders should measure how much damage one foothold can still cause.

Critical industries need a containment model that survives mixed IT and OT trust. The strongest part of the analysis is not the vendor claim but the sector fit: healthcare, pharma, and manufacturing all contain asset classes that cannot be governed as ordinary user endpoints. Identity-based containment gives those programmes a way to make trust explicit across heterogeneous systems. Practitioners should align their architecture to the hardest-to-control assets first.

From our research library:

• Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.

What this signals

Identity-based containment is the practical answer when breach security has to work after compromise, not before it. In mixed healthcare, pharma, and manufacturing environments, the key design question is how much of the estate remains reachable from one foothold, because that determines whether an incident stays local or becomes operationally disruptive.

Breach security programmes that still rely on perimeter confidence are being outpaced by east-west attack paths. The governance shift is toward explicit internal trust boundaries, especially where OT, medical, and legacy systems cannot be managed like standard enterprise endpoints.

For practitioners

• Map internal trust paths Identify the east-west paths that let a compromised endpoint, user, or workload reach higher-value systems. Prioritise radiology, pharmacy, research, plant-floor, and shared service environments where flat access can turn one foothold into broad reach.
• Contain by identity, not subnet Define segmentation policies around user, workload, and device identity so access is granted by role and function rather than by IP range or VLAN membership. This is the control shift that limits movement when an attacker is already inside.
• Treat OT and medical devices as containment first-class citizens Build specific access boundaries for devices that cannot be patched or instrumented like standard endpoints. Use policy exceptions sparingly and ensure they do not recreate flat network trust under a different label.
• Measure blast radius reduction Track how much of the estate remains reachable from a compromised endpoint, and use that metric alongside detection and response times. If internal reach stays broad, the containment programme is not yet doing its job.

Key takeaways

• The core problem is not only initial compromise but the internal trust structure that lets an attacker move from one foothold to many.
• The article ties modern breach security failures to rapid lateral movement and prolonged containment gaps in critical industries.
• Identity-based microsegmentation is positioned as the control that shrinks blast radius when flat networks and legacy systems cannot do the job.

Key terms

• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.