Topic starter
10/07/2026 9:19 pm
TL;DR: Manufacturing is seeing a sharp execution gap: 99% of organisations are implementing or planning microsegmentation, but only 9% have protected more than 80% of critical systems, even as nearly half of respondents experienced lateral movement in the past year, according to Elisity. The problem is not intent but incomplete control coverage across environments where lateral movement remains the main route to ransomware spread.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Microsegmentation in Manufacturing: Omdia Survey Findings on Ransomware and Lateral Movement”.
By the numbers:
- Nearly 50% of organizations experienced lateral movement attacks in the past year.
- 99% are implementing or planning microsegmentation, but only 9% have more than 80% of critical systems protected.
- 69% identified identity-based microsegmentation as the most desirable feature in a modern solution.
Key questions
Q: What breaks when healthcare microsegmentation is only partially deployed?
A: Partial deployment leaves unsegmented clinical pathways open, so a foothold on one device can still reach EHR systems, monitoring tools, or other high-value services.
Q: Why does incomplete segmentation increase ransomware impact in industrial networks?
A: Incomplete segmentation lets ransomware spread beyond the first compromised device into production-connected assets, which increases the chance of shutdowns, recovery cost, and operational disruption.
Q: How do teams know if microsegmentation is actually working?
A: Microsegmentation is working when a compromised workload cannot reach anything outside its explicit policy boundary.
Practitioner guidance
- Prioritise critical-system coverage first Map the systems that would cause operational shutdown if reached by lateral movement, then segment those assets before extending policy elsewhere.
- Replace IP-centric policies with identity-aware rules Use user context, device identity, and allowed communication patterns to define policy, especially where VLANs and ACLs cannot express the needed granularity.
- Simulate policies before enforcement Test communication rules in observe mode so that manufacturing teams can catch hidden dependencies, remote-access exceptions, and production-impacting blocks before rollout.
Bottom line: Manufacturing microsegmentation is now an execution problem, with many organisations still far from protecting the systems that would matter most in a ransomware event.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:42 pm
Manufacturing has a containment problem disguised as a segmentation problem: the industry is already buying into microsegmentation, but most deployments stop short of the systems that matter most. That gap is what attackers exploit, because ransomware does not need to defeat the concept of segmentation if the critical assets remain outside its enforcement boundary. The practitioner lesson is that architecture intent is not the same as attack resistance.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: What should manufacturing security leaders do when segmentation policies disrupt operations?
A: They should distinguish between a policy that is too broad and a policy that exposes an unmanaged dependency. The right response is to refine identity-aware rules, test them in simulation, and preserve production continuity while tightening the paths an attacker could use.
👉 Read our full editorial: Microsegmentation in manufacturing: the lateral movement gap persists