Topic starter
12/07/2026 12:16 pm
TL;DR: EMA’s survey of 145 IT and security leaders found 95% rate microsegmentation as extremely or very important for cyber defence, while automated discovery, policy creation, and MFA integration are emerging as the features needed to overcome deployment friction and improve containment, according to Zero Networks. The market is moving from niche control to operational requirement, and that changes how teams should think about lateral movement risk.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “Research Report: The Maturing Microsegmentation Market”.
By the numbers:
- 95% of respondents rate microsegmentation as extremely important or very important for cyber defence.
- The report is based on survey data from 145 IT professionals, information security practitioners, and technology business leaders.
Key questions
Q: What fails when microsegmentation is not operationally maintainable?
A: The control fails when policy drift, incomplete asset discovery, and manual rule updates make segmentation too slow to follow the environment.
Q: Why does microsegmentation reduce breach impact even after authentication succeeds?
A: Authentication proves that an identity or workload was accepted, not that it should reach every internal target.
Q: How do teams know if microsegmentation is actually working?
A: Microsegmentation is working when a compromised workload cannot reach anything outside its explicit policy boundary.
Practitioner guidance
- Prioritise segmentation around crown-jewel paths Start with the applications, workloads, and administrative paths whose compromise would create the largest blast radius, then segment outward from those dependencies.
- Automate asset discovery and tagging Use live discovery to map workloads, labels, and communication patterns before policy design, so segmentation reflects current reality rather than stale inventory.
- Tie segmentation to identity-sensitive access paths Review where authenticated users, privileged admins, and service accounts can still reach critical systems after login, and narrow those reach paths explicitly.
Bottom line: Microsegmentation is shifting into mainstream breach containment because organisations are focused on reducing blast radius and stopping lateral movement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:30 pm
Microsegmentation is becoming a governance control, not just a network design choice. Once organisations treat lateral movement as a containment problem rather than a post-breach investigation problem, segmentation becomes part of identity and access governance by another name. That shift matters because it forces teams to ask which authenticated identities, workloads, and service paths should be allowed to talk after the first compromise. The practitioner conclusion is that containment policy now belongs in the same strategic discussion as privileged access and workload trust.
A question worth separating out:
Q: When should organisations treat segmentation as part of identity governance?
A: When authenticated users, admin sessions, or non-human identities still have broad internal reach after access is granted. At that point, segmentation becomes the backstop that enforces least reach in the environment, especially where identity compromise would otherwise turn into lateral movement.
👉 Read our full editorial: Microsegmentation is maturing into mainstream breach containment