Microsegmentation is still a zero trust control gap, not a cure-all

At a glance

What this is: Microsegmentation narrows east-west movement inside modern environments, but the article finds that weak topology visibility and stale policy discovery can undermine its Zero Trust value.

Why it matters: IAM and security teams should treat microsegmentation as a governance and visibility problem, because segmented policy only reduces risk when workload behaviour and access paths are actually understood.

By the numbers:

• Cybercrime costs will grow 15% per year over the next five years, according to Cybersecurity Ventures cited by StrongDM.

Context

Microsegmentation is a network security control that splits environments into smaller security zones and restricts east-west traffic between workloads. In practice, its value depends less on the label and more on whether teams can model real communication paths well enough to enforce policy without creating blind spots.

The article’s core point is that microsegmentation strengthens Zero Trust only when architecture mapping, traffic observation, and staged policy rollout are in place. For IAM and security leaders, that makes the control as much about governance of workload behaviour as about network design.

Key questions

Q: What breaks when microsegmentation policies do not reflect actual workload identity and ownership?

A: When segmentation policies do not match real workload identity and ownership, teams create false containment boundaries. Attackers can still move through approved paths, while operators lose confidence in the rules and delay enforcement. The result is slower response, weaker blast-radius reduction, and more exceptions that undermine the control over time.

Q: Why does east-west traffic create more risk than perimeter traffic in modern environments?

A: Because internal traffic often moves through trusted paths once it is inside the network, attackers can pivot laterally if those paths are not explicitly constrained. The risk is not the traffic itself, but the residual trust model that lets internal movement go unchecked.

Q: How do teams know if microsegmentation is actually working?

A: Microsegmentation is working when a compromised workload cannot reach anything outside its explicit policy boundary. The best signal is not the existence of a segmentation design, but the reduction in reachable assets after compromise. If east-west traffic still flows broadly, the control is not changing attacker economics.

Q: What is the difference between segmentation and microsegmentation in practice?

A: Segmentation divides a network into broader zones, often based on environment or function. Microsegmentation goes further by isolating smaller units such as individual hosts, applications, or workloads. That finer control lets teams apply tighter access policies, reduce lateral movement, and contain compromise more precisely without relying on broad trust inside a zone.

Technical breakdown

Why east-west traffic is harder to govern than perimeter traffic

Traditional segmentation focuses on north-south traffic at the edge, where traffic crossing the perimeter is easier to inspect. Microsegmentation shifts the control point inward, to workload-level east-west traffic, where trust decisions depend on knowing which applications, services, and processes should talk to each other. That makes the policy surface far more dynamic. In hybrid and software-defined environments, workloads move, scale, and change faster than static network diagrams do. When policy is built from stale assumptions, the result is not tighter control but invisible gaps between intended and actual communication paths.

Practical implication: teams need current workload and traffic maps before they can enforce east-west controls with confidence.

How policy discovery fails when application behaviour is poorly understood

Microsegmentation only works when policy reflects real communication patterns, including what is communicating, when, and why. The article highlights a common failure mode: manual tagging and one-time observation quickly become stale in dynamic environments. That is especially true where application dependencies and workload identity are changing continuously. In those conditions, a policy lifecycle based on snapshots cannot keep pace with the environment. The control breaks not because segmentation is conceptually weak, but because the organisation lacks reliable behavioural evidence to define the right boundaries in the first place.

Practical implication: build segmentation policy from observed behaviour, then keep validating it as workloads change.

Why phased segmentation is safer than all-at-once enforcement

The article’s phased model moves from broad zone-based policies to application-based and then finer micro policies. That sequencing matters because microsegmentation is not just a technical switch, it is a control design exercise that depends on confidence at each layer. Starting too granular without evidence increases the chance of accidental outages, overly broad exceptions, or policy drift. A phased approach gives teams room to learn traffic patterns, refine boundaries, and reduce operational risk while still improving containment. In Zero Trust terms, segmentation becomes credible only when enforcement maturity grows alongside visibility.

Practical implication: introduce segmentation in stages so enforcement tightens only after each layer is validated.

Threat narrative

Attacker objective: The attacker seeks to move laterally through the environment and reach additional workloads before defenders detect the breach.

1. Entry occurs when an attacker breaches the outer perimeter and lands inside a traditional network segment that still assumes internal traffic is trusted.
2. Credential or access abuse is amplified when east-west movement is not tightly controlled, allowing the attacker to pivot between workloads using approved internal paths.
3. Impact grows as the attacker reaches additional application segments, while weak traffic visibility delays containment and expands the breach footprint.

Breaches seen in the wild

• HPE Aruba Instant On hard-coded credentials: Hard-coded admin credentials in HPE Aruba Instant On access point firmware let anyone bypass login (CVE-2025-37103); no exploitation reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Microsegmentation is a control for east-west movement, not a cure for weak environment knowledge: The article shows that segmentation only becomes reliable when architecture mapping and traffic observation are mature enough to reflect reality. Without that, teams are enforcing policy against assumptions, not workloads. The practitioner conclusion is that visibility is the precondition for containment, not a by-product of it.

Identity blast radius is the real outcome microsegmentation is trying to shrink: By narrowing which workloads can talk to each other, organisations reduce how far a compromise can travel after initial access. That matters across NHI, human, and autonomous identity programmes because internal trust paths often outlive the identities that created them. The practitioner conclusion is to treat east-west policy as blast-radius control, not just network hygiene.

Zero Trust fails when segmentation is treated as a static design choice: The article’s phased rollout advice reflects a deeper governance truth. Access boundaries in modern environments are behavioural and time-bound, so they must be discovered and revised as applications change. The practitioner conclusion is to align segmentation review with workload change, not with perimeter-era assumptions.

Microsegmentation is strongest when it is governed like a lifecycle, not deployed like a one-time project: Policies need discovery, validation, and adjustment as workloads scale and move. That makes the control similar to other identity lifecycle disciplines, where inventory and review determine whether the control remains real. The practitioner conclusion is to operationalise segmentation as an ongoing governance process.

East-west control gaps expose a broader Zero Trust assumption about internal trust: The article reinforces that once traffic is inside the environment, many legacy designs still treat it as safe by default. That assumption is incompatible with modern hybrid estates. The practitioner conclusion is to assume internal exposure until traffic paths are explicitly authorised and continuously observed.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
• Read next: Zero Trust Identity Guide

What this signals

Identity blast radius: Microsegmentation is really about shrinking how far a compromised workload can move once it is already inside the environment. That makes it relevant to IAM, NHI governance, and any programme that still assumes internal traffic can be treated as inherently safe.

Zero Trust programmes often fail at the boundary between policy and observation. The control only holds when teams can keep workload maps current and treat segmentation as a living governance model, not a one-time network design decision.

For practitioners

• Map workload communication paths Inventory application dependencies and document which workloads actually exchange east-west traffic before tightening policy boundaries.
• Observe traffic behavior continuously Use ongoing observation to validate communication patterns, because one-time discovery quickly becomes stale in dynamic environments.
• Roll out segmentation in phases Start with broad zone-based policies, then narrow to application-based rules, and only then move to finer micro policies.
• Review blind spots around internal trust Challenge any design that still treats internal traffic as trusted, especially where hybrid cloud and virtual overlays hide movement.

Key takeaways

• Microsegmentation reduces lateral movement, but it does not remove the need for accurate traffic visibility and workload mapping.
• The article’s implementation warning is operational, not theoretical: stale knowledge of application behaviour creates blind spots inside supposedly controlled zones.
• Teams that phase segmentation, validate policies against real traffic, and revisit internal trust assumptions are more likely to make Zero Trust enforcement meaningful.

Key terms

• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Network Segmentation: Network segmentation divides traffic and resources into controlled zones so access can be restricted between groups, systems, or applications. In remote access design, segmentation limits what a connected user or workload can reach after authentication, which reduces lateral movement and shrinks blast radius.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.