Topic starter
10/07/2026 9:26 pm
TL;DR: At Gartner SRM 2026, the recurring themes were that AI and automation are strengthening defenders, vulnerability exploitation has overtaken credential abuse as the top initial access vector at 31% of breaches, and identity-first microsegmentation is becoming the practical answer for mixed IT, OT, and unmanaged environments, according to Elisity. The governance lesson is that visibility, identity, and enforcement now have to move together, or segmentation becomes a theory rather than a control.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Field Notes from Gartner SRM 2026: Four Threads I'm Still Thinking About”.
Key questions
Q: What breaks when segmentation is not tied to identity in mixed environments?
A: Network-based segmentation breaks down when assets are unmanaged, legacy, or impossible to classify from the wire alone.
Q: Why does visibility have to be measured before segmentation can work?
A: Because policy quality depends on knowing what exists, who is accessing it, and where exposure already sits.
Q: What are the signs that identity-first microsegmentation is being misapplied?
A: Common warning signs are policy rules that still depend on network zones, exceptions that keep growing for unmanaged assets, and false positives that create more operational friction than the control removes.
Practitioner guidance
- Define identity as the segmentation anchor Map access policy to user, device, workload, or asset identity rather than relying on network location alone, especially where legacy or unmanaged assets are present.
- Measure visibility before widening enforcement Establish a baseline for what is on the network, who is remoting into it, and what is exposed without authentication before you expand segmentation scope.
- Separate IT and OT policy logic Keep policy intent, enforcement, and exception handling distinct across operational and enterprise environments so a block in one domain does not create unacceptable operational impact in the other.
Bottom line: Identity-first microsegmentation is emerging as a practical response to environments where network location no longer tells the full trust story.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:49 pm
Identity-first microsegmentation is becoming a governance control, not just a network design pattern. The article shows that the real problem is not simply segmentation scope but whether the policy can follow identity in environments where network signals are too weak to govern access reliably. That makes the control relevant across IT, OT, and unmanaged assets, where enforcement must work even when the underlying infrastructure cannot be normalized. The practitioner conclusion is that segmentation now has to be treated as identity governance at runtime.
A question worth separating out:
Q: How do security teams know when OT segmentation is becoming unmanageable?
A: The clearest sign is when policy changes become constant just to preserve normal operations. If teams are repeatedly editing firewall rules, VLANs or IP-based exceptions to keep connected OT systems working, the segmentation model is describing the network layout but not governing real trust relationships.
👉 Read our full editorial: Identity-first microsegmentation and AI automation are converging