Topic starter
11/07/2026 8:21 pm
TL;DR: Microsegmentation is framed here as a containment control for lateral movement, with the article citing 241 days to identify and contain breaches, 51 seconds to lateral movement, and 5% organisational adoption, according to Zero Networks and industry research. The governance question is no longer whether segmentation is useful, but whether teams can deploy it without creating new operational drag.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “Microsegmentation Vendor Evaluation Guide: Key Features for Zero Trust Security”.
By the numbers:
- It takes organisations an average of 241 days to identify and contain a breach, according to Zero Networks.
- Attackers can begin moving laterally in as little as 51 seconds after initial network access, according to Zero Networks.
- Just 5% of organisations are microsegmenting their networks today, according to Zero Networks.
Key questions
Q: What breaks when microsegmentation is not in place to stop lateral movement?
A: Without effective microsegmentation, a single internal foothold can spread across workloads, users, and management paths much faster than defenders can isolate it.
Q: Why do automated policy and asset discovery matter for segmentation outcomes?
A: They matter because segmentation rules become obsolete as soon as the environment changes.
Q: What are the signs that a segmentation programme is becoming too complex to sustain?
A: Common warning signs include long exception lists, repeated manual rule edits, dependence on agents or rearchitecture, and policies that teams cannot explain quickly.
Practitioner guidance
- Define containment zones around crown-jewel assets Start with the systems that matter most for breach spread, then map only the communication paths those assets truly require.
- Automate asset discovery and policy tagging Use discovery and tagging that update as workloads, users, and services change so segmentation rules do not depend on one-time inventories.
- Separate privileged access paths from routine traffic Treat administrative and service-to-service routes as distinct from standard user flows, especially where hybrid environments blend cloud and on-premises systems.
Bottom line: Microsegmentation is most valuable when it limits spread after initial access, not when it simply adds another visibility layer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:51 pm
Microsegmentation is now a blast-radius control, not a network hygiene project. The article’s own numbers show why detection alone is insufficient when lateral movement can begin in under a minute. In practice, the control is valuable only if it meaningfully restricts east-west movement after the first foothold. Practitioners should treat segmentation as a containment architecture, not a visibility overlay.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Should organisations prioritise segmentation over stronger perimeter controls?
A: Yes, when the main risk is post-compromise movement rather than first-entry blocking. Strong perimeter controls still matter, but they do little once an attacker has a foothold. Segmentation and internal policy become the higher-value investment when workloads are ephemeral, users are remote, and the network boundary no longer reflects how the environment actually operates.
👉 Read our full editorial: Microsegmentation capabilities that matter for zero trust containment