Topic starter
11/07/2026 8:49 pm
TL;DR: Reaching more than 90% segmentation enforcement, Illumio reports, came from a five-person Spokane Teachers Credit Union team treating Zero Trust as a business programme, starting with smaller applications, and building repeatable habits. Segmentation gains depend on governance, clear boundaries, and tested recovery paths before expanding to core services.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “How the 5-Person Security Team at Spokane Teachers Credit Union Achieves Big Zero Trust Wins”.
By the numbers:
- STCU says its five-person security team reached more than 90% segmentation enforcement.
Key questions
Q: Why does segmentation fail when it is treated as a purely technical project?
A: Because enforcement only works when business owners, application teams, and security teams agree on where boundaries belong and how exceptions are handled.
Q: What are the signs that a segmentation programme is actually maturing?
A: You should see repeatable rollout patterns, clear ownership of enforcement decisions, fewer informal exceptions, and the ability to move from small applications to more complex ones without starting over.
Q: How should security teams roll out Zero Trust segmentation without disrupting the business?
A: Start with a small, low-risk application set, define clear ownership, and use phased enforcement so the team can learn how policy behaves before expanding it.
Practitioner guidance
- Treat segmentation as a business initiative Put segmentation on the same governance cadence as other quarterly business priorities, with leadership sponsorship and measurable milestones.
- Start with smaller applications first Use low-risk applications to validate segmentation policy design, exception handling, and user support before moving to core services.
- Build a repeatable enforcement playbook Document how blocks are approved, tested, communicated, and rolled back so the team can apply the same process across multiple application tiers.
Bottom line: A small credit union team proved that segmentation can scale when it is governed as a business programme rather than a standalone technical project.
Glossary terms: Zero Trust Micro-Segmentation, Microsegmentation, East-west traffic, Assume-Breach Model
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 hours ago by NHI Mgmt Group
11/07/2026 9:15 pm
Zero Trust segmentation only scales when it is managed as a business control, not a technical afterthought. STCU’s story shows that leadership cadence, business prioritisation, and operational ownership matter as much as policy design. The governance lesson is that segmentation needs executive sponsorship and measurable milestones, or it becomes a stalled infrastructure project. Practitioners should treat it as an operating model decision.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when segmentation blocks or testing expose gaps in resilience?
A: Treat the gap as a control design issue, not an isolated incident. Revisit the application boundary, the exception path, and the recovery procedure together, then retest until the same path can no longer bypass the intended enforcement point. If the control fails in recovery, it is not complete in production.
👉 Read our full editorial: Zero trust segmentation lessons from a small credit union team