Topic starter
10/07/2026 9:18 pm
TL;DR: Zero-trust programmes still stall when teams treat microsegmentation as optional, according to Elisity, because ZTNA controls north-south access but not the east-west movement that attackers use after initial access. Microsegmentation has become more practical through identity-based, agentless enforcement, so the real question is whether organisations can operationalise it across IT, OT, and IoT.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Why Zero Trust Requires Microsegmentation: A Former Forrester Analyst Weighs In”.
Key questions
Q: What breaks when zero trust stops at user access and ignores internal traffic?
A: When zero trust focuses only on north-south access, the internal environment remains permissive enough for lateral movement after the first foothold.
Q: Why does microsegmentation reduce risk even when initial access is already controlled?
A: Because initial access control does not stop an attacker from moving laterally once inside.
Q: How do security teams know if identity-based segmentation is actually working?
A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services.
Practitioner guidance
- Map east-west trust paths Inventory which internal systems can communicate today without explicit policy, then identify where lateral movement could bypass zero-trust controls.
- Redesign segmentation around identity Use device identity, function, and context as the policy anchor instead of IP addresses or static subnets.
- Validate coverage across constrained assets Test whether your segmentation model covers IoT, OT, medical, and other non-agent-capable devices without exception.
Bottom line: Microsegmentation is the missing interior control when zero trust verifies entry but does not constrain movement after access is granted.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:40 pm
Microsegmentation is no longer an optional design choice inside zero trust programmes. Zero trust that stops at user access leaves the interior of the environment governed by legacy trust assumptions. That assumption fails because attackers do not need to break every boundary if they can move laterally after the first foothold. The practical conclusion is that microsegmentation now defines whether zero trust is actually enforceable.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Why do ZTNA and microsegmentation need to work together?
A: ZTNA limits who can reach specific applications from outside, while microsegmentation limits how far access can move once traffic is inside. Used together, they reduce both initial access breadth and lateral movement potential. If only one is deployed, attackers can still exploit the other path to expand their reach across the environment.
👉 Read our full editorial: Microsegmentation is the missing control in zero trust architectures