Topic starter
10/07/2026 9:26 pm
TL;DR: Critical infrastructure defenders can no longer rely on perimeter assumptions because adversaries move from foothold to lateral movement in seconds or minutes, making microsegmentation the control that shrinks blast radius when IT and OT are already interconnected, according to ColorTokens research. The practical question is whether containment is enforced at machine speed before an attacker reaches EMS, SCADA, or other high-value assets.
Editorial analysis by NHI Mgmt Group, based on content published by ColorTokens: “Before the Lights Go Out”.
By the numbers:
- CrowdStrike’s 2026 Global Threat Report cited a 29-minute average breakout time for AI-assisted adversaries.
Key questions
Q: What breaks when microsegmentation is missing in industrial environments?
A: Without microsegmentation, a single compromised host or account can move across too much of the environment, including build systems, update services, and operational assets.
Q: Why does the convergence of IT and OT increase lateral movement risk in industrial networks?
A: IT and OT convergence expands the number of pathways, protocols, and device types that must be trusted and controlled.
Q: How do security teams know if identity-based segmentation is actually working?
A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services.
Practitioner guidance
- Define containment zones around operational assets Group EMS, SCADA, historians, remote access infrastructure, and vendor pathways into explicit enforcement zones so a compromise in one area cannot freely traverse the estate.
- Tie segmentation policy to asset criticality Prioritise the most sensitive control paths first, especially where a compromised edge system could reach generation, transmission, or safety-adjacent environments.
- Review vendor and remote access pathways Audit every remote maintenance path, jump server, and third-party connection to verify that it is both necessary and narrowly scoped to its intended destination.
Bottom line: Microsegmentation matters because critical infrastructure can no longer assume that perimeter controls will prevent attacker movement after the first foothold.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:48 pm
Microsegmentation is now a breach-readiness control, not an architecture preference. Once IT and OT are interconnected, the issue is not whether a perimeter can be defended indefinitely. The issue is whether movement can be constrained after the first foothold, before the attacker reaches operational control systems. For critical infrastructure teams, that makes segmentation a core containment discipline, not a network design afterthought.
A question worth separating out:
Q: What should critical infrastructure teams do when remote vendor access is unavoidable?
A: They should treat vendor access as a tightly bounded exception, not a standing trust path. That means limiting the destination set, binding access to approved use cases, and continuously checking whether the connection can reach control systems that it never needed to touch. Unscoped vendor access is a common way lateral movement becomes operational impact.
👉 Read our full editorial: Breach readiness for critical infrastructure now depends on microsegmentation