Topic starter
11/07/2026 8:49 pm
TL;DR: A five-person security team at Spokane Teachers Credit Union says it reached more than 90% segmentation enforcement by treating cybersecurity as a business initiative, starting with smaller applications, and building repeatable Zero Trust habits, according to Illumio. The lesson is that resilience scales through governance discipline, not team size.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “How the 5-Person Security Team at Spokane Teachers Credit Union Achieves Big Zero Trust Wins”.
By the numbers:
- STCU says its five-person security team reached more than 90% segmentation enforcement.
Key questions
Q: How should security teams roll out Zero Trust segmentation without disrupting the business?
A: Start with a small, low-risk application set, define clear ownership, and use phased enforcement so the team can learn how policy behaves before expanding it.
Q: Why does segmentation fail when it is treated as a purely technical project?
A: Because enforcement only works when business owners, application teams, and security teams agree on where boundaries belong and how exceptions are handled.
Q: What are the signs that a segmentation programme is actually maturing?
A: You should see repeatable rollout patterns, clear ownership of enforcement decisions, fewer informal exceptions, and the ability to move from small applications to more complex ones without starting over.
Practitioner guidance
- Treat segmentation as a business initiative Put segmentation on the same governance cadence as other quarterly business priorities, with leadership sponsorship and measurable milestones.
- Start with smaller applications first Use low-risk applications to validate segmentation policy design, exception handling, and user support before moving to core services.
- Build a repeatable enforcement playbook Document how blocks are approved, tested, communicated, and rolled back so the team can apply the same process across multiple application tiers.
Bottom line: A small credit union team proved that segmentation can scale when it is governed as a business programme rather than a standalone technical project.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:15 pm
Zero Trust segmentation only scales when it is managed as a business control, not a technical afterthought. STCU’s story shows that leadership cadence, business prioritisation, and operational ownership matter as much as policy design. The governance lesson is that segmentation needs executive sponsorship and measurable milestones, or it becomes a stalled infrastructure project. Practitioners should treat it as an operating model decision.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when segmentation blocks or testing expose gaps in resilience?
A: Treat the gap as a control design issue, not an isolated incident. Revisit the application boundary, the exception path, and the recovery procedure together, then retest until the same path can no longer bypass the intended enforcement point. If the control fails in recovery, it is not complete in production.
👉 Read our full editorial: Zero trust segmentation lessons from a small credit union team