East west traffic is service to service communication inside the environment, while north south traffic is traffic entering from or leaving toward users and external systems. Zero trust must handle both. East west controls limit lateral movement between workloads, and north south controls govern who can reach protected resources from outside the service boundary.
How east west traffic changes the zero trust problem
east west traffic is the trust boundary inside the environment, where zero trust has to assume that a workload, service, or segment may already be compromised. That is why internal traffic controls focus on identity-aware policy, segmentation, and verified service-to-service access rather than treating the internal network as safe by default. NIST’s Zero Trust Architecture is the clearest baseline for this model.
In practice, east west traffic is where lateral movement becomes possible. Once an attacker lands in one workload, unchecked internal paths can let them enumerate services, pivot into adjacent systems, and reach higher-value assets without ever crossing a perimeter control again. That is why zero trust implementations often pair policy enforcement with workload identity and service-level authentication, as described in Guide to SPIFFE and SPIRE and the Ultimate Guide to NHIs, Standards.
East west controls usually become more granular than north south controls because the internal environment contains many more service relationships than user entry points. That means policy needs to be based on workload identity, service role, and request context, not just subnet membership or firewall placement. Where organisations also rely on non-human identities for these service paths, the same principle of least privilege applies to the credentials and trust material that allow those services to talk to each other.
How north south traffic differs at the boundary
North south traffic is the traffic that crosses the environment boundary, usually from end users, partner systems, or the public internet into protected services, and then back out again. In zero trust, this path is the enforcement point for access decisions, authentication, and admission control, because the system must evaluate every request before it is allowed to reach the protected resource. NIST SP 800-207 is also the right reference for this boundary model.
Compared with east west traffic, north south traffic is often easier to see and govern because it passes through fewer choke points such as gateways, ingress proxies, VPN replacements, or application front doors. The control challenge is not volume alone, but the need to make strong trust decisions without relying on network location as a proxy for legitimacy. That is why external access usually combines strong authentication, device or session checks, and least-privilege authorization before a user or external system is admitted.
Zero trust does not stop at the edge, though. If north south controls are strong but east west traffic is wide open, an attacker who gets one valid session, token, or service path may still move laterally after initial entry. The boundary is only one part of the enforcement chain.
What practitioners should verify when designing both paths
What to verify: Treat east west and north south policies as separate design problems with shared governance. Verify that internal service calls are denied by default unless a specific identity, role, or workload trust relationship is present, and confirm that external entry paths require explicit authentication and policy evaluation before access is granted.
What changes at scale: As the number of services grows, east west traffic becomes the harder problem operationally because every new workload adds more possible internal paths. That is where identity sprawl, overbroad permissions, and weak service ownership become security issues rather than mere architecture issues. NHIMG’s The 2026 Infrastructure Identity Survey shows that 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, which reinforces how central internal trust relationships become once the environment is distributed.
Practitioner takeaway: The practical difference is not just direction of traffic, but where trust is granted, how often it is re-evaluated, and how much lateral movement a single compromise can create. A mature zero trust design must make both paths identity-aware, but it should be especially strict inside the environment because that is where compromise tends to spread.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST Zero Trust (SP 800-207) | ZT-1 — All resources are considered explicitly untrusted | Zero trust is the governing model for both internal and external traffic decisions. |
| AC-4 — Flow Control and Segmentation | East west traffic depends on segmentation and allowed service-to-service flows. | |
| IA-2 — Identity Authentication | North south traffic requires strong authentication at the access boundary. | |
| Recommendation — Treat every east west and north south request as untrusted until policy verifies it. Use flow controls to restrict east west paths and limit lateral movement. Authenticate inbound users and external systems before allowing protected access. | ||
| CIS Controls v8 | 6.3 — Require Multi-factor Authentication | Boundary access decisions depend on strong authentication for external entry points. |
| 6.1 — Establish and Maintain an Inventory of Accounts | East west traffic depends on knowing which service accounts and workloads may communicate. | |
| Recommendation — Require MFA for externally reachable access paths and privileged sessions. Inventory service and workload accounts that participate in internal traffic. | ||
| OWASP Non-Human Identity Top 10 | NHI-03 — Secret Sprawl and Rotation | East west trust often depends on credentials used by workloads to talk internally. |
| NHI-05 — Excessive Privileges | Internal traffic becomes dangerous when workloads can reach far more than needed. | |
| Recommendation — Rotate internal service credentials and reduce exposed trust material. Constrain service-to-service permissions to the smallest necessary scope. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
