Microsegmentation still lags adoption despite lateral movement risk

At a glance

What this is: Elisity argues that microsegmentation adoption is still far below market growth, leaving lateral movement risk materially under-controlled in enterprise environments.

Why it matters: IAM, PAM, NHI, and security teams should treat internal movement controls as a governance issue because compromised identities, workloads, and devices can still traverse too much of the network once initial access is gained.

By the numbers:

• The global microsegmentation market will grow from $8.2 billion in 2025 to over $41 billion by 2034.
• Gartner estimates that only 5% to 20% of enterprises have adopted microsegmentation.

Context

Microsegmentation is the practice of constraining east-west traffic so a compromised host cannot move freely across internal systems. In this article, the governance gap is not the concept itself but the persistent gap between stated risk reduction goals and actual deployment across mixed IT, OT, IoT, and cloud estates.

The article’s primary identity angle is indirect but real: lateral movement frequently turns stolen human credentials, service accounts, and privileged access into broader compromise. That makes microsegmentation relevant to identity governance because it limits how far an abused identity can travel after authentication has already failed as a control boundary.

Key questions

Q: Where does IP-based microsegmentation fail in practice?

A: It fails when network location is treated as the trust boundary for actors whose identities, sessions, and permissions change faster than the subnet model. Workloads, service accounts, and AI agents can keep moving even when the IP rule set looks strict, so the control limits traffic paths but not the authorisation that drives movement.

Q: Why does inconsistent segmentation increase lateral movement risk?

A: Inconsistent segmentation increases risk because east-west traffic is only contained where enforcement is actually aligned. If a path between environments is expressed differently in separate tools, the security team may believe a restriction exists when it is missing, broader or never evaluated. That gives attackers a practical route to move from a foothold into higher-value systems.

Q: How do security teams know if identity-based segmentation is actually working?

A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services. If lateral movement, management-plane access, or service-to-service discovery still succeeds, segmentation is too coarse. Effective segmentation shows up as denied pathways, reduced reachable surface, and a clear separation between user, management, and critical workloads.

Q: What should organisations prioritise first, segmentation or identity-based access control?

A: Prioritise identity-based access control when your environment is defined by cloud workloads, service accounts, and machine identities that move faster than network boundaries. Segmentation still matters, but identity gives policy a stable reference point for who or what should be allowed to connect. That makes least privilege easier to enforce and easier to audit.

Technical breakdown

Why microsegmentation matters for lateral movement

Microsegmentation breaks a network into smaller trust zones and enforces policy between workloads, devices, or applications. Instead of assuming that a device inside the perimeter is trustworthy, the control limits east-west reach after authentication or device admission. That matters because lateral movement usually succeeds when one compromise leads to many reachable targets. In practical terms, segmentation changes the attacker’s path from broad traversal to narrow, policy-constrained movement. It is most effective when the enforcement point matches the environment, whether that is the host, the network edge, the hypervisor, or an identity layer.

Practical implication: map the enforcement point to the asset class you need to contain, not to the platform that is easiest to buy.

Agent-based, agentless, and identity-based enforcement

The article contrasts three broad models. Agent-based tools place software on hosts and can provide deep workload context, but they depend on endpoint coverage. Agentless tools enforce through network controls and are often better for unmanaged, OT, or IoT assets that cannot run software. Identity-based segmentation ties access policy to who or what the asset is, allowing policy decisions to reflect account, device, or workload identity rather than only IP address or subnet. The architecture choice determines coverage, operational overhead, and how quickly the control can be deployed across diverse environments.

Practical implication: choose the enforcement model that matches the estate you actually run, especially where unmanaged devices or non-human identities are common.

Why adoption lags despite clear risk

The adoption gap is usually a governance and deployment problem, not a lack of theoretical value. Enterprises often have heterogeneous estates, legacy dependencies, and operational teams that fear disruption from policy errors. Microsegmentation also competes with other network and identity priorities, so it is frequently piloted in one zone and never scaled. The result is a control that is widely endorsed but unevenly implemented. That pattern is consistent with many containment controls: they are easiest to justify after an incident and hardest to operationalise before one.

Practical implication: evaluate whether segmentation is being managed as a pilot project instead of a control programme with scope, ownership, and rollout criteria.

Threat narrative

Attacker objective: The attacker’s objective is to turn one successful compromise into broader internal access and higher-value impact before defenders can contain the breach.

1. Entry commonly begins with a compromised host or valid credential that already has some internal reach, allowing an attacker to operate inside the environment rather than at the perimeter.
2. Escalation occurs when weak internal segmentation lets that initial foothold probe adjacent systems, discover higher-value assets, and move beyond the original trust zone.
3. Impact is broader compromise of systems, data, or operational technology that could have been contained if internal movement boundaries were enforced earlier.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Microsegmentation is now a lateral-movement governance problem, not just a network design choice. The article’s core signal is that the market is expanding while actual deployment remains narrow, which means many organisations still rely on perimeter assumptions inside environments that have already dissolved. For identity teams, the issue is especially relevant because compromised accounts, service identities, and privileged sessions become more damaging when internal traversal is easy. Practitioners should treat containment as a governance control with explicit scope, ownership, and success criteria.

Identity-based segmentation deserves attention because internal trust still follows identity abuse. When an attacker enters through a valid login, stolen token, or over-permissioned service account, the key question becomes how far that identity can move after first access. Microsegmentation does not replace IAM or PAM, but it limits blast radius when identity controls fail. The practitioner takeaway is to evaluate containment alongside authentication and privilege reduction, not after them.

Agentless coverage is the named concept that matters most in mixed estates. The article makes clear that many real environments include OT, IoT, and unmanaged devices that cannot run endpoint software, which is why agent-centric models leave gaps. That reality is a governance issue as much as an architecture issue because policy coverage is only as good as the assets you can actually enforce. Teams should assess segmentation reach by asset class, not by feature list.

Microsegmentation maturity should be measured by containment reach, not vendor count. The market comparison shows many options, but the real question is whether policy can be enforced across the assets and trust paths that matter most. If coverage is partial, the organisation still has standing lateral-movement exposure even if a tool is technically deployed. Practitioners should define segmentation success in terms of reachable reduction, not installation completion.

This topic validates a broader identity-security principle: internal access must be assumed hostile. Once a human or non-human identity is authenticated, internal routes often become the easiest part of the attack path. Microsegmentation helps convert that assumption into a measurable control, but only when teams move from isolated pilots to environment-wide enforcement. The practical conclusion is simple: containment must be planned as part of identity governance and resilience, not left to network teams alone.

What this signals

Lateral-movement containment is becoming a governance test, not a tool selection exercise. The important question is whether an organisation can actually enforce internal boundaries across the assets it cares about, including unmanaged and hybrid devices. If the answer is no, the estate still behaves as though authentication alone is enough, which is exactly the assumption attackers exploit.

Agentless coverage will matter more in mixed estates than in clean server-only environments. Once OT, IoT, and legacy devices enter the picture, agent-based controls alone will not cover the full internal attack surface. Teams should evaluate segmentation by coverage of real assets and real trust paths, not by how tidy the deployment story looks in a demo.

For practitioners

• Define segmentation by trust boundary, not by product category Inventory where the environment actually needs internal containment across user workstations, servers, OT, IoT, and cloud workloads. Build the policy model around business-critical trust boundaries instead of around a single vendor architecture.
• Prioritise unmanaged and hybrid assets first Start with the devices that cannot reliably run an agent, because those assets are most likely to remain outside traditional endpoint-centric segmentation coverage. Use network-edge or identity-based enforcement where the estate cannot be instrumented locally.
• Tie segmentation to identity and privilege reviews Use identity, role, and privileged-access data to identify which accounts and services should never be able to reach certain internal segments. Review service accounts, admin access, and workload identities as part of segmentation design.
• Measure containment reach before claiming deployment success Track how much of the environment is actually enforceable, including unmanaged devices and legacy segments. A partial policy rollout should be treated as an exposed control, not a finished one.
• Validate operational impact before broad rollout Test policy changes against business-critical traffic paths so segmentation reduces lateral movement without breaking legitimate east-west dependencies. Expand only after exceptions are understood and documented.

Key takeaways

• Microsegmentation remains under-deployed relative to the scale of lateral-movement risk, so internal containment is still a common governance gap.
• The practical challenge is not whether segmentation exists as a concept, but whether it reaches the unmanaged and hybrid assets that create the biggest blind spots.
• Teams that measure success by coverage and reachable reduction, rather than by tool adoption alone, will get closer to real blast-radius control.

Key terms

• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Identity-Driven Segmentation: Identity-driven segmentation is a control model that allows or denies communication based on verified identity rather than only on subnet, firewall, or VLAN placement. It is especially useful in operational environments where topology changes frequently and network paths no longer describe trust accurately.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It helps security practitioners connect identity, privilege, and governance to the controls that reduce real-world blast radius.