Notifications
Clear all
Topic starter
10/07/2026 9:15 pm
TL;DR: Bank branches often remain flat or weakly segmented, letting attackers move from a single compromised device to cardholder data, core banking, or SWIFT systems in under 31 minutes, according to Elisity’s analysis citing CrowdStrike, Verizon, and Omdia. The governance problem is less about visibility than trust boundaries that still assume anything on the branch network is safe.
NHIMG editorial — based on content published by Elisity: PCI DSS Network Segmentation: The Bank Branch Blind Spot
By the numbers:
- According to the CrowdStrike 2025 Global Threat Report, the average lateral movement time in financial services is 31 minutes.
- According to Verizon DBIR 2024, 98% of attacks involve credential abuse.
- According to Omdia 2025, 53% of organizations still rely on VLANs as their primary segmentation method.
Questions worth separating out
Q: What breaks when branch networks are not truly segmented?
A: When branch networks are not truly segmented, a single compromised device can reach adjacent systems, internal credentials can be reused far too widely, and attackers can move from local footholds to payment or banking systems before containment.
Q: Why do flat branch networks make credential abuse more dangerous?
A: Flat branch networks make credential abuse more dangerous because a valid login often grants far more internal reach than it should.
Q: How do organisations know if branch segmentation is actually working?
A: Branch segmentation is working only if teams can prove that devices can communicate solely with the systems they need and nothing else.
Practitioner guidance
- Map branch east-west trust paths Inventory which devices, services, and protocols can currently talk inside each branch, then identify paths that should never exist between teller systems, cameras, HVAC, and payment-connected assets.
- Replace VLAN assumptions with identity rules Use verified device identity and service-level policy to define allowed communications, instead of relying on subnet membership or switch-port placement as the primary control.
- Prioritise segmentation proof for PCI scope Document how cardholder data environments are isolated at every branch and test the segmentation evidence after any material change, not just during annual audit prep.
What's in the full article
Elisity's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step branch microsegmentation design patterns for distributed sites with mixed managed and unmanaged devices
- Operational guidance for enforcing policy at existing access-layer switches and wireless access points
- Implementation examples for classifying devices such as cameras, ATMs, printers, and HVAC controllers
- Compliance mapping detail for PCI DSS 4.0, FFIEC, DORA, and SWIFT CSP
👉 Read Elisity's analysis of PCI DSS network segmentation gaps in bank branches →
Bank branch segmentation: are your controls keeping up?
Explore further
10/07/2026 9:38 pm
Branch segmentation is now an identity governance problem, not just a network hardening task. When internal trust is still defined by location or subnet, the organisation is effectively granting movement rights without meaningful identity checks. That is the same governance mistake that has long made service-account sprawl and over-privilege hard to contain in IAM programmes. The right conclusion is that branch security must be governed as a trust-boundary problem, not a switch configuration exercise.
A question worth separating out:
Q: Who is accountable when PCI DSS segmentation is weak in branches?
A: Accountability sits with the security, network, and compliance leaders who own the trust boundary, because PCI DSS requires documented and validated segmentation, not informal assurances. In regulated environments, teams must be able to show that branch controls limit access, reduce scope, and remain effective after configuration changes. Shared ownership without testable evidence is not sufficient.
👉 Read our full editorial: PCI DSS network segmentation gaps leave bank branches exposed
