Topic starter
11/07/2026 8:47 pm
TL;DR: Once entry is gained, lateral movement stays possible without microsegmentation, according to ColorTokens. Internal reachability then determines how much damage a compromised session or workload can cause.
Editorial analysis by NHI Mgmt Group, based on content published by ColorTokens: “Microsegmentation + ZTNA : A Zero Trust Double Defense”.
Key questions
Q: Why do remote access controls need more than authentication in Zero Trust programmes?
A: Authentication proves who the user or device is, but it does not limit what that session can reach.
Q: What are the signs that lateral movement risk is still too high?
A: If a single compromised account can reach many internal systems, lateral movement risk is still high.
Q: What breaks when organisations build Zero Trust without microsegmentation?
A: Without microsegmentation, Zero Trust loses one of its main containment mechanisms.
Practitioner guidance
- Define east-west policy boundaries for critical workloads Map which servers, applications, and services truly need to communicate, then deny the rest so internal movement is not implicit.
- Replace broad remote access with session-scoped ZTNA Limit every remote session to only the specific application or resource the user or vendor is authorised to reach.
- Audit third-party and contractor reachability Review every external user path for unnecessary visibility into internal systems, especially where contractors or vendors touch production resources.
Bottom line: Microsegmentation and ZTNA solve different Zero Trust failures, with one constraining internal movement and the other narrowing external session reach.
Glossary terms: Microsegmentation, Zero Trust Network, East-west traffic, Blast Radius
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 hours ago by NHI Mgmt Group
11/07/2026 9:13 pm
Microsegmentation is a governance control, not just a network design choice. Once an attacker is inside, the decisive question is whether east-west traffic is already constrained enough to stop internal spread. That makes workload adjacency, not just perimeter hardening, a core Zero Trust governance issue. Practitioners should treat internal reachability as an access decision, not a routing detail.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern breach containment when both users and workloads are involved?
A: Teams should govern containment as an access-scope problem across identities, not just as a network design exercise. Users, contractors, service accounts, and workloads all need their own reachability limits, because compromise in any one path can become lateral spread. The right comparison is not perimeter versus Zero Trust, but broad reachability versus constrained trust boundaries.
👉 Read our full editorial: Microsegmentation and ZTNA define Zero Trust breach containment