Zero trust and microsegmentation: what IAM teams need to know

At a glance

What this is: This explainer shows that zero trust and microsegmentation solve different parts of the access problem, but both fail when identity decisions and network boundaries are not aligned.

Why it matters: IAM, PAM, and NHI teams need this distinction because identity policy can look strong on paper while lateral movement remains possible through weak segment permissions or broad trust assumptions.

Context

Zero trust and microsegmentation are often discussed together, but they solve different control problems. Zero trust governs who or what can be trusted at access time, while microsegmentation limits where that access can move inside the environment.

For IAM teams, the practical issue is alignment: identity policy, authentication strength, and segment-level permissions must reinforce each other or attackers can still move laterally after initial access. This is especially relevant where non-human identities, service accounts, and delegated access paths broaden the attack surface.

The article frames microsegmentation as a containment technique and zero trust as an access model. That distinction matters because an organisation can adopt one without actually closing the gap the other was meant to cover.

Key questions

Q: What breaks when organisations build Zero Trust without microsegmentation?

A: Without microsegmentation, Zero Trust loses one of its main containment mechanisms. An attacker who gets past identity checks can still move laterally across poorly separated systems, reach critical workloads, and disrupt more of the environment than necessary. In practice, the model becomes easier to bypass because the network remains too open inside the perimeter, even if authentication is strong.

Q: Why do segment permissions matter so much for identity security?

A: Because identity trust does not end at login. Segment permissions determine whether an identity can move from its first authorised resource into adjacent systems, so overly broad internal rules turn legitimate access into a lateral-movement path. That is why identity teams and network teams need the same policy objective: limit reach to the minimum viable set.

Q: How do teams know if microsegmentation is actually working?

A: Microsegmentation is working when a compromised workload cannot reach anything outside its explicit policy boundary. The best signal is not the existence of a segmentation design, but the reduction in reachable assets after compromise. If east-west traffic still flows broadly, the control is not changing attacker economics.

Q: What is the difference between Zero Trust and microsegmentation in a resilience strategy?

A: Zero Trust is the broader security philosophy that assumes no implicit trust and requires verification at every stage. Microsegmentation is one of the main ways to apply that philosophy inside the network. It creates smaller trust zones so that if an intruder gains access, the breach stays contained instead of spreading to critical workloads and data.

Technical breakdown

Zero trust as access-time verification

Zero trust is an access model that assumes no user, device, or workload should be trusted by default. Each request is authenticated and authorised against policy before access is granted, which reduces the number of entry points an attacker can exploit. In practice, zero trust is strongest when identity posture, device posture, and resource policy are evaluated together rather than treated as separate controls. The model is not the same as network segmentation, and it does not by itself prevent movement once access has already been granted.

Practical implication: treat zero trust as the policy layer that decides whether access should start, not as a substitute for internal containment.

Microsegmentation as lateral-movement control

Microsegmentation splits the network into smaller zones with their own security controls so that compromise in one area does not automatically expose the rest of the environment. It is a containment technique, not an authentication model. That means it depends on the quality of the rules governing which identities, services, and ports can talk to one another. If those rules are too broad, the environment remains functionally open even if it appears segmented. If they are too narrow or poorly mapped, operations become hard to troubleshoot and maintain.

Practical implication: define segment rules from identity and workload relationships, not from infrastructure convenience.

Why identity and segmentation must be coordinated

The article’s core architectural point is that zero trust and microsegmentation solve different stages of the attack path. Zero trust reduces initial trust, while microsegmentation limits blast radius after access exists. When identity policy and segment policy are mismatched, an attacker can authenticate legitimately and still traverse the environment through over-permissive east-west paths. This is especially important for machine identities and service accounts, which often hold broad access across systems even when human access is tightly controlled.

Practical implication: review identity permissions and segment rules as one control plane so lateral movement paths are not left behind by access policy.

NHI Mgmt Group analysis

Identity controls fail when they are treated as access gates rather than containment boundaries. Zero trust answers the question of whether access should be granted, but it does not on its own answer how far a session can move after authentication. Microsegmentation fills that second gap, which is why alignment between the two is a governance issue, not just an architecture choice. Practitioners should read these as complementary controls with different failure modes.

Microsegmentation is only as effective as the identity data behind it. If the segment policy does not know which identity, workload, or service account is supposed to reach a resource, the environment devolves into coarse allowlists that are hard to sustain. That creates hidden over-permissioning even in environments marketed as tightly segmented. The practical conclusion is that segment design must start from identity relationships, not from topology alone.

Non-human identities make the zero-trust and segmentation gap more visible. Service accounts and API-driven workflows often have broader east-west reach than human users, so a clean login story can mask a weak containment story. This is where NHI governance, least privilege, and internal segmentation converge into one control problem. Practitioners should assume that any identity capable of machine-to-machine reach can become a lateral-movement path unless its scope is deliberately bounded.

Blast radius, not perimeter language, is the right way to judge progress here. Organisations can claim zero trust adoption while still allowing unconstrained internal traversal through legacy rules, shared credentials, or broad service connectivity. The governance question is whether an authenticated identity can only touch the minimum set of assets needed for the task. If not, the programme is reducing risk at the edge while preserving it inside the estate.

Zero trust and microsegmentation only become measurable when policy drift is tracked across both layers. A strong authentication stack can coexist with a weak internal control plane, and the reverse is also true. That means assurance must cover access decisions and east-west reachability together. The practitioner takeaway is to test whether identity policy and network policy tell the same story about who can talk to what.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
• Read next: Zero Trust Identity Guide

What this signals

Identity and segmentation must be governed as one control plane. A programme that validates authentication without validating east-west reachability is only solving half the problem. The operational signal to watch is whether identity policy, network policy, and workload connectivity tell the same story about who can move where.

Blast-radius control is the practical measure that matters here. Zero trust reduces who gets in, but microsegmentation determines how far a foothold can spread once it exists. Teams should expect their assurance work to move from perimeter compliance to internal reach testing and policy-drift detection.

Non-human identities expose hidden privilege paths. Service accounts and automation often retain internal reach that human access reviews miss, which makes them the easiest way for lateral movement to bypass a well-documented front door. If the identity can talk east-west, it must be governed as a containment problem, not just an authentication problem.

For practitioners

• Align identity policy with segment policy Map authenticated identities, service accounts, and workloads to the exact internal resources they are permitted to reach, then remove any broader east-west access that is not required for the use case.
• Review non-human identity reachability Check service accounts, API credentials, and automation paths for internal network reach that exceeds their business function, especially where those identities can move beyond the initial application boundary.
• Separate containment from authentication Treat zero trust as the decision to grant access and microsegmentation as the control that limits what happens after that decision, so each layer is validated on its own terms.
• Test lateral-movement paths regularly Simulate access from a valid identity and verify whether the environment stops traversal at the intended segment boundaries, not just at the perimeter.
• Reduce shared trust assumptions Eliminate broad trust relationships between services and zones that allow one authenticated identity to inherit reach across multiple systems without explicit segment-level authorisation.

Key takeaways

• Zero trust and microsegmentation address different parts of the access problem, so neither control is complete on its own.
• The real governance risk is mismatched policy, where identities are strongly authenticated but still allowed to move too freely inside the environment.
• IAM teams should test internal reachability, not just login outcomes, because lateral movement often survives otherwise strong access controls.

Key terms

• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Function-Level Permissions: Function-level permissions restrict access to individual tool actions rather than an entire application or dataset. For MCP, this is the difference between allowing a client to read a resource and allowing it to delete or modify that same resource, which is where most of the governance risk emerges.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.