Microsegmentation still stalls because identity is missing from policy

At a glance

What this is: This analysis argues that microsegmentation adoption is high, but completion is low because legacy policy models still depend on network constructs rather than identity.

Why it matters: IAM, NHI, and security teams should read this as a governance warning: controls that cannot express identity cleanly will stall before they meaningfully reduce lateral movement.

By the numbers:

• 99% of organisations are implementing or planning microsegmentation.
• Only 9% report more than 80% of critical systems are protected by microsegmentation.
• Nearly half of respondents experienced a lateral movement attack in the past 12 months.
• 57% of respondents rank microsegmentation as their top initiative to stop lateral movement.

Context

Microsegmentation is supposed to constrain east-west movement by limiting which assets can talk to each other, but most enterprise implementations still lean on IP ranges, VLANs, or agents that do not match how modern environments actually change. That creates a governance gap: the policy model assumes stable location, while the estate is full of mobile workloads, shared services, and heterogeneous devices.

This matters for identity practitioners because the control boundary is shifting from network placement to device and user identity. When policy cannot follow identity across IT, OT, IoT, and cloud-connected systems, least-privilege enforcement becomes brittle and lateral movement remains available as an attack path.

The article's starting position is typical for large enterprises, where microsegmentation intent is broad but operational completion lags behind the architecture teams would ideally want.

Key questions

Q: Where does microsegmentation fail when policy is still tied to network location?

A: It fails when the policy model assumes stable placement but the estate keeps changing. IP-based rules, VLANs, and broad zones cannot reliably track identity across moves, leases, and reclassification, so teams either break legitimate traffic or widen access to avoid outages. The control then looks deployed on paper but remains incomplete in practice.

Q: Why does microsegmentation matter so much for lateral movement risk?

A: Because most successful breaches become far more damaging after the first foothold. Microsegmentation limits east-west paths, so a compromised account or workload cannot freely pivot across the environment. That reduces the blast radius of initial access and gives incident responders a smaller, more containable security problem.

Q: What do security teams get wrong about microsegmentation?

A: They often treat it as a one-time network redesign instead of an iterative control that depends on current workload behaviour. If policies are not refreshed as applications change, segmentation becomes stale and leaves blind spots that attackers can exploit.

Q: What should teams do when microsegmentation is only partially deployed?

A: Treat partial deployment as a risk concentration issue, not a finished control. Prioritise the paths that lead from likely entry points to critical systems, then extend policy using identity signals for devices and users so the control can survive movement across the environment. Completeness matters more than pilot success.

Technical breakdown

Why location-based segmentation fails in heterogeneous networks

Traditional segmentation treats the network location as the unit of trust. VLANs, ACLs, and firewall zones can separate broad segments, but they do not express durable identity, so every move, lease change, or topology shift risks policy drift. That is manageable in small, static environments, but it breaks down when thousands of endpoints, shared services, and east-west dependencies need continuous control. In practice, location-based policy becomes a proxy for identity rather than a direct control over it.

Practical implication: Use identity signals, not subnets alone, to define who or what can communicate across the environment.

Why agent-based microsegmentation stalls at the edge

Agent-based microsegmentation enforces policy from the host, which works for managed servers but fails where software cannot be installed or supported. OT devices, medical equipment, cameras, printers, and many IoT assets cannot host an agent or cannot tolerate one without operational risk. That leaves a large portion of the estate outside the enforcement boundary. A segmentation programme that depends on host software will always be partial in mixed enterprise environments.

Practical implication: Map which assets cannot host agents before choosing an enforcement model, or coverage will stall at the exact devices most exposed to lateral movement.

How identity-based microsegmentation changes the policy model

Identity-based microsegmentation shifts the control plane from network topology to device and user identity. Policies are written against a device class, role, or business function, then enforced on existing infrastructure where possible. That makes the rules more durable across DHCP changes, switch moves, and mixed operating environments, and it also creates a cleaner fit with Zero Trust principles because access is continuously re-evaluated rather than implied by placement. The real shift is governance: identity becomes the policy primitive.

Practical implication: Author segmentation around identities and business functions so policy survives infrastructure change and supports continuous verification.

Threat narrative

Attacker objective: The attacker wants to move across the enterprise quietly until reaching higher-value systems that were assumed to be segmented away.

1. Entry occurs through a foothold that preserves legitimate-looking network presence, such as a compromised endpoint or trusted login.
2. Lateral movement succeeds because segmentation policies still rely on broad network location rather than the identity of the moving asset.
3. Impact follows when attackers reach adjacent systems that should have been isolated but remain reachable through permissive or brittle rules.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• AI LLM hijack breach: attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Microsegmentation has become a governance problem, not just a network design problem. When policy is expressed in network terms but risk is expressed in identity terms, teams end up with a control that is easy to pilot and hard to complete. The result is a say-do gap where intent is near universal but enforcement is partial. Practitioners should treat this as a policy-language mismatch, not merely a tooling issue.

Identity-based microsegmentation is really about making the policy primitive durable. Device identity, user identity, and business function survive topology changes far better than IP-based rules. That matters because lateral movement exploits the gap between what a system is called and what it can still reach after it moves. In Zero Trust terms, identity has to outrank location when policy is authored and enforced.

Access control for heterogeneous estates now needs to absorb OT, IoT, and IoMT as first-class cases. These device classes often cannot host agents, cannot tolerate authentication delays, and cannot be handled by coarse zone design without overexposure. The named concept here is identity-policy drift: the gap that appears when segmentation rules no longer track the actual identity of the thing being controlled. Teams should close that drift before expanding rollout scope.

The operational cost of segmentation errors is itself a control signal. When teams spend hours on every policy change and still see disruption, the programme has crossed from protection into fragility. That does not mean segmentation is wrong. It means the architecture is too dependent on manual tuning and too weakly coupled to live identity data to scale safely.

Microsegmentation only changes attacker economics when it covers the full estate. Partial deployment leaves the same east-west paths open, but now with the added burden of maintaining two different security models. Practitioners should judge success by whether the control can absorb identity change without creating new exceptions.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Identity-policy drift: the most useful way to read this article is as a warning that policy written against location will not keep pace with environments where device identity changes more often than network topology. Practitioners should expect microsegmentation programmes to fail at the point where identity data is incomplete or absent, because that is where exceptions start multiplying.

The next governance question is coverage, not intent. If the control cannot extend to OT, IoT, and other non-traditional endpoints, then the programme will keep protecting the easiest assets while leaving the most operationally constrained ones exposed.

For practitioners

• Map segmentation policy to device and user identity Define policies using device class, user role, and business function instead of relying on VLANs or source IPs as the primary control variable.
• Inventory assets that cannot host agents Identify OT, IoT, IoMT, printers, cameras, and other endpoints that cannot support host-based enforcement so they can be covered by agentless controls.
• Measure policy drift against move and lease events Track how often segmentation rules break or broaden after DHCP changes, switch moves, or asset reclassification, because that is where location-based policy fails.
• Prioritise east-west paths to critical systems Focus rollout on communication paths that attackers would use after initial access, especially routes into sensitive servers and shared services.

Key takeaways

• Microsegmentation fails when policy remains tied to network constructs instead of device and user identity.
• The article's evidence shows a wide gap between deployment intent and meaningful coverage, which explains why lateral movement keeps succeeding.
• Programmes should measure success by how much of the estate can be governed without brittle exceptions, not by how many pilots have started.

Key terms

• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Scope drift: Scope drift is the gradual mismatch between what an integration was meant to do and what its credentials still allow it to do. It happens when permissions are not revalidated as business needs change, creating hidden over-privilege across SaaS and API-connected systems.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity controls to the broader security architecture they are responsible for.