Topic starter
10/07/2026 9:26 pm
TL;DR: Identity-first microsegmentation is emerging as a practical response to mixed IT, OT, and unmanaged environments, Elisity reports. Segmentation has to rest on a visibility baseline that can support identity-based enforcement where network location no longer tells the full trust story.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Field Notes from Gartner SRM 2026: Four Threads I'm Still Thinking About”.
Key questions
Q: Why does visibility have to be measured before segmentation can work?
A: Because policy quality depends on knowing what exists, who is accessing it, and where exposure already sits.
Q: What are the signs that identity-first microsegmentation is being misapplied?
A: Common warning signs are policy rules that still depend on network zones, exceptions that keep growing for unmanaged assets, and false positives that create more operational friction than the control removes.
Q: What breaks when segmentation is not tied to identity in mixed environments?
A: Network-based segmentation breaks down when assets are unmanaged, legacy, or impossible to classify from the wire alone.
Practitioner guidance
- Define identity as the segmentation anchor Map access policy to user, device, workload, or asset identity rather than relying on network location alone, especially where legacy or unmanaged assets are present.
- Measure visibility before widening enforcement Establish a baseline for what is on the network, who is remoting into it, and what is exposed without authentication before you expand segmentation scope.
- Separate IT and OT policy logic Keep policy intent, enforcement, and exception handling distinct across operational and enterprise environments so a block in one domain does not create unacceptable operational impact in the other.
Bottom line: Identity-first microsegmentation is emerging as a practical response to environments where network location no longer tells the full trust story.
Glossary terms: Identity-based Microsegmentation, Operational technology segmentation, Visibility baseline, Identity-Aware Automation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 hours ago by NHI Mgmt Group
10/07/2026 9:49 pm
Identity-first microsegmentation is becoming a governance control, not just a network design pattern. The article shows that the real problem is not simply segmentation scope but whether the policy can follow identity in environments where network signals are too weak to govern access reliably. That makes the control relevant across IT, OT, and unmanaged assets, where enforcement must work even when the underlying infrastructure cannot be normalized. The practitioner conclusion is that segmentation now has to be treated as identity governance at runtime.
A question worth separating out:
Q: How do security teams know when OT segmentation is becoming unmanageable?
A: The clearest sign is when policy changes become constant just to preserve normal operations. If teams are repeatedly editing firewall rules, VLANs or IP-based exceptions to keep connected OT systems working, the segmentation model is describing the network layout but not governing real trust relationships.
👉 Read our full editorial: Identity-first microsegmentation and AI automation are converging