Topic starter
11/07/2026 8:24 pm
TL;DR: Attackers can begin lateral movement in as little as 27 minutes, Elisity reports, while identification and containment still average 258 days. Identity-based microsegmentation has to shrink reachable paths fast, or a single foothold can spread across flat networks and legacy systems.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Breach Security: The CISO's Guide to Prevention and Containment in Healthcare, Pharmaceutical, and Manufacturing Organizations”.
By the numbers:
- Attacks can reach lateral movement in as little as 27 minutes after initial compromise.
- The average time to identify and contain a breach still hovers around 258 days.
Key questions
Q: Why does lateral movement create such a high risk for manufacturing and healthcare networks?
A: Lateral movement is dangerous because a single foothold can turn into broad access across connected systems, including OT controllers and medical devices that are hard to patch or monitor.
Q: How do teams know if microsegmentation is actually working?
A: Microsegmentation is working when a compromised workload cannot reach anything outside its explicit policy boundary.
Q: What breaks when a critical industry network is left flat after compromise
A: Flat internal networks turn a single foothold into an enterprise-wide problem because the attacker can pivot laterally without encountering meaningful internal boundaries.
Practitioner guidance
- Map internal trust paths Identify the east-west paths that let a compromised endpoint, user, or workload reach higher-value systems.
- Contain by identity, not subnet Define segmentation policies around user, workload, and device identity so access is granted by role and function rather than by IP range or VLAN membership.
- Treat OT and medical devices as containment first-class citizens Build specific access boundaries for devices that cannot be patched or instrumented like standard endpoints.
Bottom line: The core problem is not only initial compromise but the internal trust structure that lets an attacker move from one foothold to many.
Glossary terms: Identity-based Microsegmentation, Lateral Movement, Blast Radius, East-west traffic
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 hours ago by NHI Mgmt Group
11/07/2026 8:54 pm
Identity-based containment is now a breach security requirement, not an optimisation. The article shows that modern attacks move faster than most organisations can detect and respond, which means the practical control question is containment after initial access. In critical industries, flat networks and permissive east-west traffic turn a single compromise into an operational event. Practitioners should treat blast-radius reduction as a primary security objective.
A few things that frame the scale:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
A question worth separating out:
Q: What should organisations do when identity and operational technology both share the same network
A: They should treat shared network space as a containment risk and define access boundaries around identity and function instead of simple connectivity. OT and medical systems often cannot absorb the same controls as standard endpoints, so the governance model has to isolate them without breaking operations. That requires policy that respects operational constraints while narrowing trust.
👉 Read our full editorial: Breach security in critical industries needs identity-based containment