Why network segmentation projects fail and what OT changes

At a glance

What this is: Elisity says network segmentation projects fail when organisations try to impose one policy across heterogeneous IT and OT environments without the visibility or enforcement model to make that policy stick.

Why it matters: This matters because IAM and security teams responsible for NHI, human access, and machine connectivity need controls that work when endpoint agents, reboots, and device-level changes are off the table.

Context

Network segmentation is the practice of restricting which systems can talk to each other so lateral movement becomes harder. The article argues that the usual model breaks down when organisations try to apply a single enforcement design across managed endpoints, unmanaged devices, and OT assets that cannot tolerate agents or disruption.

The governance gap is not simply technical. Segmentation projects span network, security, operations, and asset owners, so policy intent often gets lost between teams before it reaches enforcement. In OT and critical infrastructure, that makes identity-aware network control and exposure validation central to the programme, not optional extras.

Key questions

Q: What breaks when network segmentation is applied to OT without device-touch controls?

A: The model breaks when segmentation assumes agents, reboots, or direct device management are available. In OT, controllers and sensors may be inaccessible or too fragile to touch, so the policy cannot be enforced where the traffic actually moves. The practical result is that segmentation has to be applied at the network layer, where reach can be constrained without disrupting operations.

Q: Why does poor visibility make segmentation projects fail so often?

A: Poor visibility means teams cannot see the traffic paths, device relationships, or policy exceptions they need to govern. If you cannot inventory the assets or understand how they communicate, you end up enforcing rules blind, which creates gaps, exceptions, and mistrust. Segmentation becomes inconsistent because the policy is not based on the actual environment.

Q: How do security teams know if identity-based segmentation is actually working?

A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services. If lateral movement, management-plane access, or service-to-service discovery still succeeds, segmentation is too coarse. Effective segmentation shows up as denied pathways, reduced reachable surface, and a clear separation between user, management, and critical workloads.

Q: Should organisations prioritise exposure mapping or active enforcement first?

A: Exposure mapping should usually come first because it shows where the current policy is already failing and where enforcement will be most disruptive. Once teams understand the reachable paths, they can apply active enforcement with fewer surprises and less operator resistance. In complex IT and OT estates, sequencing the map before the guardrail reduces rollout risk.

Technical breakdown

Why segmentation projects stall across mixed IT and OT estates

Segmentation fails when the policy model assumes a relatively uniform estate, but real environments contain servers, endpoints, cameras, controllers, sensors, and industrial devices with different operating constraints. If the control design depends on agents, frequent reboots, or device-level instrumentation, OT devices quickly become exceptions that undermine the whole policy set. The article’s core technical point is that the policy problem is not only about writing rules, but about whether the environment can actually absorb those rules without breaking service. Practical implication: design segmentation around the least mutable device class first, not around the most manageable one.

Practical implication: design segmentation around the least mutable device class first, not around the most manageable one.

Exposure management versus active enforcement

The article distinguishes two network-layer approaches. Exposure management builds a model from firewalls, switches, routers, and endpoint telemetry to show where paths exist and where policy is violated. Active enforcement uses identity and contextual data to apply policy centrally and continuously so reachability changes as conditions change. These are not competing ideas; they answer different questions and are strongest when used together. Practical implication: validate where exposure exists before relying on enforcement logic to hold the line.

Practical implication: validate where exposure exists before relying on enforcement logic to hold the line.

Why OT segmentation has to avoid device-touch controls

Operational technology changes the control boundary because uptime is a hard requirement and device access is often limited or unavailable. If an engineer cannot safely install an agent, interrupt a controller, or reboot a SCADA-connected asset, then segmentation has to be enforced somewhere else. The network layer becomes the practical control point because it can limit reach without changing the device itself. That is why OT segmentation is less about host hardening and more about constraining east-west communication paths. Practical implication: move segmentation decisions to the layer that can be changed without jeopardising operations.

Practical implication: move segmentation decisions to the layer that can be changed without jeopardising operations.

Threat narrative

Attacker objective: The attacker’s objective is to expand reach across the environment and reach assets that segmentation was meant to keep isolated.

1. Entry occurs through an exposed or over-permissive east-west path in a poorly segmented environment, rather than through a device-specific exploit.
2. Credential or access abuse then lets the attacker move across systems that were assumed to be isolated, because policy enforcement is inconsistent across the estate.
3. Impact follows when the attacker reaches OT or critical infrastructure assets that should have been unreachable from the initial foothold.

Breaches seen in the wild

• Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Segmentation failure is now a governance problem, not just a tooling problem. The article shows that policy intent collapses when network, security, and operations teams do not share a common model for what should be reachable. That is why many segmentation programmes stall even after a clear charter. For practitioners, the lesson is that segmentation succeeds only when ownership, scope, and enforcement model are aligned before rollout.

OT changes the segmentation assumption set completely. In IT, teams can often rely on agents, reboots, and rapid device change. In OT, those assumptions fail because uptime and device immutability dominate every decision. This creates an identity-aware network control problem, not a host-control problem, and the network layer becomes the only viable policy plane.

Exposure validation and enforcement must be treated as separate controls. A digital twin or exposure map tells you where policy is already broken, while active enforcement tells you whether reachability is being constrained in real time. The field still confuses the two, which leads to false confidence after partial deployment. Practitioners should treat map and guardrail as distinct capabilities that answer different questions.

Network segmentation is converging with identity context. The article’s strongest signal is that static network zones are no longer enough when devices, users, and workloads all behave differently. The named concept here is identity-aware segmentation drift, where policy intent and actual reachability diverge as environments become more heterogeneous. That drift has to be managed continuously, or segmentation becomes a paper design rather than an operational control.

OT segmentation programmes fail fastest when they ignore operational fear. The article captures a real control adoption barrier: engineers expect false positives, downtime, and loss of control. That fear is not cultural noise, it is a signal that enforcement is too close to the device and too far from operational reality. Practitioners should treat operator confidence as a control dependency, not a change-management afterthought.

What this signals

Identity-aware segmentation drift: once environments combine managed endpoints, unmanaged devices, and OT assets, static zones stop matching real communication paths. That drift is the governance failure that makes segmentation look complete on paper while leaving lateral movement routes open in practice.

In critical infrastructure, the network layer becomes the control plane of last resort because device-level changes are often impossible or unsafe. That means programmes need exposure validation, policy simulation, and runtime enforcement as distinct capabilities rather than a single project label.

For practitioners

• Validate exposure before enforcing segmentation Build a current map of east-west reachability across firewalls, switches, routers, and endpoints before turning on stricter controls. Use that view to identify which paths are already violating the intended policy.
• Separate policy modelling from policy enforcement Use one process to simulate or review reachability and a different process to apply runtime enforcement, so a failed rollout does not erase your understanding of exposure.
• Design OT segmentation around immutable devices Assume controllers, sensors, and SCADA-connected assets cannot host agents or tolerate reboots, then place enforcement at the network layer where those devices can still be protected.
• Bring operations owners into segmentation design Treat OT and network operations as co-owners of the segmentation model because policy that ignores uptime, maintenance windows, or false-positive risk will not survive implementation.

Key takeaways

• Segmentation programmes fail when policy design assumes a uniform estate and a control model that OT devices cannot support.
• The article’s central distinction is between exposure mapping and active enforcement, which solve different problems and should not be conflated.
• For OT and critical infrastructure, enforcement has to move to the network layer if the device itself cannot be safely touched.

Key terms

• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Exposure management: Exposure management is the practice of identifying which assets are reachable by attackers and reducing that reach before exploitation occurs. For collaboration systems like SharePoint, it is not enough to know that a patch exists, because public accessibility changes the speed and likelihood of attack.
• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.