Identity-based microsegmentation narrows lateral movement in hybrid cloud

At a glance

What this is: NHI Mgmt Group's analysis, drawing on NetFoundry's report: Microsegmentation remains under-deployed because traditional network controls slow adoption, while identity-based policy can block lateral movement without relying on IP addresses.

Why it matters: This matters because IAM and security teams increasingly need segmentation models that govern workloads and AI agents by identity rather than by brittle network assumptions.

By the numbers:

• Only 24% of organisations have deployed microsegmentation extensively.

Context

Microsegmentation is the practice of limiting east-west and north-south traffic so only approved connections can occur. In hybrid cloud environments, the traditional model depends on firewall rules, ACLs and VLANs, which makes change control slow and creates a governance bottleneck for teams trying to contain lateral movement.

The problem is not that segmentation lacks value. The problem is that policy tied to network position ages badly when workloads move, scale and span clouds, especially when the protected subjects are machine identities and AI agents.

Key questions

Q: What breaks when cloud microsegmentation is still tied to IP addresses?

A: Static IP-based segmentation breaks when workloads scale, relocate, or disappear faster than policy updates can keep up. The result is an enforcement layer that no longer matches the actual communication paths in the environment, which creates blind spots for east-west movement and weakens containment. Teams need policy inputs that survive infrastructure churn.

Q: Why does identity-based segmentation reduce lateral movement risk for workloads?

A: Because it only permits connections between identities that policy explicitly allows, rather than between anything on the same subnet. That means an attacker who reaches one workload does not automatically gain broad east-west reach, and a private service can remain effectively hidden from the network.

Q: How do security teams know if identity-based segmentation is actually working?

A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services. If lateral movement, management-plane access, or service-to-service discovery still succeeds, segmentation is too coarse. Effective segmentation shows up as denied pathways, reduced reachable surface, and a clear separation between user, management, and critical workloads.

Q: What is the difference between network segmentation and identity segmentation?

A: Network segmentation limits where traffic can move, while identity segmentation limits what an identity can do and which resources it can reach. Both matter, but identity segmentation is critical for NHIs because a compromised token or service account can move through authorised paths even when the network is segmented.

Technical breakdown

Why IP-based segmentation breaks down in hybrid environments

Traditional microsegmentation maps policy to IP addresses, subnets or network zones. That works until a workload changes location, a cloud environment is recreated, or shared addressing makes the network view unreliable. The more dynamic the environment, the more segmentation becomes a rule-maintenance exercise rather than a durable access control model. Identity-based segmentation replaces that brittle binding with cryptographic identity, so policy follows the workload rather than the network slot. In practice, this reduces the need to rewrite controls every time infrastructure shifts. Read the Ultimate Guide to NHIs: Key Challenges and Risks.

Practical implication: Treat identity as the policy anchor when workloads move across clouds or hosts.

How identity-based policy changes the control plane

In the model described by NetFoundry, every workload and AI agent gets a cryptographic identity, and policy decides which identities may connect. That changes segmentation from perimeter filtering to authenticated connection approval. Outbound-only connectivity to the fabric also means services do not need inbound exposure just to be reachable. For practitioners, the mechanism matters because access is enforced before a connection is established, not after traffic has already entered a broad network segment. The result is tighter reachability control with less reliance on static network constructs.

Practical implication: Design policy around verified workload identity instead of static network topology.

Why revocation can be immediate when identity changes

The live demo described in the report showed a workload losing access immediately after a single identity tag was removed. That is the operational difference between network segmentation and identity-based access control: the entitlement is evaluated at connection time, so revocation does not depend on route changes, ACL propagation or manual firewall updates. For high-change environments, this is important because the control failure mode shifts from delayed enforcement to immediate denial. The mechanism also avoids exposing the protected API to scan-based discovery because the service is hidden from the network. Read Top 10 NHI Issues.

Practical implication: Use identity-tag removal as the enforcement event for rapid access withdrawal.

NHI Mgmt Group analysis

Microsegmentation fails as a network-control project when the real problem is identity governance. The report shows that deployment complexity, not lack of intent, keeps many organisations from using segmentation extensively. When controls depend on firewall rules, ACLs and VLANs, the policy surface becomes too brittle for modern hybrid environments. The practitioner takeaway is that segmentation should be governed as an identity problem, not treated as another network tuning exercise.

Identity-based microsegmentation creates a narrower and more defensible control boundary for workloads and AI agents. Once policy is attached to cryptographic identity, reachability can be decided without caring where a service runs or which IP address it currently holds. That matters because dynamic infrastructure breaks location-based assumptions faster than teams can recertify them. The implication is that workload identity becomes the durable unit of segmentation governance.

Hidden services are easier to defend than addressable ones, and that changes the attacker’s path. If a private API is not exposed to the network, the usual discovery and scan-first workflow loses value. This is a meaningful shift for lateral-movement defense because reachability is no longer granted just by being on the same network segment. Practitioners should read this as a move from visibility-based perimeter logic to identity-gated access logic.

Workload identity is becoming the common control plane for hybrid traffic and agent traffic. The same identity model now spans east-west and north-south flows, which means segmentation can no longer be treated as a server-only or cloud-only problem. AI agents widen the requirement because they also need bounded connectivity, not just human-facing workloads. The practitioner conclusion is that network governance and NHI governance are converging on the same policy substrate.

Zero Trust for machine traffic is less about inspection and more about reachability discipline. The report’s model does not depend on decryption or inline inspection to establish control. Instead, it constrains which identities can even initiate a path. That is a different governance posture from classic ZTNA and a more relevant one for service-to-service access. The implication is that teams should evaluate whether their control model can survive without trusting network location at all.

What this signals

Identity-gated connectivity is becoming the more durable answer to hybrid segmentation drift. As environments span multiple clouds and ephemeral workloads, policy that depends on network position will keep losing precision. The operational signal for practitioners is that segmentation programmes need to move closer to workload identity and away from static infrastructure assumptions.

AI agents expand the segmentation problem beyond servers and services. Once agents are treated as policy-bearing identities, reachability controls must cover non-human actors as well as workloads. That pushes governance teams to align identity lifecycle, policy issuance and network reachability in one model rather than treating them as separate disciplines.

For practitioners

• Inventory workload and AI agent identities Map which services, APIs and agents currently rely on IP-based reachability so you can identify where policy will break as infrastructure changes. Read the Ultimate Guide to NHIs: Key Challenges and Risks.
• Shift segmentation policy to identity tags Define approved connections by cryptographic identity and service role, not by subnet, firewall zone or static address block.
• Test immediate revocation paths Remove a single identity attribute from a non-production workload and confirm that access stops without waiting for firewall propagation or route changes.
• Hide private APIs from network discovery Prefer designs where protected services are unreachable unless the identity policy allows the session, reducing exposure to scan-driven lateral movement.
• Separate human remote access from machine-to-machine control Keep human access tooling and workload connectivity governance distinct so segmentation models do not inherit assumptions from user-centric ZTNA designs.

Key takeaways

• Microsegmentation remains valuable, but topology-based policy makes it harder to deploy and govern consistently across hybrid environments.
• Identity-based segmentation shifts the control point from network location to verified workload identity, which narrows lateral movement opportunities.
• Practitioners should test whether access can be revoked immediately by identity change, because delayed enforcement means the control is still too dependent on legacy network mechanics.

Related NHI Mgmt Group resources: Top 10 NHI Issues · Ultimate Guide to NHIs: Key Challenges and Risks · Lateral Movement Guide

Key terms

• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Cryptographic Identity: Cryptographic identity is a trust model in which authentication depends on verifiable keys, certificates, or signed assertions rather than shared secrets alone. It is essential for machines and agents because it gives the organisation a stronger way to prove identity and revoke access quickly.
• Outbound-only connectivity: A connection model where the gateway initiates traffic outward rather than accepting inbound access from the network. It narrows the trust boundary, reduces firewall complexity, and better aligns with least privilege because the enterprise does not need to open broad inbound paths to support governance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.