Identity-first microsegmentation and AI automation are converging

At a glance

What this is: This is Elisity’s field note from Gartner SRM 2026, arguing that AI-fuelled automation, exploit-driven intrusion, and mixed IT-OT reality are pushing identity-first microsegmentation from theory into operational necessity.

Why it matters: For IAM, NHI, and security architecture teams, the article matters because it ties enforcement to identity rather than network location, which is the only workable path when unmanaged devices, legacy assets, and OT constraints break conventional segmentation.

Context

At Gartner Security & Risk Management Summit 2026, the central theme was not a single product category but a governance problem: how to enforce access and containment when modern environments mix IT, OT, unmanaged assets, and changing automation patterns. Identity-first microsegmentation appears in that context as a way to make enforcement follow the identity that can still be known when the network cannot be trusted to tell the whole story.

The article’s core claim is that visibility and enforcement now have to move together. Traditional network-based segmentation struggles in environments where a benign false positive can stop patient care or production, while identity-based policy can still apply even when devices are legacy, proprietary, or unmanaged. That is a control design question, not a tooling slogan.

Key questions

Q: What breaks when segmentation is not tied to identity in mixed environments?

A: Network-based segmentation breaks down when assets are unmanaged, legacy, or impossible to classify from the wire alone. In mixed IT and OT environments, the control can either miss the target or block the wrong traffic, which turns containment into operational risk. Identity gives teams a stable policy subject when topology is too unstable to trust.

Q: Why does visibility have to be measured before segmentation can work?

A: Because policy quality depends on knowing what exists, who is accessing it, and where exposure already sits. If teams cannot measure those conditions, they cannot tell whether segmentation is improving control or just shifting blind spots. Measured visibility is the governance baseline that makes enforcement defensible.

Q: What are the signs that identity-first microsegmentation is being misapplied?

A: Common warning signs are policy rules that still depend on network zones, exceptions that keep growing for unmanaged assets, and false positives that create more operational friction than the control removes. When identity is not the actual policy anchor, segmentation becomes a labeling exercise instead of an enforcement model.

Q: How do security teams know when OT segmentation is becoming unmanageable?

A: The clearest sign is when policy changes become constant just to preserve normal operations. If teams are repeatedly editing firewall rules, VLANs or IP-based exceptions to keep connected OT systems working, the segmentation model is describing the network layout but not governing real trust relationships.

Technical breakdown

Why identity-based enforcement outlasts network location

Identity-first microsegmentation binds policy to who or what is requesting access, rather than to where traffic happens to originate. That matters when devices move, IPs change, assets are unmanaged, or network topology tells you almost nothing about trust. In mixed environments, the identity can still be known even when the device cannot run an agent or the protocol is legacy. The technical shift is from perimeter-style segmentation to policy decisions that follow the subject of access, not the path it takes.

Practical implication: Use identity attributes as the policy anchor when network topology is too unstable to serve as a reliable control plane.

Why visibility has to be measurable before segmentation works

Visibility is only useful when it becomes a metric, not a feeling. The article’s point is that teams cannot manage what they cannot measure, and segmentation fails when the organization cannot prove which assets exist, who is remoting in, or what is exposed on the open internet. In practice, identity-first microsegmentation depends on enumerating assets and access paths enough to define policy boundaries. Without that baseline, segmentation is more theory than control.

Practical implication: Define measurable visibility baselines before you treat segmentation as an enforcement program.

How AI and automation change the defender’s operating model

The article treats AI and automation as a scaling issue for both sides, but with a different outcome for defenders if they invest correctly. Off-the-shelf AI now helps attackers compress attack chains, yet defenders can also use automation to reduce manual policy work and respond faster to environmental change. The mechanism is not autonomous security by itself, but identity-aware automation that can keep policy aligned with a fast-changing surface. That shifts security operations from static configuration to continuous adaptation.

Practical implication: Automate policy maintenance and response where identity changes faster than human review cycles can keep up.

NHI Mgmt Group analysis

Identity-first microsegmentation is becoming a governance control, not just a network design pattern. The article shows that the real problem is not simply segmentation scope but whether the policy can follow identity in environments where network signals are too weak to govern access reliably. That makes the control relevant across IT, OT, and unmanaged assets, where enforcement must work even when the underlying infrastructure cannot be normalized. The practitioner conclusion is that segmentation now has to be treated as identity governance at runtime.

Visibility is the precondition for enforceable policy, not a reporting metric after the fact. You cannot segment what you cannot enumerate, and you cannot prove control effectiveness if you do not know what is on the network or who is using it. That is why the article’s emphasis on measurable visibility matters more than the usual tooling debate. The practitioner conclusion is that access policy, asset discovery, and enforcement telemetry need a shared governance model.

Automation changes the economics of defence, but only if it is tied to identity-aware control points. The article’s argument is not that AI alone solves security. It is that automation can finally scale defender action faster than the environment changes, provided policy decisions are anchored in identity and not in brittle network assumptions. The practitioner conclusion is that automation programs should be judged by whether they improve enforceable identity coverage, not by how much activity they generate.

Mixed IT and OT environments expose the limits of one-size-fits-all control assumptions. A false positive can be a nuisance in IT and an operational incident in clinical or industrial settings, so the same control logic cannot simply be copied across domains. That creates a governance requirement to separate policy intent from enforcement mechanics while still keeping identity as the common language. The practitioner conclusion is to treat OT segmentation as a distinct operating model with identity at its core.

Complexity reduction is now a security objective in its own right. The article’s consolidation thread matters because fragmented controls create duplicated policy, unclear ownership, and slower response. Identity-first microsegmentation fits that direction when it reduces architecture sprawl without weakening enforcement boundaries. The practitioner conclusion is to simplify the control stack only where the remaining platforms can still express identity-based policy consistently.

What this signals

Identity-first microsegmentation should be treated as a runtime governance pattern. The article points to a broader shift in which identity, visibility, and enforcement have to stay aligned even as assets move across managed, unmanaged, IT, and OT contexts. When network location stops being a reliable control input, identity becomes the only stable policy handle that still scales.

Operational environments expose the limits of borrowed security assumptions. Controls that are acceptable in enterprise IT can be unsafe when a false positive affects a clinical or industrial workflow. Practitioners should expect segmentation design to split by environment class, with enforcement tuned to the business consequence of failure rather than to a single policy template.

For practitioners

• Define identity as the segmentation anchor Map access policy to user, device, workload, or asset identity rather than relying on network location alone, especially where legacy or unmanaged assets are present.
• Measure visibility before widening enforcement Establish a baseline for what is on the network, who is remoting into it, and what is exposed without authentication before you expand segmentation scope.
• Separate IT and OT policy logic Keep policy intent, enforcement, and exception handling distinct across operational and enterprise environments so a block in one domain does not create unacceptable operational impact in the other.
• Automate identity-aware policy updates Use automation to keep segmentation rules aligned with changing identity, asset, and access conditions instead of relying on manual reconfiguration cycles.

Key takeaways

• Identity-first microsegmentation is emerging as a practical response to environments where network location no longer tells the full trust story.
• The article frames visibility as a measurable prerequisite for enforcement, not a side benefit of discovery tools.
• Security teams need identity-based policy models that can adapt across IT, OT, and unmanaged assets without copying one control design everywhere.

Key terms

• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Operational technology segmentation: The practice of separating industrial or clinical systems so security controls do not interfere with safety or production. In OT, a control can be technically correct yet operationally unsafe, so policy design has to account for process continuity as well as access restriction.
• Visibility baseline: The minimum measurable view of assets, users, and access paths needed to judge whether a control is actually working. In identity and segmentation programmes, a visibility baseline turns discovery from an inventory exercise into a governance input for policy decisions.
• Identity-Aware Automation: Identity-aware automation uses identity, history, and contextual signals to support decisions inside an operational workflow. In fraud and support settings, it helps staff act consistently without relying on guesswork, while preserving a record of why a decision was made.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.