Hybrid mesh firewalls need identity-aware microsegmentation for lateral movement

At a glance

What this is: Hybrid mesh firewalls unify fragmented perimeter controls, but the article argues they still miss internal lateral movement unless identity-aware microsegmentation is added.

Why it matters: IAM, NHI, and network security teams need to treat east-west containment as a distinct control problem, because perimeter consolidation alone does not govern which identity can move where inside the environment.

Context

Hybrid mesh firewalls are a way to centralise policy across multiple firewall types in hybrid estates, but they do not automatically control every internal connection. The article’s core point is that internal movement, not initial access, remains the place where defenders still lose visibility and enforcement.

That matters for identity governance because east-west traffic is often driven by service identities, workloads, and users whose access paths change faster than manual firewall policy can keep up. In a mixed hybrid estate, the control question is no longer just who gets in, but which identity can laterally reach which asset once inside.

Key questions

Q: Where do hybrid mesh firewalls fail in practice?

A: They fail at internal containment when organisations treat boundary consolidation as if it also controlled east-west movement. A hybrid mesh firewall can simplify perimeter management, but lateral movement still succeeds if identities and workloads are not governed inside the segment. The failure is architectural, not just operational.

Q: Why does microsegmentation matter so much for lateral movement risk?

A: Because most successful breaches become far more damaging after the first foothold. Microsegmentation limits east-west paths, so a compromised account or workload cannot freely pivot across the environment. That reduces the blast radius of initial access and gives incident responders a smaller, more containable security problem.

Q: What are the signs that firewall policy is lagging behind hybrid change?

A: The main signs are growing rule sprawl, repeated manual exceptions, and segments that still allow broad internal reach after assets or workloads move. If new systems appear faster than policy is updated, the environment may look centralised while internal exposure keeps widening.

Q: Should teams rely on perimeter firewalls or segmentation to reduce blast radius?

A: They should use both, but for different jobs. Perimeter firewalls limit initial access, while segmentation limits what an attacker can reach after access is gained. If the goal is blast-radius reduction, segmentation is the control that addresses internal movement directly.

Technical breakdown

Why hybrid mesh firewalls stop at the segment edge

Hybrid mesh firewalls consolidate management across physical, virtual, cloud-native, and firewall-as-a-service layers, but they still operate as boundary controls. They are good at reducing complexity in north-south traffic and centralising policy, yet they do not continuously evaluate every east-west hop inside a segment. That means policy is still largely expressed around zones, not around the identity of the caller or the workload being contacted. In practice, the internal movement problem remains separate from perimeter consolidation.

Practical implication: Treat hybrid mesh firewall coverage as boundary governance, not as an internal containment control.

What identity-aware microsegmentation changes in east-west control

Identity-aware microsegmentation applies host-level and workload-level policy so that access decisions follow the identity, not just the network location. That matters because lateral movement usually depends on trusting internal reachability once the perimeter has been crossed. When segmentation is automated, policy can adapt as assets appear, disappear, or move across cloud and on-premises environments. The technical shift is from static network grouping to dynamic, identity-linked containment that reduces the blast radius of compromise.

Practical implication: Map east-west rules to identities and workloads, not just IP ranges or network zones.

Why manual policy management cannot keep pace with hybrid sprawl

The article points to a core operational limit: fragmented tooling and manual policy updates do not scale with hybrid environments that span data centres, cloud services, and remote sites. Every new asset, service, or decommissioned system creates policy drift unless rules are updated quickly and consistently. In that model, the firewall stack can remain technically deployed but functionally stale. Automated policy creation and continuous adjustment matter because the environment changes faster than human-managed rulebooks do.

Practical implication: Use automation to keep containment policy aligned with changing identity and asset inventories.

Threat narrative

Attacker objective: The attacker aims to move laterally across the hybrid environment and expand the compromise beyond the initial entry point.

1. Entry occurs at the perimeter or macro perimeter, where hybrid mesh firewalls are strongest but still do not remove the need for internal containment.
2. After initial access, the attacker pivots east-west because internal traffic is not continuously governed by identity-aware policy.
3. Lateral movement succeeds where blind spots and stale rules leave internal reachability open across segments.
4. Impact expands as the attacker spreads beyond the first foothold and the blast radius is no longer constrained.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hybrid mesh firewall consolidation does not solve the identity problem inside the network: centralised perimeter control reduces operational sprawl, but it does not automatically govern east-west movement. The decisive gap is not whether the firewall stack can see the edge, but whether it can continuously constrain internal reachability as identities and workloads move. Practitioners should treat perimeter simplification and lateral containment as separate control objectives.

Identity-aware microsegmentation is the control that turns internal access into a governable identity decision: network zone policy alone cannot express who or what should speak to a specific workload once the environment fragments across cloud and on-premises estates. By binding policy to host and workload identity, segmentation reduces blast radius instead of merely reducing firewall count. The practical takeaway is that east-west governance needs identity context, not just central management.

Hybrid sprawl makes manual firewall policy a drift problem, not just an administration problem: when assets are added, moved, or retired faster than rules are rewritten, the policy model becomes stale even if the tooling is modern. That creates a false sense of containment because the environment looks centrally managed while internal paths remain open. The practitioner conclusion is that automated policy maintenance is part of security correctness, not only operational convenience.

Internal containment is becoming the decisive differentiator in hybrid security architecture: as organisations standardise perimeter controls, attackers shift to the paths those controls do not continuously govern. The market signal is that identity, segmentation, and firewall policy are converging into one governance question about authorised movement. Security teams should plan for a world where edge control is assumed and lateral control is the real test.

Microsegmentation is maturing from niche containment to baseline hybrid governance: the article reflects a broader shift in which hybrid environments can no longer be defended as a set of disconnected islands. The concept to watch is identity-aware east-west control, because that is where compromise containment lives in practice. Practitioners should evaluate whether their current architecture can actually shrink blast radius when the first control boundary fails.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Identity-aware east-west control is becoming the missing layer in hybrid architecture: once firewall management is centralised, the next governance question is no longer how many consoles exist. It is whether internal movement can still be constrained when identities, workloads, and cloud assets shift faster than manual rule updates.

Hybrid estates are exposing a broader control gap between edge protection and internal containment. That gap will keep widening unless practitioners connect segmentation policy to identity and asset change events instead of treating network zones as stable boundaries.

For practitioners

• Separate edge control from internal containment Document hybrid mesh firewalls as boundary controls and assign east-west containment to a separate identity-aware policy layer.
• Model lateral movement paths by identity Map which users, services, devices, and workloads can reach each other inside each segment, then remove paths that are not required.
• Automate policy updates for changing assets Tie segmentation rules to asset and workload changes so new systems are protected and decommissioned systems are removed without waiting on manual cleanup.
• Validate blast-radius reduction under compromise Test whether a single foothold can still reach adjacent systems after segmentation rules are applied, especially in hybrid and cloud-connected segments.

Key takeaways

• Hybrid mesh firewalls reduce policy fragmentation at the edge, but they do not by themselves stop lateral movement inside the environment.
• The article’s central argument is that internal containment needs identity-aware microsegmentation to limit blast radius after initial access.
• Practitioners should separate perimeter simplification from east-west governance and verify that segmentation follows identity and workload change.

Key terms

• Hybrid Mesh Firewall: A hybrid mesh firewall is a centrally managed approach that coordinates multiple firewall types across cloud, on-premises, remote, and distributed environments. Its value is policy consistency, but its control boundary still remains network-centric unless paired with identity-aware internal enforcement.
• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.