Microsegmentation and ZTNA define Zero Trust breach containment

At a glance

What this is: This article argues that microsegmentation and ZTNA are complementary Zero Trust controls that contain breaches by governing both east-west and north-south traffic.

Why it matters: It matters because identity and security teams need to limit where compromised access can go next, especially when users, devices, contractors, and workloads all share the same trust plane.

Context

Zero Trust fails when teams treat external access and internal movement as separate problems. If an attacker gets in, east-west traffic becomes the real path to sensitive data, and ordinary perimeter controls no longer tell you where the blast radius ends.

Microsegmentation and ZTNA address different sides of that governance gap. Microsegmentation narrows what workloads can talk to inside the environment, while ZTNA constrains who and what can reach published resources from outside, including contractors and third parties.

Key questions

Q: What breaks when organisations build Zero Trust without microsegmentation?

A: Without microsegmentation, Zero Trust loses one of its main containment mechanisms. An attacker who gets past identity checks can still move laterally across poorly separated systems, reach critical workloads, and disrupt more of the environment than necessary. In practice, the model becomes easier to bypass because the network remains too open inside the perimeter, even if authentication is strong.

Q: Why do remote access controls need more than authentication in Zero Trust programmes?

A: Authentication proves who the user or device is, but it does not limit what that session can reach. In Zero Trust, the real risk is overbroad post-authentication access that creates unnecessary internal visibility. ZTNA matters because it narrows every session to specific applications instead of extending trust across the network.

Q: What are the signs that lateral movement risk is still too high?

A: If a single compromised account can reach many internal systems, lateral movement risk is still high. Other warning signs include shared network visibility, broad contractor access, and workload-to-workload connections that are not tied to a documented business need. Those conditions show that containment is weaker than the architecture assumes.

Q: How should security teams govern breach containment when both users and workloads are involved?

A: Teams should govern containment as an access-scope problem across identities, not just as a network design exercise. Users, contractors, service accounts, and workloads all need their own reachability limits, because compromise in any one path can become lateral spread. The right comparison is not perimeter versus Zero Trust, but broad reachability versus constrained trust boundaries.

Technical breakdown

How microsegmentation constrains east-west traffic

Microsegmentation places policy enforcement between workloads so that internal traffic is no longer implicitly trusted. Instead of assuming a flat network, each application or server pair is treated as a separate communication boundary with explicit allow rules. That matters because lateral movement depends on reachable internal paths, not just initial compromise. In practical terms, the control reduces the number of systems an attacker can probe after entry and makes privilege escalation more expensive by removing easy internal reachability.

Practical implication: map internal traffic flows and cut unnecessary workload-to-workload paths before you rely on detection alone.

How ZTNA changes north-south access control

ZTNA replaces broad network reach with per-session, context-driven access to specific applications. Rather than extending a user or device into the network, it brokers a narrow encrypted connection to only the approved resource. That is materially different from traditional remote access because the user does not inherit general network visibility. For IAM teams, the governance issue is not just authentication but the scope of access granted after authentication, especially for remote workers, contractors, and third-party access paths.

Practical implication: treat remote access as an application-level authorization problem, not a network admission problem.

Why layered containment matters after initial compromise

The article’s core architectural point is that prevention and containment solve different failure modes. Firewalls, VPNs, and perimeter checks aim to stop entry, but once compromise happens the question becomes how far the attacker can move before being stopped. Zero Trust therefore needs control points both at the entry boundary and inside the environment. Without that dual enforcement, a single compromised identity or device can still reach far more than its intended scope.

Practical implication: measure your Zero Trust design by blast-radius reduction, not by access denial at the edge alone.

Threat narrative

Attacker objective: The attacker aims to expand a single foothold into broad internal reach and sensitive-data access.

1. Entry occurs through a compromised perimeter control, user session, or other initial foothold that bypasses the outer boundary.
2. Credential or access abuse then enables the attacker to move laterally across reachable internal systems when east-west traffic is not segmented.
3. Impact follows when the attacker reaches sensitive data, escalates privileges, or spreads ransomware across the environment.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Microsegmentation is a governance control, not just a network design choice. Once an attacker is inside, the decisive question is whether east-west traffic is already constrained enough to stop internal spread. That makes workload adjacency, not just perimeter hardening, a core Zero Trust governance issue. Practitioners should treat internal reachability as an access decision, not a routing detail.

ZTNA closes a different trust gap than VPNs ever did. The article correctly distinguishes broad network access from session-specific application access, which is the right way to think about modern remote connectivity. For identity teams, the important point is that authentication does not justify network-wide visibility. Practitioners should evaluate remote access by what each session can actually reach.

Blast-radius control is the real Zero Trust maturity test. Many programmes still over-focus on entry prevention and under-invest in post-compromise containment. That creates a false sense of control because attackers only need one weak path to begin lateral movement. Practitioners should judge Zero Trust by how much damage a single compromised identity, device, or workload can still do.

This is where NHI governance intersects with network containment. Workloads, service accounts, and other non-human identities often sit on the internal paths that microsegmentation is meant to protect. If those identities can move freely between services, the environment still behaves like a flat trust zone. Practitioners should inventory non-human access paths alongside user access paths when designing containment.

Containment trust gap: the article exposes the assumption that strong edge controls make internal compromise manageable by default, which they do not. The hidden failure mode is uncontrolled east-west reachability after initial access. Practitioners should redesign policy around the smallest acceptable communication set, not the largest tolerated one.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Microsegmentation is becoming the practical expression of Zero Trust inside the environment. Teams that only harden the edge still leave lateral movement opportunities open, which means breach containment remains incomplete. For IAM and security architects, the question is no longer whether access is authenticated, but whether it is bounded tightly enough to stop internal spread.

Non-human identities make the containment problem more urgent. Workloads and service accounts often carry the internal permissions that attackers try to reuse after entry, so a flat east-west model creates avoidable blast radius. Practitioners should align workload identity governance with segmentation policy rather than treating them as separate programmes.

Blast-radius reduction should become a measurable control objective. The real test of a Zero Trust programme is how far a compromised identity can travel before policy blocks it, not whether the first login was successful. That shifts the operating model toward containment testing, access minimisation, and continuous review of reachable systems.

For practitioners

• Define east-west policy boundaries for critical workloads Map which servers, applications, and services truly need to communicate, then deny the rest so internal movement is not implicit.
• Replace broad remote access with session-scoped ZTNA Limit every remote session to only the specific application or resource the user or vendor is authorised to reach.
• Audit third-party and contractor reachability Review every external user path for unnecessary visibility into internal systems, especially where contractors or vendors touch production resources.
• Measure containment by blast radius Test how far a compromised account or workload can move before segmentation or authorization blocks it, then tighten the widest paths first.

Key takeaways

• Microsegmentation and ZTNA solve different Zero Trust failures, with one constraining internal movement and the other narrowing external session reach.
• The article’s core message is that breach resilience depends on containment after entry, not just on preventing entry at the edge.
• For identity and security teams, the key control question is how much damage a single compromised session, identity, or workload can still cause.

Key terms

• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Zero Trust Network: A Zero Trust Network is a network security approach that does not trust users, devices, or traffic by default. Every connection is continuously verified using identity, device posture, context, and policy before access is granted. It assumes breach, limits lateral movement, and treats network access as conditional rather than implicit.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps practitioners connect identity control design to containment, resilience, and operational accountability across modern environments.