Notifications
Clear all
Topic starter
12/07/2026 12:24 pm
TL;DR: Black Hat 2025 discussions on microsegmentation, AI in security, and defense in motion reflected a wider problem: organisations are spending more while attackers still win on speed, lateral movement, and alert overload, according to Zero Networks and cited industry data. The practical shift is from detection-first posture to containment-first governance, especially where identity-based access and segmented workloads intersect.
NHIMG editorial — based on content published by Zero Networks: Takeaways from Black Hat 2025 on microsegmentation, cybersecurity trends, and defense in motion
By the numbers:
- 83% of organizations currently use endpoint security while just 5% leverage microsegmentation.
- Attackers achieved a record-low breakout time of just 51 seconds in 2024.
- The mean time to identify a breach was 194 days.
Questions worth separating out
Q: What breaks when microsegmentation is not in place in hybrid networks?
A: When microsegmentation is absent, a single foothold can often reach far more internal systems than defenders expect.
Q: Why does microsegmentation matter for IAM and PAM teams?
A: Microsegmentation matters because identity controls are only as strong as the paths an identity can use after authentication.
Q: How do security teams know if segmentation is actually reducing risk?
A: Teams know segmentation is working when unnecessary workload communications disappear, exception volume falls, and policy changes are validated continuously rather than assumed.
Practitioner guidance
- Map east-west exposure before tuning detection Inventory the internal pathways that allow workloads, service accounts, and admin tools to talk to each other.
- Bind segmentation policy to identity context Require user identity, workload identity, device posture, and privilege scope to inform what can communicate with what.
- Automate policy creation and exception handling Use deterministic rule generation and automated grouping to reduce manual policy drift.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- The Black Hat session context and speaker-led commentary on why detection-only defence is failing in practice.
- The specific microsegmentation and automation capabilities the vendor associates with reduced implementation complexity.
- The joint firewalls-plus-segmentation operating model described for north-south and east-west protection.
- The vendor's framing of how these controls fit compliance and cyber insurance expectations.
👉 Read Zero Networks' Black Hat 2025 analysis of microsegmentation and defense in motion →
Microsegmentation after Black Hat 2025: is your network still too reactive?
Explore further
12/07/2026 12:37 pm
Microsegmentation has moved from a network optimisation topic to an identity governance issue. The article is really about who and what can move after compromise, which is the same governance question IAM and PAM teams already ask about standing privilege. Once workloads, service accounts, and administrative paths are all potential lateral movement channels, segmentation becomes part of access governance, not just network design. Practitioners should treat containment boundaries as identity boundaries.
A question worth separating out:
Q: How should organisations combine AI-driven operations with containment controls?
A: Organisations should keep AI-assisted operations inside tighter blast-radius boundaries than manual work. AI can accelerate change, but it also accelerates mistakes if it can act across too many systems. The safest pattern is to pair automation with identity-aware segmentation so AI outputs do not become unrestricted internal movement.
👉 Read our full editorial: Black Hat 2025 puts microsegmentation and defense in motion to the test
