TL;DR: Zero-trust programmes still stall when teams treat microsegmentation as optional, according to Elisity, because ZTNA controls north-south access but not the east-west movement that attackers use after initial access. Microsegmentation has become more practical through identity-based, agentless enforcement, so the real question is whether organisations can operationalise it across IT, OT, and IoT.
At a glance
What this is: This is Elisity's analysis of why microsegmentation remains central to zero trust, with the key finding that identity-based, agentless enforcement is changing what is operationally feasible.
Why it matters: It matters because IAM and security architects cannot treat zero trust as a perimeter or access problem alone when lateral movement inside the environment is still the main gap.
Context
Microsegmentation is the practice of creating granular security boundaries between systems so east-west traffic is governed by identity and policy rather than by implicit network trust. The article argues that the control has long been treated as too complex to operationalise, which is why many zero-trust programmes stopped at user access and never contained lateral movement inside the environment.
For IAM and security teams, the gap is not conceptual. It is an operating-model problem: ZTNA can verify who or what connects in, but it does not decide which internal assets should be allowed to talk to each other after access begins. That is where microsegmentation becomes the enforcement layer that zero trust still needs.
Key questions
Q: What breaks when zero trust stops at user access and ignores internal traffic?
A: When zero trust focuses only on north-south access, the internal environment remains permissive enough for lateral movement after the first foothold. That leaves attackers free to move from one compromised asset to the next. Microsegmentation closes that gap by applying explicit policy to east-west communication inside the network.
Q: Why does microsegmentation reduce risk even when initial access is already controlled?
A: Because initial access control does not stop an attacker from moving laterally once inside. Microsegmentation limits which internal systems can talk to each other, so a compromised device or credential has less room to expand into higher-value targets. The risk reduction comes from containment, not from preventing the first login.
Q: How do security teams know if identity-based segmentation is actually working?
A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services. If lateral movement, management-plane access, or service-to-service discovery still succeeds, segmentation is too coarse. Effective segmentation shows up as denied pathways, reduced reachable surface, and a clear separation between user, management, and critical workloads.
Q: Why do ZTNA and microsegmentation need to work together?
A: ZTNA limits who can reach specific applications from outside, while microsegmentation limits how far access can move once traffic is inside. Used together, they reduce both initial access breadth and lateral movement potential. If only one is deployed, attackers can still exploit the other path to expand their reach across the environment.
Technical breakdown
Why legacy segmentation failed at scale
First-generation microsegmentation depended on complete flow mapping, endpoint agents, or heavy network rework through VLANs and ACLs. That model breaks down because large environments contain too many dynamic device-to-device paths to enumerate accurately, especially when IoT, OT, and medical systems are involved. The result is a control that looks precise on paper but stalls before broad production deployment. The article's core technical point is that operational complexity, not policy intent, made the old model brittle.
Practical implication: treat broad flow discovery and legacy network constructs as migration constraints, not as a final segmentation design.
Identity-based microsegmentation and agentless enforcement
The newer approach anchors policy to device identity, function, and context instead of IP address or subnet location. That changes the enforcement model from manual per-flow rule writing to rules that follow the asset wherever it moves. Agentless enforcement at the network edge also avoids the endpoint limitation that excluded many unmanaged or constrained devices. In practice, this is what makes segmentation feasible across mixed IT, OT, and IoT estates without forcing every device to run software agents.
Practical implication: define segmentation policy around identity and asset role, then validate whether your enforcement points can cover unmanaged and non-agent-capable devices.
Why zero trust still needs east-west controls
Zero trust is not complete when the programme focuses only on north-south traffic. ZTNA governs initial access from users or devices into applications, but once an attacker lands on a host or reaches a trusted internal segment, the real danger shifts to lateral movement. Microsegmentation closes that interior trust gap by limiting how far a compromise can propagate. NIST SP 800-207 and CISA's zero-trust guidance both reflect that architectural distinction.
Practical implication: align zero-trust design reviews to internal movement paths, not only to user-to-application access flows.
Threat narrative
Attacker objective: The attacker aims to expand a single foothold into broad internal reach by moving laterally across trusted assets.
- Entry begins when a user, endpoint, or device obtains legitimate access through a perimeter or remote-access path that zero trust already controls.
- Escalation happens when the compromised foothold is able to communicate laterally to higher-value internal assets because internal boundaries are too coarse.
- Impact follows when the attacker reaches additional systems, spreading from the initial compromise instead of being contained to a single segment.
Breaches seen in the wild
- Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Microsegmentation is no longer an optional design choice inside zero trust programmes. Zero trust that stops at user access leaves the interior of the environment governed by legacy trust assumptions. That assumption fails because attackers do not need to break every boundary if they can move laterally after the first foothold. The practical conclusion is that microsegmentation now defines whether zero trust is actually enforceable.
Identity-based policy is the real control shift, not just a deployment shortcut. When segmentation is anchored to what an asset is and what it should do, policy becomes portable across changing networks and device types. That matters because modern estates include managed endpoints, legacy systems, IoT, and OT in the same trust domain. Practitioners should view identity anchoring as the mechanism that turns segmentation from a network project into an access-governance control.
Agentless enforcement changes the governance equation for constrained devices. The old model assumed every endpoint could host software or tolerate heavy reconfiguration. That assumption breaks for headless, regulated, or operational technology devices that cannot support agents. The implication is that segmentation programmes must be evaluated on coverage across device classes, not on how well they perform in the easy parts of the environment.
Microsegmentation has become a control for containment, not just architecture purity. The market conversation should move away from whether segmentation is elegant and toward whether it shortens attacker reach after initial compromise. That is the same language security leaders use for blast-radius reduction, and it is now the right way to assess zero-trust maturity.
Zero-trust maturity depends on whether east-west policy is as real as north-south policy. ZTNA may authenticate the entry point, but the internal trust model still decides how far compromise travels. Teams that separate those planes in governance, budget, and architecture planning will keep discovering that a perimeter-conscious zero-trust programme is incomplete.
From our research library:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
- Read next: Zero Trust Identity Guide
What this signals
Identity-based segmentation is becoming the practical control that separates zero trust claims from zero trust containment. Teams that only hardened access entry points are still exposed to lateral movement inside the environment, so the next programme question is whether east-west policy exists at all. For architecture teams, that means evaluating segmentation as an identity and containment control rather than as a network cleanup exercise.
Microsegmentation now sits in the same decision set as workload and device identity governance. When enforcement depends on what an asset is, governance has to track asset role, device class, and policy scope together. That changes operating priorities for organisations that have historically treated segmentation as a network team concern rather than as part of broader identity architecture.
Zero-trust maturity only becomes credible when internal trust boundaries are measurable. The programme signal to watch is whether a compromise can be confined to one segment without relying on manual intervention. If the answer is no, the environment may be authenticated at the edge but still functionally flat inside.
For practitioners
- Map east-west trust paths Inventory which internal systems can communicate today without explicit policy, then identify where lateral movement could bypass zero-trust controls.
- Redesign segmentation around identity Use device identity, function, and context as the policy anchor instead of IP addresses or static subnets.
- Validate coverage across constrained assets Test whether your segmentation model covers IoT, OT, medical, and other non-agent-capable devices without exception.
- Reassess zero-trust maturity criteria Measure whether your programme can actually contain a compromise inside the network, not only authenticate inbound access.
- Pilot against existing infrastructure Prefer rollout patterns that use current switches and access points so segmentation can be deployed incrementally instead of waiting for full network replacement.
Key takeaways
- Microsegmentation is the missing interior control when zero trust verifies entry but does not constrain movement after access is granted.
- The article's central evidence is that first-generation segmentation failed because complexity overwhelmed implementation, while identity-based enforcement lowers that barrier.
- For practitioners, the deciding issue is whether segmentation can contain lateral movement across IT, OT, and IoT without depending on endpoint agents or years of network rework.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Zero trust segmentation depends on explicit internal access permissions and boundaries. |
| Recommendation — Apply PR.AA-05 to restrict east-west communication to approved asset relationships. | ||
| NIST Zero Trust (SP 800-207) | Architectural Principles — Architectural Principles | The article directly frames microsegmentation as a zero-trust architectural requirement. |
| Recommendation — Use zero-trust architecture principles to enforce internal segmentation as part of the access path. | ||
| MITRE ATT&CK | TA0008 — Lateral Movement | The article's core risk is attacker movement across internal systems after initial access. |
| Recommendation — Map segmentation gaps to TA0008 and prioritise controls that block internal lateral movement. | ||
| CIS Controls v8 | CIS-5 — Account Management | Identity-based policy still relies on governed asset and account relationships across the environment. |
| Recommendation — Align account and asset governance with segmentation boundaries so identity rules stay current. | ||
Key terms
- Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
- East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
- Identity-based Policy: An identity-based policy attaches to a user, group, or role and defines what that identity is allowed to do. It travels with the identity rather than the target resource, which makes it useful for central entitlement management. The main governance risk is allowing these policies to grow broader over time.
- Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org