Topic starter
10/07/2026 9:22 pm
TL;DR: Most microsegmentation projects fail because device diversity, silos, incomplete visibility, and immature enforcement tooling make policy hard to apply consistently across IT and OT environments, according to Elisity’s interview with RedSeal’s Joseph Ward. The practical answer is to validate exposure first, then enforce identity-aware network controls where agents and reboots are not viable.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Why Network Segmentation Projects Fail: A RedSeal CPTO View”.
Key questions
Q: What breaks when network segmentation is applied to OT without device-touch controls?
A: The model breaks when segmentation assumes agents, reboots, or direct device management are available.
Q: Why does poor visibility make segmentation projects fail so often?
A: Poor visibility means teams cannot see the traffic paths, device relationships, or policy exceptions they need to govern.
Q: How do security teams know if identity-based segmentation is actually working?
A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services.
Practitioner guidance
- Validate exposure before enforcing segmentation Build a current map of east-west reachability across firewalls, switches, routers, and endpoints before turning on stricter controls.
- Separate policy modelling from policy enforcement Use one process to simulate or review reachability and a different process to apply runtime enforcement, so a failed rollout does not erase your understanding of exposure.
- Design OT segmentation around immutable devices Assume controllers, sensors, and SCADA-connected assets cannot host agents or tolerate reboots, then place enforcement at the network layer where those devices can still be protected.
Bottom line: Segmentation programmes fail when policy design assumes a uniform estate and a control model that OT devices cannot support.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:44 pm
Segmentation failure is now a governance problem, not just a tooling problem. The article shows that policy intent collapses when network, security, and operations teams do not share a common model for what should be reachable. That is why many segmentation programmes stall even after a clear charter. For practitioners, the lesson is that segmentation succeeds only when ownership, scope, and enforcement model are aligned before rollout.
A question worth separating out:
Q: Should organisations prioritise exposure mapping or active enforcement first?
A: Exposure mapping should usually come first because it shows where the current policy is already failing and where enforcement will be most disruptive. Once teams understand the reachable paths, they can apply active enforcement with fewer surprises and less operator resistance. In complex IT and OT estates, sequencing the map before the guardrail reduces rollout risk.
👉 Read our full editorial: Why network segmentation projects fail and what OT changes