Notifications
Clear all
Topic starter
10/07/2026 9:18 pm
TL;DR: Gartner says identity is becoming the primary control plane for zero trust as AI agents proliferate across workloads, and that static IP-based microsegmentation leaves organisations catastrophically exposed to AI-driven attacks. The practical shift is from perimeter-style filtering to identity- and context-aware control that can shrink blast radius before human response arrives, according to Gartner research.
NHIMG editorial — based on content published by Zero Networks: Gartner report on reimagining network microsegmentation beyond the IP
By the numbers:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- Only 5.7% of organisations have full visibility into their service accounts.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams implement identity-aware microsegmentation in hybrid environments?
A: Start by tying segmentation policy to authenticated workload, service account, and agent identity, then map each identity to the smallest set of allowed destinations.
Q: Why do AI agents make static network segmentation less effective?
A: AI agents can create, chain, and repeat internal actions faster than teams can review network-based exceptions.
Q: What breaks when segmentation ignores service and workload identity?
A: When segmentation ignores identity, any caller that reaches an allowed network location may inherit access that was meant for a specific workload or role.
Practitioner guidance
- Map segmentation policy to workload identity Replace IP-only allowlists with rules that bind traffic permissions to authenticated workload, service account, or agent identity, then review where identity context is missing from enforcement.
- Define blast-radius limits for NHIs and agents Set explicit cross-service boundaries for service accounts, tokens, and AI agents so a compromise cannot pivot across unrelated application tiers or operational zones.
- Bring segmentation into identity governance Add microsegmentation decisions to IAM and PAM governance so access reviews include runtime communication paths, not only entitlements and privilege assignments.
What's in the full report
Zero Networks' full report covers the operational detail this post intentionally leaves for the source:
- How Gartner frames identity-led segmentation across AI agents, workloads, and zero trust architecture
- The report’s discussion of agentless microsegmentation and what that changes operationally for deployment
- The specific implications for shrinking blast radius before human detection and response
- How the report positions network segmentation in a broader security roadmap
👉 Read Zero Networks' report on Gartner's identity-led microsegmentation findings →
Network microsegmentation and identity context: are your controls keeping up?
Explore further
10/07/2026 9:41 pm
Identity-led segmentation is becoming the new baseline for zero trust. Gartner’s framing reflects a real governance shift: network controls now have to understand the identity of workloads, service accounts, and AI agents, not just their addresses. Static zones cannot keep pace with ephemeral compute and delegated runtime activity. Practitioners should treat identity-aware policy as the design centre of segmentation, not an optional enhancement.
A question worth separating out:
Q: Who is accountable when microsegmentation fails to contain lateral movement?
A: Accountability usually spans IAM, network security, cloud security, and platform engineering because the failure sits at the boundary between identity governance and traffic enforcement. Teams should define owners for policy design, exception approval, and runtime monitoring before an incident occurs. Without that clarity, the control exists in theory but not in operational practice.
👉 Read our full editorial: Identity-driven microsegmentation is overtaking IP-based zero trust
