Notifications
Clear all
Topic starter
02/08/2026 11:54 am
TL;DR: Microsegmentation can reduce blast radius, but policy drift, exceptions, and infrastructure churn mean deployed controls may not still block lateral movement, according to SafeBreach. Continuous validation turns Zero Trust from an assumption into evidence, and that evidence is increasingly what boards, auditors, and regulators expect.
NHIMG editorial — based on content published by SafeBreach: Proving Zero Trust in Practice: Continuous Validation for Segmentation and Lateral Movement Defense
Questions worth separating out
Q: What fails when microsegmentation is deployed but not continuously validated?
A: The control fails at the point where the environment changes faster than the policy.
Q: Why do segmentation controls matter so much once an identity is compromised?
A: Because identity compromise is often the trigger for lateral movement.
Q: How do security teams know if segmentation is actually reducing risk?
A: Teams know segmentation is working when unnecessary workload communications disappear, exception volume falls, and policy changes are validated continuously rather than assumed.
Practitioner guidance
- Map and test lateral movement paths Inventory the specific east-west routes that matter to critical applications, then validate whether those routes are actually blocked under current policy.
- Re-test segmentation after every policy exception Treat each temporary allow rule as a security change that requires follow-up validation.
- Tie segmentation evidence to identity and privilege reviews Use simulation results to identify where compromised credentials or over-privileged accounts can still reach sensitive systems.
What's in the full article
SafeBreach's full blog post covers the operational detail this post intentionally leaves for the source:
- How the attack simulation workflow maps to segmentation validation across segmented environments
- What SafeBreach and Akamai Guardicore each contribute to the closed-loop testing model
- Which specific attack techniques the vendor uses to demonstrate blocked and unblocked movement
- How the article frames DORA, NIS2, and TIBER-EU evidence expectations for resilience reporting
👉 Read SafeBreach's analysis of continuous validation for zero trust segmentation →
Zero trust segmentation: how do teams prove lateral movement is blocked?
Explore further
02/08/2026 1:02 pm
Continuous validation is the missing assurance layer in zero trust segmentation. Deployment tells you a control exists, but it does not tell you whether the control still blocks the paths attackers use. Dynamic infrastructure, exceptions, and policy drift make that distinction critical. The practical conclusion is that zero trust cannot be claimed from configuration alone.
A question worth separating out:
Q: Who is accountable when segmentation controls do not contain an incident?
A: Accountability usually spans infrastructure, security architecture, and the teams that approved exceptions or changes. Under resilience and governance regimes, leaders must show not only that controls exist, but that they were tested and remained effective. If containment failed, the issue is as much about assurance as enforcement.
👉 Read our full editorial: Continuous validation is now essential for zero trust segmentation
