Topic starter
10/07/2026 9:26 pm
TL;DR: Omdia's survey of 352 security decision-makers found 99% of organisations are implementing or planning microsegmentation, yet only 9% protect more than 80% of critical systems and nearly half saw lateral movement in the past year, according to Elisity. The gap is architectural: policies built around network location cannot keep pace with identity-driven, heterogeneous environments.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “The Microsegmentation Say-Do Gap: 99% Plan It, 9% Finish It, and Lateral Movement Keeps Winning”.
By the numbers:
- 99% of organisations are implementing or planning microsegmentation.
- Only 9% report more than 80% of critical systems are protected by microsegmentation.
- Nearly half of respondents experienced a lateral movement attack in the past 12 months.
Key questions
Q: Where does microsegmentation fail when policy is still tied to network location?
A: It fails when the policy model assumes stable placement but the estate keeps changing.
Q: Why does microsegmentation matter so much for lateral movement risk?
A: Because most successful breaches become far more damaging after the first foothold.
Q: What do security teams get wrong about microsegmentation?
A: They often treat it as a one-time network redesign instead of an iterative control that depends on current workload behaviour.
Practitioner guidance
- Map segmentation policy to device and user identity Define policies using device class, user role, and business function instead of relying on VLANs or source IPs as the primary control variable.
- Inventory assets that cannot host agents Identify OT, IoT, IoMT, printers, cameras, and other endpoints that cannot support host-based enforcement so they can be covered by agentless controls.
- Measure policy drift against move and lease events Track how often segmentation rules break or broaden after DHCP changes, switch moves, or asset reclassification, because that is where location-based policy fails.
Bottom line: Microsegmentation fails when policy remains tied to network constructs instead of device and user identity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:49 pm
Microsegmentation has become a governance problem, not just a network design problem. When policy is expressed in network terms but risk is expressed in identity terms, teams end up with a control that is easy to pilot and hard to complete. The result is a say-do gap where intent is near universal but enforcement is partial. Practitioners should treat this as a policy-language mismatch, not merely a tooling issue.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: What should teams do when microsegmentation is only partially deployed?
A: Treat partial deployment as a risk concentration issue, not a finished control. Prioritise the paths that lead from likely entry points to critical systems, then extend policy using identity signals for devices and users so the control can survive movement across the environment. Completeness matters more than pilot success.
👉 Read our full editorial: Microsegmentation still stalls because identity is missing from policy