Notifications
Clear all
Topic starter
12/07/2026 12:18 pm
TL;DR: CISA’s microsegmentation guidance frames policy-controlled access as a dynamic model that uses identity, device posture, and behavioural context to make real-time decisions, according to Zero Networks’ summary of the release. The key implication is that zero trust programmes fail when segmentation remains static and privilege is still treated as a standing state.
NHIMG editorial — based on content published by Zero Networks: Microsegmentation in Zero Trust: Building Policy-Controlled Access into Your Architecture
By the numbers:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams implement policy-controlled access for privileged resources?
A: Start by placing a real enforcement point in front of the most sensitive paths, then require a live policy decision before access is granted.
Q: Why do zero trust programmes struggle when segmentation remains static?
A: Static segmentation cannot keep pace with identity changes, workload movement, and privilege creep.
Q: What breaks when privileged access is not continuously governed?
A: When privileged access is not continuously governed, standing privilege persists, dormant accounts remain usable, and the attack surface expands across human and machine identities.
Practitioner guidance
- Map privileged paths to live policy decisions Identify the administrator, workload, and service-account routes that still rely on standing trust, then move them behind a Policy Enforcement Point that can call a Policy Decision Point before access is granted.
- Prioritise JIT on lateral movement routes Apply just-in-time access first to sessions that can reach critical systems, not to low-risk traffic.
- Automate policy updates with asset discovery Link segmentation rules to current asset and identity inventories so new workloads, service accounts, and application changes do not inherit outdated permissions or stale network reachability.
What's in the full article
Zero Networks' full post covers the operational detail this analysis intentionally leaves for the source:
- Step-by-step explanation of how its enforcement points and policy decision flow are applied to privileged sessions.
- Practical examples of where just-in-time access is used for lateral movement paths and interactive administrative activity.
- Discussion of how automation is used to tag assets and generate segmentation policies without manual dependency mapping.
- The vendor's view of where persistent connectivity still remains necessary in legacy environments.
👉 Read Zero Networks’ analysis of policy-controlled access in zero trust microsegmentation →
Microsegmentation in zero trust: is policy-controlled access enough?
Explore further
12/07/2026 12:32 pm
Policy-controlled access is the right control model, but only when it is applied to identities that can be governed in real time. CISA’s framing is useful because it shifts the discussion away from static network trust and toward contextual access decisions. That said, the model only works when identity, device, and resource context are reliably available at decision time. The practitioner conclusion is that zero trust must be enforced as a live policy system, not as a design document.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why segmentation and access control fail when inventories are incomplete.
A question worth separating out:
Q: Who is accountable when identity-based access fails in a Zero Trust programme?
A: Accountability sits with the identity, security, and platform owners who control entitlement design, lifecycle governance, and response automation. If service accounts, tokens, or human credentials are outside a clear ownership model, the programme cannot enforce revocation or prove that least privilege is being maintained.
👉 Read our full editorial: Policy-controlled access turns microsegmentation into zero trust
