Healthcare microsegmentation faces an implementation paradox

At a glance

What this is: This survey shows healthcare teams want microsegmentation for ransomware resilience, but clinical uptime fears and legacy deployment models keep adoption stuck.

Why it matters: For IAM and security leaders, the issue is that east-west control in hospitals is now a governance problem as much as a network design problem, especially where unmanaged devices and identity-based policy intersect.

By the numbers:

• 60% of health systems cannot adequately protect unpatchable, agentless medical devices.
• 40% cite fear of clinical disruption as the top barrier to microsegmentation adoption.
• 78% rate proven breach and ransomware prevention as the most important decision criterion.
• 46% report cyber insurance carriers now request segmentation controls at renewal.

Context

Healthcare microsegmentation is the practice of limiting lateral movement between devices and workloads by enforcing granular policy inside the network. In healthcare, the governance problem is not simply how to segment, but how to do it without interrupting clinical workflows, patient safety, or the operation of unpatchable medical devices.

The article argues that this creates an implementation paradox: leaders understand the security value of segmentation, yet legacy methods still require change windows, network re-plumbing, and operational disruption that hospitals can rarely absorb. That tension is especially acute where identity-based policy must cover unmanaged IoMT, OT, and clinical infrastructure at scale.

Key questions

Q: What fails when hospitals try to segment medical networks with legacy tools?

A: Legacy segmentation fails when it assumes hospitals can tolerate VLAN rework, ACL changes, and long maintenance windows. In clinical environments, that creates unacceptable operational risk, so teams delay or avoid the control entirely. The result is a security design that is technically valid but operationally unusable for unpatchable, agentless devices.

Q: Why does clinical downtime fear increase lateral movement risk?

A: Because fear of disruption pushes teams toward inaction, flat networks remain in place and attackers can move more easily from one device to another. In hospitals, the risk is not only compromise of a single endpoint but the ability to reach many systems before detection. Containment has to be designed so it does not depend on downtime.

Q: What are the signs that a microsegmentation programme is being delayed too long?

A: Common warning signs are repeated exceptions, persistent excess privilege, and teams treating segmentation as a future project instead of a current control gap. At that point, the organisation is likely relying on weak perimeter assumptions while attackers can move laterally once inside. The longer the delay, the more exposure builds across applications and infrastructure.

Q: How should healthcare security teams balance patient safety and segmentation controls?

A: They should use a model that protects east-west traffic without changing clinical workflows, then phase enforcement through simulation and cross-functional approval. Patient safety and security are not opposing goals, but the control must be designed so it does not depend on shutting systems down to work.

Technical breakdown

Why legacy segmentation breaks in hospitals

Traditional segmentation relies on VLAN changes, ACLs, firewall rules, NAC policy, and often re-IPing devices. That model assumes the environment can tolerate topology changes and maintenance windows, which is usually false in a hospital. The result is a control that is conceptually sound but operationally misaligned with clinical uptime requirements. In practice, the more devices are unmanaged or agentless, the less viable infrastructure-heavy segmentation becomes. The security gap is not lack of intent, but a deployment model that treats the network as the control surface rather than the device identity and traffic pattern.

Practical implication: reduce dependence on network re-plumbing and design segmentation around existing clinical uptime constraints.

Identity-based policy for IoMT and unmanaged devices

Identity-based microsegmentation decouples policy from IP address and topology, then applies least-privilege controls based on device or workload identity. That matters for infusion pumps, imaging systems, and other IoMT assets that cannot run agents or be safely patched on a normal cadence. Instead of forcing security into the device, the control sits alongside the network and evaluates who or what may talk to whom. This is where identity and network governance intersect: the policy model has to know the device class, its communication pattern, and its allowed peers without requiring invasive changes to the asset.

Practical implication: classify unmanaged medical devices by communication behaviour and enforce identity-based east-west restrictions.

Simulation, monitoring, and policy scale are the real control plane

The article shows that successful microsegmentation depends on three operational capabilities: simulation before enforcement, continuous monitoring for lateral movement, and policy management that scales beyond manual rule creation. Without simulation, clinical teams have to trust that a block will not break care delivery. Without continuous monitoring, teams cannot tell whether segmentation failures or lateral movement are occurring. Without scalable policy workflows, the control becomes an administrative burden. In other words, the technical challenge is not simply enforcing segmentation, but proving it can be changed safely over time.

Practical implication: validate policy in simulation first, then measure enforcement and drift continuously after rollout.

Threat narrative

Attacker objective: The objective is to expand from one compromised device to broad lateral movement that can interrupt clinical services and maximize ransomware impact.

1. Entry occurs when a single compromised endpoint or unmanaged device becomes the foothold inside a flat hospital network.
2. Credential or access abuse is replaced here by east-west reachability, allowing the attacker to move laterally across poorly segmented clinical systems.
3. Impact follows when ransomware operators reach critical systems and disrupt clinical operations, encryption, or patient-facing services.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Microsegmentation in healthcare is now a clinical resilience problem, not just a network architecture choice. The article shows that hospitals are not deciding whether segmentation has value, but whether the deployment model can coexist with patient safety and uptime. That makes the control a governance issue across security, biomedical engineering, and operations. The practitioner takeaway is that segmentation programs must be judged by their ability to reduce lateral movement without disrupting care.

Identity-based enforcement is the only segmentation model that plausibly fits unmanaged medical environments. Devices that cannot host agents or tolerate reconfiguration need policy that follows identity and communication behaviour rather than topology. This is where the intersection with IAM becomes real: the policy decision is about what a device is allowed to talk to, not just where it sits on the network. Practitioners should treat unmanaged IoMT as an identity governance problem with network consequences.

Clinical downtime fear is a control-selection signal, not an argument against segmentation. If a team cannot enforce change safely, the problem is not that segmentation is unnecessary, but that the architecture is too brittle for healthcare operations. The article’s strongest contribution is exposing the cost of legacy segmentation assumptions. Practitioners should use that signal to reset deployment criteria around safe simulation, phased enforcement, and measurable containment.

Implementation paradox: the control hospitals want most is the one their deployment model makes hardest to adopt. The named concept matters because it captures a recurring security pattern in regulated environments where operational risk blocks security change. Once that paradox is named, leaders can compare tools and designs by whether they remove disruption from the adoption path. The practitioner conclusion is to prioritise deployability as part of control effectiveness.

Microsegmentation becomes credible only when it can demonstrate containment without altering clinical workflows. That changes how security teams should evaluate vendors, pilots, and insurance requirements: proof of non-disruptive enforcement is as important as policy design. In governance terms, the control must satisfy both security and service continuity objectives. The practitioner conclusion is to demand evidence of safe rollout, not just policy capability.

From our research library:

• Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.

What this signals

Implementation paradox: healthcare teams are being asked to prove containment while still preserving clinical uptime, and that changes the buying test for segmentation controls. Programs should be measured by how quickly they can reduce lateral movement without forcing network redesign.

Identity-based segmentation is a governance model, not just a technical design choice. When policy follows device identity and traffic behaviour, security teams can protect agentless IoMT assets without relying on agents or topology changes. That makes rollout governance, exception handling, and simulation part of the control itself.

Security leaders should expect more pressure from cyber insurers and internal audit to show segmentation evidence, but the real differentiator will be whether the control can be deployed safely at scale. Hospitals that cannot demonstrate non-disruptive enforcement will keep postponing the very control they most need.

For practitioners

• Map unmanaged medical devices first Inventory IoMT, OT, and other agentless assets by location, communication pattern, and clinical criticality before designing segmentation policy.
• Simulate policy before enforcement Test segmentation rules against real traffic and clinical workflows before blocking any east-west paths, especially for devices that support patient care.
• Prioritise lateral movement containment Target the segments and device groups most likely to enable ransomware spread, rather than trying to redesign the whole hospital network at once.
• Build cross-functional approval paths Involve clinical, biomedical, networking, and security teams in policy design so that exceptions, maintenance, and change control are handled before rollout.
• Use insurance renewal pressure as a control milestone Treat insurer requests for segmentation evidence as a trigger to document what is protected, what is simulated, and what has already been enforced.

Key takeaways

• Healthcare microsegmentation is trapped between two valid priorities, protecting clinical systems and avoiding operational disruption.
• The survey shows that unpatchable, agentless devices remain a major protection gap, and legacy segmentation models are too disruptive for many hospitals.
• The practical answer is identity-based enforcement with simulation and phased rollout, so containment improves without forcing a network redesign.

Key terms

• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• IoMT: IoMT means Internet of Medical Things, the connected medical devices and systems used in clinical care. These devices often have long lifecycles, limited patchability, and strict uptime requirements, which makes compensating controls such as segmentation especially important.
• Identity-based Policy: An identity-based policy attaches to a user, group, or role and defines what that identity is allowed to do. It travels with the identity rather than the target resource, which makes it useful for central entitlement management. The main governance risk is allowing these policies to grow broader over time.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and IAM practitioners connect identity controls to real operational risk across hybrid environments.