Continuous segmentation closes the drift gap in device networks

At a glance

What this is: This is an IoT and OT segmentation analysis showing that static NAC policies drift as devices, addresses, and behaviors change.

Why it matters: It matters because practitioners responsible for connected devices need enforcement that tracks state changes continuously, not only during periodic policy reviews.

By the numbers:

• 79% of organizations called segmentation a priority, according to Asimily.
• 33% had fully implemented it, according to Asimily.
• 87% said their approach needs improvement, according to Asimily.

Context

Network segmentation is a control for limiting where devices can talk and what they can reach, but it only works if the policy reflects current device state. In IoT, OT, and IoMT environments, the network changes faster than manual policy maintenance can keep up, so enforcement quickly becomes stale.

The article frames this as a governance problem as much as a network one. Where connected assets move, change role, or alter risk profile, static group membership and device-blind DACLs stop reflecting the real exposure boundary, which creates a genuine identity-and-access angle for machine and device populations.

Key questions

Q: What breaks when segmentation policies are too broad or too static?

A: Broad or static policies often leave more connectivity open than teams realise, which weakens containment and creates blind spots during incidents. In fast changing environments, stale rules can fail to reflect current application flows, cloud dependencies, or temporary access paths. That mismatch makes breach containment slower and increases the chance of lateral movement.

Q: Why does device drift increase segmentation risk in IoT and OT networks?

A: Device drift changes the facts segmentation depends on, including IP address, function, and risk posture. When those facts change faster than manual policy review, the network enforces yesterday’s assumptions. The result is a widening gap between intended isolation and actual reachability, especially in environments with many connected devices.

Q: How do security teams know if identity-based segmentation is actually working?

A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services. If lateral movement, management-plane access, or service-to-service discovery still succeeds, segmentation is too coarse. Effective segmentation shows up as denied pathways, reduced reachable surface, and a clear separation between user, management, and critical workloads.

Q: What should teams do when segmentation depends on firewall or NAC rules?

A: They should treat rule maintenance as part of the control itself, not a separate admin task. When address changes, role changes, or reclassification occur, the policy must be re-evaluated and re-applied automatically or the segmentation model will fail under routine network change.

Technical breakdown

Why static segmentation policies drift

Traditional segmentation starts with a snapshot: identify devices, place them into groups, and write allow or deny rules around those lists. That approach breaks when the network is dynamic because the group definition is frozen while device state is not. IP changes, firmware updates, new devices, and role shifts all create policy drift. In practical terms, the control is no longer enforcing intended access boundaries, only yesterday’s inventory. Continuous segmentation changes the control model from static membership to continuous evaluation of attributes that describe the device and its current risk posture.

Practical implication: Practitioners should treat segmentation as a living control that needs continuous re-evaluation, not a one-time design exercise.

How device risk and network context shape enforcement

The stronger model is intent-based segmentation, where the policy describes what should belong in a segment using attributes such as device type, manufacturer, function, and risk profile. That requires accurate device visibility and a risk engine that can distinguish theoretical vulnerability from exploitable exposure in the actual network topology. In this model, network policy is not just tied to an asset list. It is tied to current device context and observed behavior, which lets enforcement adapt when threat detection changes the risk score or when the device no longer matches the original criteria.

Practical implication: Teams need device visibility and risk context feeding the policy engine, or segmentation will still degrade into manual exception handling.

Why NAC and DACLs fail when they are not continuously updated

NAC and firewall-based controls can enforce segmentation well, but only if the underlying policy is updated when devices change. A DACL that points to a server IP address, for example, becomes invalid the moment that address changes. Likewise, a device that no longer belongs in a segment should lose its prior policy immediately. Continuous orchestration matters because the problem is not only control design. It is the maintenance burden required to keep the control aligned with reality. Without that loop, segmentation can look complete while quietly leaking in practice.

Practical implication: Security teams should automate policy reapplication and policy removal across NAC and firewall layers whenever device attributes change.

Threat narrative

Attacker objective: Exploit segmentation drift to preserve or gain network reachability beyond the intended device boundary.

1. Entry begins when a new or changed device appears on the network and existing segmentation rules do not yet reflect its current state.
2. Escalation occurs when stale NAC or DACL policy still permits the device to reach assets it should no longer access, or blocks needed traffic after an IP change.
3. Impact is unauthorized reachability, broken isolation, or unintended disruption of operational devices because the enforced policy no longer matches the network.
4. The attacker objective is to exploit policy drift so that access boundaries weaken faster than defenders can manually correct them.

Breaches seen in the wild

• Verkada camera breach 2021: Admin credentials on Verkada's exposed Jenkins support server let hackers into a support interface and customer cameras at 97 customers.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Policy drift is the real failure mode in modern segmentation. The issue is not whether segmentation exists, but whether the enforced boundary still matches the live device estate. When device membership, IPs, or operating state change, static rules decay into historical artefacts. Practitioners should treat drift detection as a governance control, not an afterthought.

Device identity is now part of the access-control problem. IoT, OT, and IoMT environments rely on machines that change behavior without a human logging in, which means access decisions have to follow device attributes, not just network location. That is why the intersection of NAC, device visibility, and risk scoring matters so much for identity governance across non-human endpoints. Practitioners should design segmentation as device-identity governance.

Continuous segmentation is a response to enforcement fatigue. Manual policy review does not scale when the environment changes daily and the cost of a mistaken change is operational disruption. The named concept here is segmentation drift gap: the widening distance between intended network policy and actual enforced policy. Practitioners should close that gap with continuous evaluation and automated policy lifecycle control.

Auditability becomes more valuable when segmentation is dynamic. If policies are going to change as device attributes evolve, teams need clear logs showing what changed, why it changed, and what policy was applied. That supports incident review, change control, and compliance evidence. Practitioners should make segmentation changes traceable enough to survive operational and regulatory scrutiny.

Intent-based segmentation is the more durable operating model. Describing the conditions for membership is more resilient than maintaining endless static lists of assets. That shift makes segmentation less dependent on manual hygiene and more aligned to how connected device estates actually behave. Practitioners should use the policy intent as the source of truth, not an inventory snapshot.

What this signals

Segmentation now behaves like an identity governance problem for devices. If the policy cannot keep pace with changes in device state, the control is effectively governing stale identities rather than live assets. That means NAC teams need the same discipline IAM teams use for lifecycle change, exception handling, and revocation.

Continuous evaluation is the operational pivot. The practical question is no longer whether segmentation exists, but whether the environment can re-evaluate trust as the device estate changes. For connected operations, that pushes policy orchestration, auditability, and device context into the centre of the control design.

For practitioners

• Define segments by device intent, not static host lists Use device type, function, manufacturer, and risk profile as the policy basis so the segment can survive IP changes and hardware churn.
• Feed NAC with live visibility and risk context Connect passive monitoring, safe scanning, and exploitability analysis to the segmentation workflow so policy decisions reflect current conditions.
• Automate policy removal when devices no longer qualify Revoke prior NAC policies automatically when a device changes role, firmware state, or behavior so stale access does not persist.
• Log every segmentation change for audit and review Record policy application, removal, and re-evaluation events so change history can support troubleshooting and compliance evidence.
• Test DACL updates against address changes Validate that firewall and DACL rules follow peer IP changes without manual intervention, especially for management and control-plane traffic.

Key takeaways

• Static segmentation policies age quickly when device inventories, IP addresses, and traffic patterns change faster than humans can review them.
• The article’s core evidence is that most organisations see segmentation as a priority, but far fewer have fully implemented it and many say their approach still needs improvement.
• The control lesson is to move from one-time rule setting to continuous evaluation so enforcement keeps pace with the live network.

Key terms

• Continuous Segmentation: A segmentation model that continuously evaluates whether devices still belong in a given network segment. It replaces static group membership with ongoing policy re-evaluation so access enforcement can follow changes in device state, risk, and network behavior.
• Network access control: Network access control is the policy layer that decides which devices are allowed to connect to a network. It is related to device access control, but it governs entry to the network path rather than the use of specific local hardware or peripherals once connected.
• Dacls: Dacls is a remote access trojan that gives an attacker control over an infected host. It is typically used to execute commands, collect system data, and maintain persistence after initial compromise. Security teams should monitor for suspicious process injection, persistence mechanisms, and outbound connections to untrusted infrastructure.
• Policy Drift Detection: Policy drift detection is the process of identifying when an access policy no longer matches the intended rule or the current business context. It helps teams catch unauthorized changes, stale permissions, and exceptions that have quietly become the new normal, so governance stays aligned with actual identity and app usage.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is useful for practitioners who need to connect lifecycle control with broader identity and security operations.