Identity-based microsegmentation: are firewall rules still the bottleneck?

TL;DR: Microsegmentation still stalls because firewall rules, ACLs and VLANs make deployment slow and risky, even though only 24% of organisations have deployed it extensively, according to NetFoundry’s report, published with Omdia’s technical review. Identity-based policy tied to cryptographic identities shifts control from network location to workload and AI agent identity.

Editorial analysis by NHI Mgmt Group, based on content published by NetFoundry: “Omdia Technical First Look”.

By the numbers:

• Only 24% of organisations have deployed microsegmentation extensively.

Key questions

Q: What breaks when cloud microsegmentation is still tied to IP addresses?

A: Static IP-based segmentation breaks when workloads scale, relocate, or disappear faster than policy updates can keep up.

Q: Why does identity-based segmentation reduce lateral movement risk for workloads?

A: Because it only permits connections between identities that policy explicitly allows, rather than between anything on the same subnet.

Q: How do security teams know if identity-based segmentation is actually working?

A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services.

Practitioner guidance

• Inventory workload and AI agent identities Map which services, APIs and agents currently rely on IP-based reachability so you can identify where policy will break as infrastructure changes.
• Shift segmentation policy to identity tags Define approved connections by cryptographic identity and service role, not by subnet, firewall zone or static address block.
• Test immediate revocation paths Remove a single identity attribute from a non-production workload and confirm that access stops without waiting for firewall propagation or route changes.

Bottom line: Microsegmentation remains valuable, but topology-based policy makes it harder to deploy and govern consistently across hybrid environments.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →