Notifications
Clear all
Topic starter
11/07/2026 8:41 pm
TL;DR: Hybrid mesh firewalls centralize perimeter policy across hybrid estates, but they still leave east-west movement exposed unless identity-aware microsegmentation is layered in, according to Zero Networks and Gartner. The real control gap is internal containment, where attackers pivot after initial access and exploit blind spots.
NHIMG editorial — based on content published by Zero Networks: The Future of Hybrid Mesh Firewalls and how automated, identity-aware microsegmentation blocks lateral movement
By the numbers:
- Gartner forecasts that more than 60% of organizations will have multiple firewall deployments by 2026.
- 9 of the Fortune 10 companies are included in that customer base.
Questions worth separating out
Q: How should security teams limit identity-driven lateral movement in hybrid environments?
A: Security teams should segment identity paths by privilege, business criticality, and trust boundary, then enforce different controls for privileged users, suppliers, and standard users.
Q: Why do hybrid mesh firewalls not fully solve east-west risk?
A: Hybrid mesh firewalls simplify boundary policy, but they are still primarily network controls.
Q: What do security teams get wrong about microsegmentation?
A: Teams often treat microsegmentation as a networking feature rather than an identity enforcement layer.
Practitioner guidance
- Map east-west exposure by identity and workload Build an inventory of which users, services, workloads, and device classes can reach each other inside major segments.
- Separate perimeter control from internal containment Keep hybrid mesh firewall policy as the boundary layer, then define a separate containment layer for workloads and internal systems.
- Automate segmentation updates with infrastructure change Tie policy changes to asset onboarding, workload migration, and decommissioning events so internal access does not outlive the systems it was built for.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- A breakdown of how the hybrid mesh firewall model is positioned across physical, virtual, cloud-native, and FWaaS deployments.
- The vendor’s explanation of how automated, identity-aware microsegmentation is layered to close east-west visibility gaps.
- Referenced commentary from Gartner and Palo Alto Networks on market demand, consolidation, and integration context.
- Examples of the product and partner messaging used to describe centralized management and internal traffic control.
👉 Read Zero Networks' analysis of hybrid mesh firewalls and microsegmentation →
Hybrid mesh firewalls and east-west control: are your defenses keeping up?
Explore further
11/07/2026 9:08 pm
Hybrid mesh firewalls solve policy sprawl, not identity sprawl. Centralizing perimeter management reduces operational friction, but it does not answer the harder question of which identity should be able to talk to which workload inside the environment. That distinction matters because lateral movement usually succeeds after the perimeter has already done its job. Practitioners should read mesh firewall consolidation as a control-plane simplification, not as a complete trust model.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when lateral movement controls are missing?
A: Accountability should sit with both security leadership and the teams that own identity, platform, and network policy, because lateral movement is a shared control problem. Frameworks such as NIST CSF and OWASP NHI make it clear that internal access, visibility, and containment are governance responsibilities, not optional hardening tasks. Ownership must be explicit before an incident forces the issue.
👉 Read our full editorial: Hybrid mesh firewalls need identity-aware microsegmentation for lateral movement
