TL;DR: Only 2% of organisations have fully achieved Zero Trust maturity across all pillars, while 88% of CISOs report major implementation challenges and nearly 70% of leaders still consider microsegmentation essential, according to Zero Networks. Continuous east-west visibility becomes the practical constraint on enforcement, not the policy concept itself.
At a glance
What this is: This article says microsegmentation fails when policy is built from static network snapshots instead of always-current east-west traffic data.
Why it matters: For IAM and NHI practitioners, the message is that enforcement quality depends on live evidence of who and what is communicating, not just on policy intent.
By the numbers:
- Only 2% of organisations have fully achieved maturity across all Zero Trust pillars.
- Just 5% are microsegmenting their networks today.
Context
Zero Trust depends on continuous verification, but enforcement breaks down when teams must guess at what is actually talking to what inside the environment. Microsegmentation is meant to reduce lateral movement and narrow blast radius, yet static network maps, stale flow data, and manual rule design often turn it into a reporting exercise rather than a control.
The identity angle is real because the article ties segmentation to identities as well as assets: the live communication baseline determines which services, workloads, and machine identities are allowed to talk. That makes this topic relevant to NHI governance, because over-broad east-west access can preserve hidden trust paths even when human IAM looks well controlled.
Key questions
Q: What breaks when microsegmentation is built on stale traffic visibility?
A: Stale traffic visibility causes teams to segment around outdated assumptions, which either leaves hidden pathways open or blocks legitimate dependencies by mistake. The result is weak enforcement, avoidable operational friction, and slower containment when an attacker moves laterally inside the environment.
Q: Why does east-west visibility matter so much for Zero Trust enforcement?
A: Because Zero Trust is only as strong as the control that decides which internal flows are allowed. Live visibility shows the actual dependencies between systems, workloads, and identities, so policy can be based on observed reality instead of assumptions. Without that input, enforcement becomes either over-permissive or operationally unsafe.
Q: How can security teams tell whether segmentation policy is already drifting?
A: Look for growing exception lists, repeated rule edits, and mismatches between approved policy and current application behaviour. Those signs usually mean the segmentation baseline is stale and no longer reflects the live environment. Once drift appears, enforcement confidence falls and teams start relying on manual workarounds.
Q: How should teams govern microsegmentation across human and machine identities?
A: Treat service accounts and workload identities as part of the segmentation design, not just the IAM programme. If machine identities can still communicate broadly inside the network, human access reviews alone will miss the real lateral movement paths. Governance should align identity scope, communication scope, and enforcement scope.
Technical breakdown
Why east-west visibility is the real policy input
Microsegmentation works by converting observed communication patterns into access rules that allow only necessary traffic between workloads, applications, and environments. If the rule base is built from snapshots, historical exports, or manual assumptions, the policy engine is reasoning over a partial model of the network. That creates two failure modes: over-permissive rules that keep uncertain paths open, and over-restrictive rules that break legitimate dependencies. Real-time visibility closes that gap by making the policy engine responsive to current behaviour rather than past state.
Practical implication: build segmentation from live traffic data, not from one-time discovery exports.
How deterministic enforcement differs from reactive monitoring
Deterministic enforcement means the control is derived from known communication requirements and then applied with confidence, rather than being inferred loosely and tuned after repeated incidents. In this model, visibility is not an investigation aid bolted on after the fact. It is the input that lets the policy engine generate, simulate, and maintain accurate rules as workloads change. That matters because the same environment that supports a service account today may be different tomorrow, and stale segmentation quickly becomes rule drift.
Practical implication: connect enforcement to a continuously refreshed behavioural baseline so policy stays aligned as the environment changes.
Why lateral movement controls depend on current identity and workload relationships
Attackers benefit when internal trust is broader than operators realise. Lateral movement is constrained only when the organisation can see which identities and workloads actually need east-west communication, under what conditions, and for how long. In cloud, Kubernetes, IoT, and hybrid estates, those relationships change often enough that periodic review misses important transitions. This is where microsegmentation intersects with NHI governance: service accounts and other machine identities can preserve access paths that are invisible in traditional human IAM reviews.
Practical implication: include machine identities and service communication paths in segmentation design and review.
Threat narrative
Attacker objective: The attacker wants to move laterally inside the environment and reach higher-value systems without being stopped by internal segmentation controls.
- Entry typically begins with an initial compromise that gives an attacker a foothold inside a trusted zone or workload segment.
- Escalation succeeds when broad east-west access or stale segmentation rules allow the attacker to move laterally to additional systems.
- Impact occurs when the attacker reaches high-value assets, because the network design did not constrain movement between internal trust zones.
Breaches seen in the wild
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Real-time visibility is now a governance dependency, not an observability bonus. Segmentation policy cannot be treated as a static design artifact when the environment changes continuously. The practical control question is whether policy generation is based on live communication truth or on stale network assumptions. Practitioners should treat live east-west data as a control prerequisite, not an operational nice-to-have.
Microsegmentation exposes the gap between human identity governance and machine traffic reality. IAM teams can certify access on paper while service-to-service paths remain far broader than intended. That is why NHI governance matters here: service accounts, workload identities, and internal application flows can preserve lateral movement routes that human access reviews never see. The practitioner conclusion is to govern communication paths as identities-in-motion, not as isolated permissions.
Deterministic policy drift is the failure mode this article makes visible. A policy that was accurate at creation can become unsafe or disruptive when topology, dependencies, or workloads change. That drift is a governance problem because it forces teams to choose between permissive exceptions and broken operations. Practitioners should measure whether policy still matches live behaviour, not whether it once matched the network.
Microsegmentation is only scalable when simulation and staged enforcement are part of the control model. The article shows that operational confidence depends on testing rules against real traffic before full rollout. That reduces the chance that security teams will defer enforcement out of fear of disruption. The field implication is clear: enforce with evidence, not with assumptions.
Zero Trust maturity is being constrained by enforcement fidelity, not by strategy language. Many organisations can describe Zero Trust principles, but few can translate them into precise, continuously current controls. The gap sits in the input layer, where network reality must be captured fast enough to support policy. Practitioners should focus on whether their enforcement engine can adapt as quickly as their environment changes.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Identity Security Posture Management (ISPM) Guide
What this signals
Deterministic policy drift is the practical warning sign in this article: when a segmentation baseline is derived from stale traffic data, the control starts to diverge from the live environment and teams compensate with exceptions. That is not just a network hygiene issue, because exception growth usually means governance has lost contact with current behaviour.
The stronger pattern for practitioners is to treat east-west traffic telemetry as a control input, not a dashboard output. When enforcement decisions are based on current communication paths, teams can reduce lateral movement without forcing operations to absorb avoidable breakage.
For practitioners
- Implement live east-west telemetry for segmentation Capture current communication flows across on-premises, cloud, IoT, OT, and Kubernetes environments before writing segmentation rules.
- Simulate rules before enforcement Test proposed microsegmentation policies against real traffic so teams can see which legitimate connections would be blocked before rollout.
- Classify assets by behaviour and function Use observed communication patterns to group assets by application, criticality, and required peers rather than by static inventory labels alone.
- Include machine identities in access reviews Review service accounts and workload identities alongside human accounts so hidden east-west trust paths do not survive segmentation projects.
- Treat policy drift as an operational signal Monitor whether generated rules still reflect current traffic and remove exceptions that exist only because the baseline is out of date.
Key takeaways
- Microsegmentation only delivers Zero Trust value when policy is grounded in live east-west behaviour rather than a static network snapshot.
- The main governance failure is policy drift, where segmentation rules no longer match the environment and teams compensate with exceptions.
- Practitioners should tie enforcement to continuously refreshed traffic data so internal trust paths shrink without disrupting legitimate operations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Segmentation enforces who and what may communicate across internal trust boundaries. |
| DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events | Real-time visibility is the monitoring layer that feeds enforcement decisions. | |
| Recommendation — Apply PR.AA-05 to restrict east-west access to observed, necessary communication paths. Use DE.CM-01 to maintain current monitoring of internal traffic before policy decisions are made. | ||
| MITRE ATT&CK | TA0008 — Lateral Movement | The article centres on constraining attacker movement inside the environment. |
| Recommendation — Map segmentation gaps to TA0008 and prioritise internal paths that enable movement between segments. | ||
| NIST Zero Trust (SP 800-207) | Continuous diagnostics and mitigation — Continuous diagnostics and mitigation | The article argues for ongoing measurement and adaptation in Zero Trust enforcement. |
| Recommendation — Use continuous diagnostics to keep segmentation policy aligned with live network behaviour. | ||
| CIS Controls v8 | CIS-5 — Account Management | Machine and service identities are part of the east-west trust surface that segmentation must constrain. |
| Recommendation — Apply CIS-5 to keep internal access paths tied to current account and service relationships. | ||
Key terms
- Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
- East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
- Deterministic Enforcement: A policy model that produces a clear allow or block decision based on defined rules rather than probabilistic model judgment. For AI agents, deterministic enforcement is valuable because it can stop risky execution even when language is obfuscated, multi-turn, or designed to evade classifier-based guardrails.
- Scope drift: Scope drift is the gradual mismatch between what an integration was meant to do and what its credentials still allow it to do. It happens when permissions are not revalidated as business needs change, creating hidden over-privilege across SaaS and API-connected systems.
Deepen your knowledge
NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners align identity controls with the operational realities of modern security programmes.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org