Topic starter
11/07/2026 8:36 pm
TL;DR: Cloud visibility alone cannot explain workload dependencies, blast radius, or lateral movement fast enough, Illumio argues. In hybrid and multi-cloud estates, relationship-aware telemetry should sharpen containment decisions and cut ambiguity around suspicious paths.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Visibility vs. Observability: Context Matters More Than Ever in the Cloud Era”.
Key questions
Q: Why does lack of context increase lateral movement risk?
A: Without context, defenders cannot distinguish normal east-west traffic from attacker movement through trusted paths.
Q: What are the signs that cloud observability is not working?
A: The main signs are alert overload, repeated uncertainty about why a port or connection exists, and slow decisions during containment.
Q: Where does cloud visibility fail in practice?
A: Visibility fails when it shows assets and traffic but not the dependency context needed to judge whether a connection is risky or expected.
Practitioner guidance
- Map workload dependencies before tightening controls Build a relationship view of workloads, services, and APIs so you can see which connections are expected, which are risky, and which support crown-jewel systems.
- Use behavioural baselines for east-west traffic Track normal communication patterns across cloud and on-prem environments so deviations can be prioritised by context rather than by alert volume alone.
- Tie segmentation to blast radius analysis Prioritise segmentation around the systems and paths most likely to expand an intrusion, not just around broad network zones or static subnets.
Bottom line: Cloud security visibility is no longer sufficient on its own because it cannot explain dependencies, lateral movement, or containment priority.
Glossary terms: AI-Powered Observability, Blast Radius, Contextualized Insights, East-west traffic
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 52 minutes ago by NHI Mgmt Group
11/07/2026 9:02 pm
Context is now the primary control variable in cloud security: raw visibility has diminishing value when environments are distributed, ephemeral, and highly connected. Security teams do not fail because they have no telemetry. They fail because telemetry without relationship context cannot tell them which pathways matter. Practitioners should therefore treat context as a governance requirement, not an optional analytics layer.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do observability and Zero Trust work together in practice?
A: Zero Trust works better when observability shows how entities authenticate, communicate, and deviate from expected behaviour. That allows security teams to apply adaptive policies, segment suspicious paths, and reduce blast radius based on evidence rather than assumption. In practice, observability supplies the context that makes Zero Trust enforcement precise.
👉 Read our full editorial: Visibility versus observability in cloud security: why context matters