PCI DSS network segmentation gaps leave bank branches exposed

At a glance

What this is: Elisity argues that bank branches remain exposed because flat or weakly segmented networks let one compromised endpoint reach critical banking and payment systems quickly.

Why it matters: For IAM and security teams, this is an access-control problem as much as a network design problem, because branch trust boundaries still allow lateral movement after initial compromise.

By the numbers:

• The average lateral movement time in financial services is 31 minutes, according to CrowdStrike 2025 Global Threat Report cited by Elisity.
• 98% of attacks involve credential abuse, according to Verizon DBIR cited by Elisity.
• 53% of organizations still rely on VLANs as their primary segmentation method, according to Omdia research cited by Elisity.
• Only 9% of organizations have microsegmented more than 80% of critical systems, according to Omdia research cited by Elisity.

Context

Bank branch network segmentation is the control boundary that separates everyday endpoint traffic from systems that handle cardholder data, payments, and core banking access. When that boundary is weak, the problem is not just network hygiene but an identity and access failure, because anything trusted on the segment can often talk to everything else.

Elisity’s argument is that branch environments still rely on implicit trust, static VLAN design, and coarse segmentation that do not scale across distributed locations. That creates a governance gap for financial services teams that must satisfy PCI DSS 4.0, FFIEC expectations, and broader resilience requirements while managing mixed device populations and limited local IT support.

Key questions

Q: What breaks when banking environments rely on flat network access instead of segmentation?

A: Flat access makes it easier for attackers and ransomware to move from one compromised system to others. In banking, that can turn a single foothold into disruption across core services, data stores, and operational systems. Without segmentation, teams lose a practical containment boundary, so recovery becomes slower and the impact of an incident becomes much wider.

Q: Why does weak branch segmentation increase financial services breach impact?

A: Weak segmentation increases impact because attackers can move from one compromised endpoint to high-value systems before defenders isolate the initial foothold. In financial services, that short dwell time matters because payment, core banking, and transfer systems are often reachable from the branch if internal boundaries are not enforced.

Q: What do security teams get wrong about VLAN-based segmentation in branches?

A: Teams often assume VLANs provide meaningful internal isolation at branch scale, but VLANs are coarse, static, and dependent on manual configuration. They do not adapt well to device churn, mixed device types, or sites without local IT, so they rarely stop east-west movement within a branch.

Q: How do organisations know if branch segmentation is actually working?

A: Branch segmentation is working only if teams can prove that devices can communicate solely with the systems they need and nothing else. Good evidence includes tested allowed paths, blocked paths that fail as intended, and repeatable segmentation validation after changes. If the control is only visible in diagrams, it is not yet operating as a security boundary.

Technical breakdown

Why flat branch networks create lateral movement paths

A flat branch network treats many connected devices as if they share the same trust level, even when they serve very different functions. Teller workstations, cameras, printers, and building controls can sit on the same segment, so a compromised endpoint can probe other systems without crossing a meaningful control boundary. In practical terms, the attacker is not defeating perimeter security once; they are exploiting the absence of internal separation. This is why internal segmentation matters as much as external hardening in distributed environments.

Practical implication: use segmentation to break the branch into smaller trust zones so one compromised device cannot reach everything on the same segment.

Why VLANs fail as a branch segmentation model

VLANs are a location-based control, not an identity-based one. They group devices by switch port or subnet, which means they require manual changes whenever a device moves, is replaced, or a branch layout changes. That works poorly in branches with no local IT staff and a mix of managed and unmanaged devices. VLANs also provide little protection inside the segment, so once an attacker is on that network slice, east-west movement remains largely open. The control is static while the environment is dynamic.

Practical implication: treat VLANs as coarse infrastructure grouping, not as a sufficient control for branch-level lateral movement prevention.

How identity-based microsegmentation changes enforcement

Identity-based microsegmentation shifts policy from where a device sits to what the device is and what it is allowed to do. Policies can be based on verified device identity, user context, and permitted communication paths, so a teller workstation can reach approved services while a camera or guest device cannot. This matters because the trust decision is made at enforcement time, not inferred from the network location. For financial services, that is closer to the actual risk model than IP-based trust. It also maps more cleanly to audit evidence because the policy intent is explicit.

Practical implication: define allow rules by verified identity and approved service paths, then enforce them consistently across all branches.

Threat narrative

Attacker objective: The attacker wants to turn one branch foothold into access to payment, banking, or funds-transfer systems before defenders can contain the move.

1. Entry begins with a compromised teller workstation, an unpatched digital signage device, or a rogue device plugged into an open branch port.
2. Credential abuse or simple network trust lets the attacker move laterally across the flat segment because internal devices are treated as trusted peers.
3. Escalation occurs when the attacker reaches cardholder data environments, core banking connections, or SWIFT terminals from the branch network.
4. Impact is broad access to critical banking systems and the ability to pivot from a local compromise into high-value enterprise assets.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Branch segmentation is an access governance problem, not just a network design problem. When a branch segment trusts every connected device by default, the control failure is one of authorization at the east-west layer. Financial services teams should treat branch traffic as an entitlement model that must be constrained, not as a flat internal zone. The practitioner conclusion is that segmentation policy belongs in the identity and access conversation, not only in the network team backlog.

Implicit trust zones: is the right label for what fails in branch networks. The article shows a recurring pattern: devices are grouped by location, yet attackers move by abusing whatever is already inside the segment. That means the real governance gap is not visibility but the assumption that network presence equals trust. For practitioners, the key question is whether internal trust is being granted by design or inherited from legacy topology.

PCI DSS pressure will increasingly expose weak internal segmentation assumptions. The compliance issue is not simply whether a VLAN exists, but whether allowed connections are documented, justified, and enforceable across many distributed sites. In practice, this forces teams to prove that sensitive systems are isolated at branch scale, not only in the data center. The practitioner conclusion is to align segmentation evidence with how auditors actually test internal connectivity and control consistency.

Identity-based microsegmentation is becoming the more defensible branch control model. It matches the way distributed environments actually change, because policy travels with device identity instead of remaining pinned to switch configuration. That does not remove the need for network controls, but it changes the control objective from static grouping to verified communication permission. The practitioner conclusion is to move toward policy models that can survive branch churn, device diversity, and limited local administration.

Branch environments expose a broader zero trust lesson for financial services. Once a device is inside the branch, the old perimeter logic collapses quickly if east-west access is not constrained. That makes microsegmentation and least-privilege network access part of the same governance pattern as IAM least privilege. The practitioner conclusion is to align branch segmentation with zero trust principles rather than treating it as an isolated compliance exercise.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Implicit trust zones: branch networks are still organized around the assumption that anything inside the segment is safe, and that assumption is what attackers exploit. For financial services programmes, the operational question is no longer whether a VLAN exists, but whether internal trust is actually constrained by policy.

The next governance step is to align branch segmentation with zero trust thinking, where device identity and permitted communication matter more than network location. That shift is especially important where many branch devices cannot run agents and where auditors will expect evidence that allowed connections are both limited and repeatable.

For practitioners

• Map branch devices to explicit trust zones Inventory teller workstations, ATMs, cameras, printers, HVAC controllers, and visitor access points, then group them by permitted communication paths instead of by where they plug in.
• Replace static VLAN assumptions with identity-based policy Define allow rules for specific device identities and destination services, so a teller workstation can reach only the systems it actually needs.
• Document and validate allowed branch connections Create evidence for every permitted east-west path, then test that the branch segmentation design still matches PCI DSS 4.0 and FFIEC expectations after each significant change.
• Prioritise non-agent enforcement for unmanaged branch devices Assume many branch devices cannot run endpoint agents, and choose enforcement methods that work at the network edge for cameras, sensors, and building systems.
• Reduce lateral movement between operational and payment systems Separate low-trust devices from cardholder data and core banking access so a compromised branch endpoint cannot pivot into higher-value systems.

Key takeaways

• Flat branch segmentation gives attackers a short route from one compromised device to high-value banking systems.
• The central weakness is implicit internal trust, which lets east-west movement happen inside the branch before defenders can respond.
• Banks need segmentation evidence that is enforceable across distributed sites, not just diagrams that look controlled on paper.

Key terms

• Network Segmentation: Network segmentation divides traffic and resources into controlled zones so access can be restricted between groups, systems, or applications. In remote access design, segmentation limits what a connected user or workload can reach after authentication, which reduces lateral movement and shrinks blast radius.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Implicit trust: The assumption that an authenticated user, token, or session should continue to be trusted across time and systems without repeated checks. In modern environments, this assumption creates attack leverage because identity artefacts can be reused, delegated, or moved faster than manual governance can react.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.