Microsegmentation limits lateral movement, but zero trust still needs identity

At a glance

What this is: This is an analysis of macrosegmentation versus microsegmentation, with the central finding that workload-level, identity-aware controls are needed to stop lateral movement inside a breached environment.

Why it matters: It matters because IAM, NHI, and cloud security teams cannot treat network zoning as a substitute for identity-aware authorization between workloads, services, and users.

Context

Macrosegmentation groups assets into broad network zones and is effective at filtering traffic that crosses a boundary, but it does little once an attacker is already inside a zone. The governance gap is the assumption that perimeter inspection can contain threats that move laterally between workloads, services, or accounts. In identity-heavy environments, that gap becomes an access-control problem as much as a network problem.

Microsegmentation narrows the control plane to the workload level and changes the trust decision from zone membership to identity-aware policy. That matters for NHI governance because service accounts, workloads, and users often share internal connectivity paths that traditional segmentation does not distinguish well. The article’s starting position is typical for organisations that have invested in perimeter controls before east-west visibility.

Key questions

Q: Where does macrosegmentation fail in practice?

A: Macrosegmentation fails when an attacker already has a foothold inside a zone and can move laterally to other assets without crossing the perimeter. It is designed to inspect north-south traffic, so it can leave east-west communications largely untouched. That means one compromised host can become a bridge to higher-value systems unless internal access is separately controlled.

Q: Why do internal workload connections increase breach impact?

A: Internal workload connections increase breach impact because they create trusted pathways that attackers can reuse after the first compromise. If those paths are governed only by network location, the same credentials or host access can open access to adjacent systems, sensitive data, or core services. The result is a much larger blast radius than the original entry point.

Q: What are the signs that segmentation is failing to contain lateral movement?

A: The clearest signal is when one or two access paths dominate the reachability of critical assets even though the environment appears segmented. If remote admin and identity-linked routes still connect key systems with high probability, the control is too weak to change blast radius meaningfully.

Q: How should teams combine macrosegmentation and microsegmentation?

A: Teams should use macrosegmentation to control broad network boundaries and microsegmentation to govern east-west communication between specific workloads. The two controls answer different questions. The first limits exposure across zones, while the second reduces blast radius inside a zone. A layered model is stronger than relying on either control alone.

Technical breakdown

How macrosegmentation controls north-south traffic

Macrosegmentation creates larger network zones and applies controls at the boundary between them. The policy surface is usually routers, switches, firewalls, ACLs, and inspection tools, so the model is well suited to managing traffic that crosses from outside to inside. It is much less precise inside a zone, because the control logic is tied to network placement rather than to workload identity or task context. In practice, that means it can reduce exposure to external threats while still allowing unconstrained communication among assets that share the same segment.

Practical implication: use macrosegmentation as boundary hygiene, not as the control that limits compromise spread inside a zone.

Why microsegmentation is an identity-aware control plane

Microsegmentation applies policy between workloads, not just around them. The article’s key point is that the policy decision is identity-aware, so the allowed path depends on which workload, user, or service is initiating communication and what the business need is. That shifts zero trust from a coarse network question to a granular authorization question. For NHI and cloud environments, this is especially important because service-to-service connections often persist even when the workload is ephemeral, and network location alone does not tell you whether access should continue.

Practical implication: bind east-west access to workload identity and explicit policy, not to subnet membership.

How lateral movement survives when only perimeter controls exist

Once an attacker gains a foothold through phishing, stolen credentials, or a software flaw, they usually try to move laterally to find higher-value systems and data. If controls only inspect north-south traffic, that internal movement can remain invisible or unrestricted. The article also points to the operational outcome: exfiltration, disruption, and ransomware become much easier when a single compromised asset can talk freely to peers in the same zone. This is why lateral movement is the real failure mode that segmentation must address.

Practical implication: design controls for break-out containment, not just for initial ingress inspection.

Threat narrative

Attacker objective: The objective is to spread from one compromised workload or endpoint into adjacent systems and then reach sensitive data or operationally valuable assets.

1. Entry occurs through common initial access methods such as phishing, social engineering, stolen credentials, or exploitation of a software vulnerability.
2. After the foothold is established, the attacker seeks east-west access to move from the initial host to adjacent systems inside the same network zone.
3. The attacker then targets critical systems and sensitive data, with exfiltration, ransomware deployment, or operational disruption as the likely end state.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Microsegmentation is now a trust-assumption control, not just a network design choice. Once security teams move from zone-level segmentation to workload-level policy, the question changes from where traffic enters to what identity is allowed to communicate. That is why this topic belongs in identity governance as well as network security. Practitioners should treat east-west authorization as part of the access model, not as an afterthought.

Lateral movement containment is the real test of zero trust. The article correctly shows that north-south inspection can coexist with weak internal control. In identity terms, the control gap is the gap between authenticated entry and authorised movement. Teams that do not govern internal workload-to-workload access are still accepting a large blast radius even if the perimeter looks disciplined.

Identity-aware policy needs to extend to NHIs. Service accounts, workloads, and automated processes often communicate continuously, which makes them easy to overlook in segmentation programs built around human users and subnets. That creates hidden trust paths inside cloud and hybrid estates. Practitioners should map NHI communication paths as part of segmentation design, not only as part of IAM inventories.

Blast-radius reduction is the more accurate zero-trust outcome than border defense. The article’s strongest contribution is its emphasis on surviving breach rather than preventing every initial compromise. That framing aligns with modern control thinking across NIST SP 800-207 and workload-centric identity models. Security teams should measure whether internal compromise can still spread, because that is where the control either succeeds or fails.

Macrosegmentation and microsegmentation are complementary, but they are not substitutes. Broad zones still help with administrative simplicity and boundary inspection, while fine-grained controls answer the harder question of internal trust. The mistake is to assume that one layer eliminates the need for the other. Practitioners should preserve both, but assign each to the problem it can actually solve.

From our research library:

• By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
• Read next: Zero Trust Identity Guide

What this signals

Identity-aware microsegmentation is becoming a practical zero-trust requirement, not an architectural refinement. When internal trust is still expressed in subnet terms, teams cannot see which workloads or non-human identities can move laterally after compromise. That gap pushes segmentation, IAM, and NHI governance into the same design discussion, with east-west authorization becoming a programme-level control objective.

Blast-radius reduction should become a measurable outcome for zero-trust programmes. If a single compromised asset can still reach core services or peers in the same zone, the programme has not actually reduced internal trust. Security leaders should use segmentation evidence to test whether compromise can be contained before it spreads, because perimeter success is not the same as containment success.

90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs. That view aligns with workload-level segmentation because machine and service identities are often the trust path that internal lateral movement follows.

For practitioners

• Map east-west communication paths Inventory which workloads, services, and identities talk to each other inside each zone, including internal dependencies that never cross the perimeter. Use that map to identify which connections need enforcement at the workload level rather than only at the boundary.
• Define explicit allow rules for internal access Write policy around known business flows such as bastion-to-server administration, service-to-service calls, and core infrastructure dependencies. Block peer-to-peer communications that are not operationally required, especially where they create a lateral movement path.
• Treat service accounts as segmentation subjects Include non-human identities in policy design so internal access is based on the workload or service identity, not just the subnet or host location. This is essential where automation and application traffic create persistent east-west trust.
• Segment core services first Prioritise AD, DNS, DHCP, NTP, web servers, and mail servers because compromise of these services expands attacker reach quickly across the environment. Tightening these paths reduces the blast radius when a host is breached.

Key takeaways

• Macrosegmentation helps with boundary control, but it does not adequately govern east-west movement after an internal foothold is established.
• The practical zero-trust test is whether a compromised workload can still reach adjacent systems, not whether perimeter inspection exists.
• Identity-aware microsegmentation reduces blast radius by binding internal access to specific workloads and services rather than to broad network zones.

Key terms

• Macrosegmentation: Macrosegmentation is broad network zoning that groups systems by location, asset type, or business function. It helps filter traffic across large boundaries, but it usually cannot stop movement between systems inside the same zone, which is why it is only one layer of containment.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners who need to govern machine access paths as part of zero trust. It is designed for teams building identity controls that extend beyond human users and into automated infrastructure.