Microsegmentation adoption gaps are leaving lateral movement exposed

At a glance

What this is: Microsegmentation adoption is lagging well behind market expansion, leaving east-west lateral movement insufficiently contained across enterprise environments.

Why it matters: IAM, PAM, NHI, and security teams need this because segmentation gaps turn trusted internal access into an easy movement path once an endpoint or workload is compromised.

By the numbers:

• The global microsegmentation market will grow from $8.2 billion in 2025 to over $41 billion by 2034.

Context

Microsegmentation is the practice of limiting east-west traffic so a compromised host cannot move freely across an environment. The problem is not whether the control works in principle, but whether it is actually deployed broadly enough to contain lateral movement in real enterprises, especially where managed servers, OT, IoT, and cloud workloads coexist.

The article's core security gap is adoption, not concept maturity. For IAM and identity practitioners, that matters because modern segmentation increasingly depends on identity-based enforcement, which ties network access decisions back to workload, device, or human identity rather than only to static network zones.

Key questions

Q: What fails when microsegmentation is only partially deployed?

A: Partial deployment leaves internal trust paths that attackers can still use after the first compromise. The failure is not just incomplete policy coverage, but inconsistent containment across unmanaged devices, cloud workloads, and shared infrastructure. Teams should judge the gap by which east-west paths remain open, not by whether the programme has started.

Q: Why does lateral movement remain so common in segmented environments?

A: Lateral movement persists when segmentation rules do not cover the actual communication paths attackers use. If identity, device type, or workload context is missing, the network still behaves like a broad trust zone. The result is that a single compromised account or host can move farther than security teams expect.

Q: How do teams know if microsegmentation is actually working?

A: Microsegmentation is working when a compromised workload cannot reach anything outside its explicit policy boundary. The best signal is not the existence of a segmentation design, but the reduction in reachable assets after compromise. If east-west traffic still flows broadly, the control is not changing attacker economics.

Q: Should organisations prioritise agentless microsegmentation over agent-based coverage?

A: They should prioritise the model that matches the estate they actually run. Agent-based tools can be strong on managed servers, but agentless coverage is often more realistic for OT, IoT, and other unmanaged assets. The right sequence is usually coverage first, then deeper optimisation where agents are viable.

Technical breakdown

Why lateral movement persists without microsegmentation

Microsegmentation works by shrinking the trust zone after initial compromise. Instead of assuming an internal network is safe, policy is applied between workloads, devices, or identity groups so an attacker cannot laterally reuse access once inside. Where that control is missing, credentials, sessions, and open ports become movement paths rather than isolated access points. In mixed estates, the challenge is deployment friction: agents, firewall chokepoints, or hypervisor dependencies can slow rollout and leave large sections unsegmented.

Practical implication: map east-west exposure by segment, not by perimeter, and prioritise the routes most likely to carry lateral movement.

Identity-based enforcement vs network-zone segmentation

Identity-based enforcement binds access decisions to who or what is actually communicating, while network-zone segmentation relies on topology and static boundaries. That difference matters for environments with unmanaged devices, ephemeral workloads, or shared infrastructure, where network location alone is a weak indicator of trust. Identity-based policy is also more compatible with zero trust because it can express least privilege at the point of access instead of assuming the network boundary will do the job.

Practical implication: evaluate whether your segmentation model can follow identity and not just IP ranges or subnets.

Agentless, agent-based, and inline microsegmentation models

The implementation model shapes coverage. Agent-based platforms typically give deep workload visibility but require software on the endpoint. Agentless approaches enforce policy on the network or adjacent infrastructure, which is essential for devices that cannot host software. Inline firewall-based models can cover east-west traffic but may introduce operational chokepoints and more complex policy paths. The right model depends on whether the estate is mostly managed servers or a mix of IT, OT, and IoT.

Practical implication: match the control model to the device estate before you standardise on a segmentation architecture.

Threat narrative

Attacker objective: The attacker wants to move from one foothold to broader internal access, then reach privileged systems or sensitive data without being stopped by east-west controls.

1. Entry occurs through a compromised endpoint, stolen login, or exposed workload that still has internal network reach.
2. Credential or session abuse then allows the attacker to probe adjacent systems and reuse trusted paths inside the environment.
3. Escalation and lateral movement continue until the attacker reaches higher-value workloads, administrative services, or data stores.
4. Impact is the spread of compromise across internal segments that were assumed to be trusted but were not actually isolated.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Microsegmentation adoption gap: the real governance issue is not tool availability but incomplete control coverage. Enterprises can discuss zero trust architecture for years while leaving large internal segments open to movement after compromise. Practitioners should treat deployment coverage as a governance metric, not a design aspiration.

Identity-based enforcement is now the practical test of segmentation: topology-only controls are too brittle for mixed estates that include cloud workloads, unmanaged devices, and shared infrastructure. When access policy follows identity and not just location, internal trust becomes measurable and revocable. Practitioners should align segmentation decisions with identity governance, not just network engineering.

Agentless coverage matters because many critical assets cannot host software: OT, IoT, medical, and embedded devices often sit outside agent-based assumptions. That leaves a control blind spot unless policy is enforced at the network edge or adjacent infrastructure. Practitioners should judge segmentation by what it can actually cover, not by how well it works on managed endpoints.

Least privilege inside the network is still under-implemented: many programmes secure the perimeter, then allow broad east-west access internally. That is precisely where lateral movement turns a single compromise into an enterprise incident. Practitioners should treat internal access as a privileged trust zone that must be narrowed continuously.

Microsegmentation adoption lag is creating security debt: the market is growing quickly, but adoption remains narrow enough that exposure is still the norm. The named concept here is east-west trust debt, meaning the residual internal access organizations leave in place because segmentation has not been fully deployed. Practitioners should measure and retire that debt before attackers do it for them.

What this signals

East-west trust debt: segmentation programmes now fail less often because the idea is wrong and more often because the deployment surface is too broad. The practical issue for readers is whether internal trust paths still exist between high-value systems, unmanaged devices, and cloud workloads that were never brought under explicit policy.

The governance question is whether your programme can enforce least privilege inside the network, not just on the perimeter. Where identity-based enforcement is available, it should be used to narrow trust at the point of access, especially in mixed estates that contain workloads, devices, and privileged administrative paths.

For practitioners

• Quantify east-west exposure by segment Inventory where workloads, devices, and identity groups can still talk laterally without explicit policy. Rank those paths by business criticality and known compromise likelihood so the first deployment wave targets the most dangerous movement routes.
• Prioritise unmanaged and shared devices first Start segmentation coverage with OT, IoT, medical, and other unmanaged assets that cannot run software agents. These systems are the hardest to govern through endpoint controls and the most likely to remain open if you wait for a uniform agent rollout.
• Tie segmentation rules to identity signals Use user, workload, and device identity where available so policy can survive IP changes, cloud mobility, and shared infrastructure. Identity-linked rules are easier to align with zero trust and easier to revoke when access assumptions change.
• Test containment with lateral movement scenarios Validate whether a compromised host can reach admin ports, management planes, and adjacent workloads after initial access. Use those tests to confirm that deny-by-default rules are actually stopping internal movement rather than just documenting it.

Key takeaways

• Microsegmentation is a containment control, not a design preference, and partial adoption leaves internal movement paths open after initial compromise.
• The biggest gap is operational coverage across mixed estates, where unmanaged devices and cloud workloads do not fit a single enforcement model.
• Identity-linked internal policy gives security teams a more realistic way to reduce lateral movement than relying on network zoning alone.

Key terms

• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Identity-Aware Enforcement: Identity-aware enforcement is policy decisioning that uses who the user is and which account or context they are using. For browser AI, it helps distinguish sanctioned corporate use from unmanaged personal sessions and applies different controls based on that distinction.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It is designed for practitioners building identity controls across cloud, platform, and security operations programmes.