CISA microsegmentation guidance exposes the real Zero Trust gap

At a glance

What this is: This is Elisity’s analysis of CISA’s microsegmentation guidance, and the key finding is that the real Zero Trust gap is operational execution, not strategic intent.

Why it matters: It matters because IAM, NHI, and security teams increasingly need controls that enforce least privilege in motion, not just in design, and microsegmentation now sits inside that governance problem.

By the numbers:

• Traditional segmentation across 275 sites would take one year per location and $200 million to complete, according to Elisity.
• CISOs understand the need to limit lateral movement, the tactic used in over 70% of successful breaches, according to Elisity.
• Elisity says its discovery engine achieves 99% device visibility within hours of deployment.
• Main Line Health protected 5 hospitals, health centers, and over 40 offices with just a few full-time employees, according to Elisity.

Context

Microsegmentation is a network control that limits which systems can talk to each other, and in Zero Trust it becomes a governance mechanism rather than a pure infrastructure project. The problem CISA is addressing is familiar to practitioners: broad trust zones, slow policy change, and segmentation programmes that collapse under operational complexity.

This article uses CISA’s Microsegmentation in Zero Trust guidance as the anchor for a broader execution problem. The identity angle is real because effective segmentation increasingly depends on user, device, and workload attributes, so policy has to follow identity context instead of static network location.

Key questions

Q: What breaks when organisations build Zero Trust without microsegmentation?

A: Without microsegmentation, Zero Trust loses one of its main containment mechanisms. An attacker who gets past identity checks can still move laterally across poorly separated systems, reach critical workloads, and disrupt more of the environment than necessary. In practice, the model becomes easier to bypass because the network remains too open inside the perimeter, even if authentication is strong.

Q: Why do identity and device attributes matter for microsegmentation decisions?

A: Because modern networks are too dynamic for IP addresses and VLANs to describe trust accurately. Identity and device posture give segmentation policy a current view of who or what is making the request, so enforcement can reflect risk rather than topology. Without those attributes, policy quickly becomes stale and inconsistent across environments.

Q: What are the signs that a Zero Trust Segmentation programme is not working as intended?

A: A Zero Trust Segmentation programme is struggling when teams still rely on broad network trust, cannot explain allowed traffic paths, or find that containment policies are too coarse to stop movement between critical systems. If incidents spread quickly, policy exceptions proliferate, or segmentation is treated as documentation rather than enforcement, the control is not delivering meaningful risk reduction.

Q: Should pharmaceutical teams prioritise microsegmentation before broader zero trust rollout?

A: Yes, when the biggest risk is lateral movement through flat or converged networks. Microsegmentation gives the clearest early containment benefit because it reduces the blast radius first, then creates a stronger foundation for identity, device, and data controls that follow.

Technical breakdown

Why static network segmentation breaks Zero Trust

Traditional segmentation relies on IP ranges, VLANs, firewall rules, and manually maintained allowlists. That model assumes the environment is stable enough for static policy to remain correct, which is not how modern networks behave. Zero Trust changes the control objective from perimeter trust to per-request authorization and continuous validation. Microsegmentation is the enforcement layer that reduces lateral movement by constraining east-west traffic, but only when policy can be attached to business meaning such as device type, workload role, or identity context. If the policy model is still anchored to addresses and zones, it will lag the environment it is meant to control.

Practical implication: Treat segmentation as an identity- and context-aware control problem, not a network renumbering exercise.

How policy enforcement points make microsegmentation dynamic

Policy Enforcement Points, or PEPs, are the decision and enforcement layer that applies segmentation rules at runtime. In a Zero Trust model, those points do more than check a connection at the moment it starts. They can keep evaluating whether the access remains valid as context changes, such as device posture, user state, or detected anomalies. That is the key architectural shift in CISA’s guidance. It moves segmentation from a one-time configuration task to a living control that can respond to the environment. Without runtime enforcement, microsegmentation becomes little more than a cleaner firewall policy set.

Practical implication: Design segmentation so that enforcement can react to changing context during the session, not only at connection setup.

Why identity attributes now drive microsegmentation policy

CISA’s guidance reflects a broader move away from location-based network trust toward policy built from identity attributes. That includes user roles, device posture, asset class, and behavioral context. This matters because the same endpoint or workload can be safe in one context and risky in another. Identity-linked policy also fits modern operations better than duplicated rules across sites, since the policy travels with the entity rather than the subnet. For identity teams, this is where Zero Trust and segmentation intersect: policy authority increasingly depends on trustworthy identity data, not just network topology.

Practical implication: Ensure identity, device, and asset data are reliable enough to serve as policy inputs for segmentation decisions.

Threat narrative

Attacker objective: The attacker wants to turn a single initial foothold into wider internal access and a larger operational impact than the original compromise should have allowed.

1. Entry occurs through over-trusted internal connectivity, where an attacker who gains one foothold can reach too many adjacent systems because segmentation is weak or static.
2. Escalation follows when the attacker moves laterally across shared trust zones, using the absence of tight east-west controls to reach higher-value assets.
3. Impact is broad compromise or ransomware spread, because the lack of enforceable blast-radius control lets one intrusion expand into a multi-system incident.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Microsegmentation is now a governance control, not a network hygiene task. The article makes clear that the real failure is not conceptual acceptance of Zero Trust but the inability to operationalize it quickly enough to matter. That shifts the centre of gravity from architecture diagrams to enforcement, validation, and lifecycle control. Practitioners should treat segmentation as a policy governance problem with measurable blast-radius outcomes.

Identity has become the practical control plane for segmentation. CISA’s guidance, as interpreted here, depends on user, device, and workload attributes because static network labels no longer track risk well enough. That means IAM, device trust, and workload context now influence east-west traffic decisions. The boundary between network security and identity governance is thinner than many programmes assume, so teams need shared ownership of the policy inputs.

Long segmentation projects create a Zero Trust debt burden. When implementation stretches into years, the organisation carries an accumulating gap between policy intent and actual control coverage. That gap is not merely technical. It becomes operational debt that delays containment improvements, complicates audit evidence, and weakens resilience planning. Practitioners should measure how long it takes for a policy change to become enforceable, because speed is part of the control itself.

Blast-radius control is the named concept practitioners should track. The article’s core lesson is that Zero Trust succeeds only when a breach can be contained to the smallest practical scope. That makes containment speed, policy granularity, and validation workflow the relevant metrics, not abstract adoption milestones. Security leaders should benchmark how quickly policy can shrink the blast radius after a new device, workload, or risk signal appears.

Microsegmentation validates Zero Trust only when it is continuously maintained. The control is not a one-time project deliverable. It is an operating model that must survive infrastructure change, asset churn, and new trust relationships. For identity and security teams, the implication is clear: policy drift is a control failure, not a maintenance nuisance, and continuous validation belongs in the governance model.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Blast-radius control is becoming the practical test of Zero Trust maturity. Security leaders should expect policy effectiveness to be judged by containment speed, not by whether a framework has been adopted on paper. If microsegmentation cannot be updated quickly enough to reflect live identity and device context, the programme has a governance gap that attackers can exploit.

Teams that still run segmentation as a slow network change process will struggle to keep pace with cloud workloads, mobile endpoints, and hybrid identities. The useful question is whether policy can change as fast as trust conditions change, because that is what turns Zero Trust from architecture into operating reality.

For practitioners

• Implement phased segmentation by dependency group Start with candidate resources that have clear communication patterns, map dependencies before enforcement, and validate policy in permissive mode before blocking traffic.
• Bind policy to identity and device context Use user role, device posture, and workload attributes as policy inputs so segmentation decisions follow the entity rather than the subnet.
• Measure policy change speed as a control metric Track how long it takes to move from identification to validated enforcement, because delays create a widening gap between Zero Trust design and actual containment.
• Validate east-west traffic continuously Review internal communications for unnecessary pathways, then confirm that policy enforcement still reflects the current business and security context as assets change.
• Integrate segmentation with detection and response Link policy enforcement to threat signals from endpoint and vulnerability tools so a confirmed risk can trigger automatic isolation of affected devices or workloads.

Key takeaways

• Microsegmentation is the enforcement layer that makes Zero Trust operational, and weak internal segmentation leaves organisations exposed to lateral movement.
• The article’s core warning is execution latency, because policy that takes too long to deploy cannot contain risk fast enough to matter.
• Identity and device context now shape segmentation policy, so governance over those inputs is part of the security control itself.

Key terms

• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Policy Enforcement Point: A policy enforcement point is the control that applies an authorization decision at the place where an action occurs. In distributed systems, it may sit inside an API gateway, application, or workflow engine, and it depends on a consistent decision format to avoid bespoke integrations.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect access control decisions to the broader identity programme they operate.