How should security teams use segmentation to contain lateral movement in hybrid and multi-cloud environments?

Why This Matters for Security Teams

Segmentation only works when it is designed around real trust boundaries, not just network diagrams. In hybrid and multi-cloud estates, attackers rarely need to “break” every layer; they move through reachable services, over-permissive identities, and unmanaged east-west paths until they hit something valuable. That is why segmentation must be tied to identity, workload posture, and dependency mapping, especially where cloud control planes and on-prem networks overlap. The 2024 Non-Human Identity Security Report found that 35.6% of organisations cite consistent access across hybrid and multi-cloud environments as their top NHI security challenge.

This is also where attacker behaviour matters. The MITRE ATT&CK Enterprise Matrix shows lateral movement is not a single event but a chain of discovery, credential use, remote services, and privilege escalation. In practice, teams that segment only at the perimeter often discover gaps after a workload has already pivoted into another cloud account, VPC, or cluster.

How It Works in Practice

Effective segmentation in hybrid and multi-cloud environments starts with mapping the communication paths that actually exist, then reducing them to the minimum required for business function. That includes application-to-application traffic, workload-to-database access, build pipeline access, admin paths, and cross-environment management channels. The objective is to make lateral movement expensive, noisy, and short-lived.

For cloud-native environments, current guidance suggests combining network controls with identity-aware controls. Security groups, firewall rules, service meshes, and private connectivity can limit reachability, but they are not enough on their own when workloads authenticate with secrets that are reused across systems. Pair those boundaries with workload identity, short-lived credentials, and policy decisions evaluated at request time. That approach aligns with patterns discussed in 52 NHI Breaches Analysis and reduces the chance that one compromised token becomes a blanket path across environments.

• Segment by function, not by vague environment labels such as “prod” or “internal.”
• Use deny-by-default rules for east-west traffic and open only documented flows.
• Apply different boundaries for human admin access, CI/CD systems, and workload-to-workload calls.
• Rotate and scope secrets so a single compromise cannot cross trust zones.
• Continuously validate policies against real topology, because cloud drift changes reachability fast.

When attackers exploit stolen credentials, segmentation should force them to re-authenticate or fail at each boundary, which is why incidents like the TruffleNet BEC Attack — Stolen AWS Credentials remain so instructive for cloud defenders. These controls tend to break down when teams rely on one-time network diagrams in environments where infrastructure, identities, and routes change continuously.

Common Variations and Edge Cases

Tighter segmentation often increases operational overhead, requiring organisations to balance containment benefits against change-management, debugging, and service-discovery complexity. That tradeoff becomes more pronounced in multi-cloud estates, where each platform enforces boundaries differently and where shared services can accidentally become transit points between otherwise separate zones.

Best practice is evolving for service mesh, microsegmentation, and zero trust overlays, and there is no universal standard for this yet. Some teams centralise controls around application tiers, while others segment around sensitive data stores or administrative planes. The right choice depends on whether the main risk is workload compromise, credential theft, or cross-account privilege abuse. For cloud control-plane exposure, the Azure Key Vault privilege escalation exposure illustrates how a single mis-scoped identity can undermine carefully drawn network boundaries.

Teams should also be careful not to over-segment to the point that monitoring, incident response, and patching become blind spots. Segmentation should preserve approved management access while blocking everything else. In hybrid and multi-cloud operations, that usually means separate zones for production, shared services, management, and sensitive datasets, with explicit allow rules for each.

Related resources from NHI Mgmt Group

• How should security teams choose an identity platform for hybrid and multi-cloud environments?
• How should security teams use ITDR in cloud and hybrid environments?
• How should security teams reduce identity sprawl across hybrid and multi-cloud environments?
• How should security teams choose a PAM platform for hybrid and multi-cloud environments?