Microsegmentation in manufacturing: the lateral movement gap persists

At a glance

What this is: This Elisity analysis shows that manufacturing’s microsegmentation ambition far outpaces real coverage, leaving most critical systems exposed to lateral movement.

Why it matters: It matters because manufacturing security teams are being asked to contain ransomware and operational disruption with controls that are still too incomplete to stop spread inside industrial networks.

By the numbers:

• Nearly 50% of organizations experienced lateral movement attacks in the past year.
• 99% are implementing or planning microsegmentation, but only 9% have more than 80% of critical systems protected.
• 57% prioritize microsegmentation for lateral movement prevention, yet only 24% have deployed it.
• 69% identified identity-based microsegmentation as the most desirable feature in a modern solution.

Context

Manufacturing microsegmentation is a control problem, not an awareness problem. The core issue is that legacy segmentation methods were built for static, IP-centric networks, while modern industrial environments mix IT, OT, IoT, vendor access, and remote engineering workflows that need finer policy boundaries.

The identity connection is real and important: in manufacturing, effective segmentation increasingly depends on device identity, user context, and flow-level policy rather than VLANs or ACLs alone. That makes this a governance question for both network security and IAM-adjacent teams responsible for access scope and containment.

The survey data makes the starting position look typical rather than exceptional, which is itself the warning sign. Most organisations want the control, but most have not operationalised it across the systems that matter most.

Key questions

Q: What breaks when healthcare microsegmentation is only partially deployed?

A: Partial deployment leaves unsegmented clinical pathways open, so a foothold on one device can still reach EHR systems, monitoring tools, or other high-value services. The result is a false sense of containment, because the attacker only needs one reachable path to expand impact across care delivery.

Q: Why does incomplete segmentation increase ransomware impact in industrial networks?

A: Incomplete segmentation lets ransomware spread beyond the first compromised device into production-connected assets, which increases the chance of shutdowns, recovery cost, and operational disruption. The risk is not just data loss. It is the ability of malware to move laterally across environments where downtime has physical consequences.

Q: How do teams know if microsegmentation is actually working?

A: Microsegmentation is working when a compromised workload cannot reach anything outside its explicit policy boundary. The best signal is not the existence of a segmentation design, but the reduction in reachable assets after compromise. If east-west traffic still flows broadly, the control is not changing attacker economics.

Q: What should manufacturing security leaders do when segmentation policies disrupt operations?

A: They should distinguish between a policy that is too broad and a policy that exposes an unmanaged dependency. The right response is to refine identity-aware rules, test them in simulation, and preserve production continuity while tightening the paths an attacker could use.

Technical breakdown

Why VLANs and ACLs still fail in manufacturing environments

Traditional VLANs and access control lists create coarse boundaries, but they do not stop movement inside a trusted segment. In manufacturing, that weakness matters because once an attacker reaches one workstation, engineer laptop, or remote-access path, east-west movement can reach PLCs, HMIs, historians, and supporting systems that share the same broadcast or policy domain. ACLs are usually IP and port based, so they cannot express identity-aware intent such as which authenticated engineer, on which device, may reach which control asset. The architecture problem is that the policy primitive is too blunt for industrial complexity.

Practical implication: replace coarse network boundaries with identity-based policy enforcement that can distinguish user, device, and flow context.

How identity-based microsegmentation changes the enforcement model

Identity-based microsegmentation shifts the control point from address space to identity and communication intent. Instead of assuming all devices in a subnet should trust each other, it classifies assets and users, maps allowed relationships, and enforces only the flows required for the task. That is especially relevant in OT because many industrial devices cannot run agents, cannot tolerate downtime, and cannot be reorganised into a clean modern architecture. Agentless enforcement and policy simulation are therefore not convenience features but prerequisites for practical control in mixed manufacturing environments.

Practical implication: build policies around device identity and allowed communication paths, not around what the underlying infrastructure happens to expose.

Why operational overhead creates the microsegmentation gap

The main blocker is often not technical feasibility but the cost of change. If each policy adjustment requires long troubleshooting cycles, redesign work, and manual approval churn, coverage stalls before it reaches the systems most exposed to ransomware spread. In manufacturing, that creates a widening disparity between stated Zero Trust intent and actual containment capability. Governance fails when the organisation can describe the control in strategy decks but cannot sustain it through production constraints, vendor access, and frequent asset change. The result is a control that exists in principle but not at attack time.

Practical implication: measure segmentation success by protected critical-systems coverage, not by whether a programme has been announced or piloted.

Threat narrative

Attacker objective: The attacker wants to move from one initial foothold into production-relevant systems quickly enough to disrupt operations, extort the victim, or steal sensitive industrial data.

1. Entry occurs when an attacker reaches a manufacturing environment through a compromised account, remote access path, or another initial foothold inside the trust boundary.
2. Credential and access reuse then let the attacker pivot laterally through connected systems because internal segmentation is incomplete or too coarse to stop movement.
3. Impact follows when ransomware or destructive activity spreads from the initial foothold into production-connected assets, interrupting operations and forcing shutdowns.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manufacturing has a containment problem disguised as a segmentation problem: the industry is already buying into microsegmentation, but most deployments stop short of the systems that matter most. That gap is what attackers exploit, because ransomware does not need to defeat the concept of segmentation if the critical assets remain outside its enforcement boundary. The practitioner lesson is that architecture intent is not the same as attack resistance.

Identity-based policy is becoming the real differentiator in industrial segmentation: IP-centric controls cannot express the relationship between a specific engineer, a specific device, and a specific control system. That creates a genuine intersection between network security and identity governance, because access scope now determines whether lateral movement can be contained. The practitioner conclusion is that segmentation programmes need identity semantics, not just network topology.

Modern microsegmentation exposes a familiar governance failure mode: under-covered control scope: organisations often count implementation as progress long before they have meaningful coverage across crown-jewel systems. In risk terms, the assumption that a deployed control is a control in practice is what fails here. The practitioner conclusion is to treat coverage depth as the security outcome, not deployment intent.

Microsegmentation fatigue is now a programme risk in its own right: when change overhead is high, teams revert to familiar but insufficient tools such as VLANs and ACLs. That does not solve the problem, it preserves it under a governance label. The practitioner conclusion is that if the control cannot survive operational reality, it will not survive adversary pressure.

Zero Trust in manufacturing is being validated, but only partially: the survey shows the strategy has broad acceptance, yet execution still lags in the environments where disruption cost is highest. That means the market is moving toward more identity-aware, agentless enforcement models, not because they are fashionable, but because legacy segmentation cannot keep pace with industrial attack paths. The practitioner conclusion is to re-evaluate containment architecture before the next ransomware event tests it.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Identity-aware segmentation is becoming the practical bridge between OT containment and IAM-style governance: manufacturing networks need rules that follow user and device context, not just subnets and ports. That shifts containment from topology management to access governance, which is where many industrial programmes still lack mature operating models.

Coverage depth matters more than architecture labels: a programme can claim microsegmentation and still leave the assets that matter most outside the control boundary. For practitioners, the governance question is whether the critical systems are actually protected, not whether the control exists in a design document.

Manufacturing security teams should expect more pressure to prove containment, not just segmentation intent: insurers, auditors, and internal risk owners increasingly want evidence that lateral movement can be constrained in production-like conditions. That makes operational validation and policy simulation part of the security outcome, not optional implementation detail.

For practitioners

• Prioritise critical-system coverage first Map the systems that would cause operational shutdown if reached by lateral movement, then segment those assets before extending policy elsewhere.
• Replace IP-centric policies with identity-aware rules Use user context, device identity, and allowed communication patterns to define policy, especially where VLANs and ACLs cannot express the needed granularity.
• Simulate policies before enforcement Test communication rules in observe mode so that manufacturing teams can catch hidden dependencies, remote-access exceptions, and production-impacting blocks before rollout.
• Track coverage as a control metric Measure the percentage of critical systems under active microsegmentation rather than reporting deployment intent or pilot status as proof of containment.
• Align segmentation with OT operating constraints Design for assets that cannot accept agents, change windows that are narrow, and protocols that are sensitive to latency, so the control remains usable in production.

Key takeaways

• Manufacturing microsegmentation is now an execution problem, with many organisations still far from protecting the systems that would matter most in a ransomware event.
• The main security issue is lateral movement, because partial coverage still leaves pathways for attackers to move from one foothold into production-connected assets.
• Practitioners should measure success by critical-system coverage, identity-aware policy enforcement, and whether the control can be sustained without disrupting industrial operations.

Key terms

• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course if you are building governance skills across access, identity, and operational control.