Topic starter
12/07/2026 12:14 pm
TL;DR: As organisations spread workloads across AWS, Azure and Google Cloud Platform, manual segmentation and fragmented visibility create blind spots that make lateral movement harder to detect, according to Illumio. The practical issue is not cloud choice but whether policy, telemetry and enforcement can stay consistent across environments.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Illumio Strengthens Google Cloud Platform Support to Contain Risk Across Distributed Environments”.
Key questions
Q: How should teams govern segmentation across AWS, Azure and Google Cloud Platform?
A: They should use one policy model for workload communication and then map provider-specific enforcement to that model.
Q: Why do visibility gaps make lateral movement harder to stop in multi-cloud?
A: Because teams cannot validate which east-west paths are normal, necessary or already being abused.
Q: What breaks when cloud segmentation is managed separately in each platform?
A: What breaks is policy consistency.
Practitioner guidance
- Define segmentation policy centrally Create one policy model for workload communication across AWS, Azure and GCP, then map cloud-specific enforcement to that policy rather than maintaining separate rule sets per provider.
- Baseline east-west communication paths Inventory how workloads actually talk to one another across cloud boundaries before tightening segmentation, so enforcement reflects business traffic rather than assumptions.
- Use observability to validate containment Review whether your cloud telemetry can show blocked, allowed and anomalous workload-to-workload paths in near real time, then test containment decisions against that view.
Bottom line: Multi-cloud estates create segmentation drift when teams manage policy differently across AWS, Azure and GCP.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:28 pm
Multi-cloud segmentation debt is now a governance problem, not a tooling annoyance. Once policy must be expressed across AWS, Azure and GCP, teams accumulate inconsistent rules, manual workarounds and blind spots. That is governance debt because the control model stops matching the actual estate. Practitioners should treat policy drift as a standing risk indicator, not a deployment inconvenience.
A question worth separating out:
Q: Should security teams prioritise observability or enforcement first in distributed cloud?
A: Observability first, because enforcement without a reliable view of workload communication can block the wrong paths or miss the real ones. Teams need to understand traffic patterns before they can confidently contain them. Once the paths are visible, policy can be tightened with far less guesswork.
👉 Read our full editorial: Multi-cloud segmentation in GCP: why visibility gaps persist