Notifications
Clear all
Topic starter
08/06/2026 4:12 pm
TL;DR: Zero trust restricts access by default while microsegmentation limits lateral movement inside the network, and Axiad’s explainer argues the two work best when identity controls, authentication, and segment-level permissions are aligned. The real issue is that perimeter thinking and broad trust assumptions still leave room for unauthorized access and spread.
NHIMG editorial — based on content published by Axiad: Zero Trust and Microsegmentation: An Explainer
By the numbers:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
Questions worth separating out
Q: How should security teams use microsegmentation with zero trust?
A: Security teams should use zero trust to control whether an identity can access a resource and microsegmentation to control how far that identity can move after access is granted.
Q: Why do NHIs complicate zero trust programmes?
A: NHIs complicate zero trust because many of them authenticate successfully but then operate with persistent, excessive, or poorly reviewed access.
Q: What breaks when microsegmentation is implemented without identity governance?
A: Microsegmentation without identity governance often leaves the root problem untouched: identities still have too much legitimate access.
Practitioner guidance
- Map identity scope to network zones Document which human and non-human identities can reach which segments, then remove broad east-west access that has no current business justification.
- Reduce standing privilege before tuning segmentation Review service accounts, API keys, and privileged accounts for excess access, then shrink entitlements before relying on microsegmentation to contain misuse.
- Tie zero trust policy to identity lifecycle events Link provisioning, role changes, offboarding, and secret rotation to the same access policy logic so stale identity rights do not outlive the purpose they were granted for.
What's in the full article
Axiad's full blog post covers the operational detail this post intentionally leaves for the source:
- The article walks through the distinction between zero trust and microsegmentation with implementation examples.
- It compares network segmentation, microsegmentation, SDN, and application-level controls for different environments.
- It outlines adoption considerations such as resource impact, troubleshooting trade-offs, and integration with authentication services.
- It frames passwordless authentication as part of the broader zero-trust and microsegmentation stack.
👉 Read Axiad's explainer on zero trust and microsegmentation →
Zero trust and microsegmentation: are your identity controls aligned?
Explore further
08/06/2026 5:43 pm
Zero trust without identity governance is only partial containment. The model assumes access is continuously evaluated, but that breaks down if identities are over-permissioned or secrets remain long lived. In NHI-heavy environments, the control problem is not just login assurance, it is entitlement scope across the session. Practitioners should treat identity governance as the enforcement layer that makes zero trust credible.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means most teams cannot verify whether segmentation or zero trust policies are even aligned to real identity scope.
A question worth separating out:
Q: How do IAM teams know whether zero trust and segmentation are actually working?
A: Teams should test whether authenticated identities are constrained to the exact resources they need and whether a compromise can be contained to a small zone. If service accounts can still reach sensitive systems broadly, or if lateral movement succeeds despite segmentation, the controls are not operating as intended.
👉 Read our full editorial: Zero trust and microsegmentation: what IAM teams need to know
