Topic starter
12/07/2026 12:25 pm
TL;DR: CISA’s Microsegmentation in Zero Trust, Part One: Introduction and Planning turns microsegmentation into an operational control path, and Elisity’s analysis argues the real obstacle is execution, not intent, with legacy segmentation projects still measured in years and millions of dollars. The governance problem is that Zero Trust fails when policy cannot be deployed, validated, and maintained fast enough to match changing identity and device context.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “CISA Microsegmentation in Zero Trust, Part One: Introduction and Planning - How Elisity Makes It Actionable”.
By the numbers:
- Traditional segmentation across 275 sites would take one year per location and $200 million to complete, according to Elisity.
- CISOs understand the need to limit lateral movement, the tactic used in over 70% of successful breaches, according to Elisity.
- Elisity says its discovery engine achieves 99% device visibility within hours of deployment.
Key questions
Q: What breaks when organisations build Zero Trust without microsegmentation?
A: Without microsegmentation, Zero Trust loses one of its main containment mechanisms.
Q: Why do identity and device attributes matter for microsegmentation decisions?
A: Because modern networks are too dynamic for IP addresses and VLANs to describe trust accurately.
Q: What are the signs that a Zero Trust Segmentation programme is not working as intended?
A: A Zero Trust Segmentation programme is struggling when teams still rely on broad network trust, cannot explain allowed traffic paths, or find that containment policies are too coarse to stop movement between critical systems.
Practitioner guidance
- Implement phased segmentation by dependency group Start with candidate resources that have clear communication patterns, map dependencies before enforcement, and validate policy in permissive mode before blocking traffic.
- Bind policy to identity and device context Use user role, device posture, and workload attributes as policy inputs so segmentation decisions follow the entity rather than the subnet.
- Measure policy change speed as a control metric Track how long it takes to move from identification to validated enforcement, because delays create a widening gap between Zero Trust design and actual containment.
Bottom line: Microsegmentation is the enforcement layer that makes Zero Trust operational, and weak internal segmentation leaves organisations exposed to lateral movement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:38 pm
Microsegmentation is now a governance control, not a network hygiene task. The article makes clear that the real failure is not conceptual acceptance of Zero Trust but the inability to operationalize it quickly enough to matter. That shifts the centre of gravity from architecture diagrams to enforcement, validation, and lifecycle control. Practitioners should treat segmentation as a policy governance problem with measurable blast-radius outcomes.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should pharmaceutical teams prioritise microsegmentation before broader zero trust rollout?
A: Yes, when the biggest risk is lateral movement through flat or converged networks. Microsegmentation gives the clearest early containment benefit because it reduces the blast radius first, then creates a stronger foundation for identity, device, and data controls that follow.
👉 Read our full editorial: CISA microsegmentation guidance exposes the real Zero Trust gap