Segmentation without prioritization: what are teams missing?

TL;DR: Segmentation stalls when teams treat every vulnerability as equally urgent, because severity scores alone do not reveal exploitability, reachability, or blast radius, according to Asimily. Risk-based prioritization turns a scan list into an enforceable segmentation plan, making isolation decisions more accurate and less disruptive.

Editorial analysis by NHI Mgmt Group, based on content published by Asimily: “Why Segmentation Stalls Without Risk-Based Prioritization”.

By the numbers:

• 87% describe their current approach as still needing improvement, according to Asimily.

Key questions

Q: What breaks when segmentation is built from unprioritized vulnerability lists?

A: Segmentation breaks when teams try to isolate everything or isolate the wrong things.

Q: Why do severity scores mislead segmentation teams?

A: Severity scores describe a flaw in isolation, not the device, topology, or reachable path around it.

Q: How do security teams know if segmentation is actually reducing risk?

A: Teams know segmentation is working when unnecessary workload communications disappear, exception volume falls, and policy changes are validated continuously rather than assumed.

Practitioner guidance

• Build a continuous risk baseline Maintain an always-current inventory of connected IoT, OT, and IoMT assets, and tie each device to function, ownership, and observed communications before making isolation decisions.
• Prioritise by exploitability and reachability Rank vulnerabilities by whether an attacker can actually reach and use them in the current topology, then isolate the smallest set of assets that reduces the most risk.
• Use segmentation simulation before enforcement Test proposed policy changes against real traffic and device-to-device paths so the team can see whether a rule blocks dangerous exposure or breaks essential operations.

Bottom line: Segmentation fails when teams treat every vulnerability as equally important instead of ranking what is actually reachable and exploitable.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →