When should industrial teams choose identity-based segmentation over network redesign?

Why industrial teams should favor identity-based segmentation first

Identity-based segmentation is the better choice when the goal is to shrink lateral movement without taking on the operational risk of readdressing production networks. In industrial environments, the most valuable boundary is often the one tied to a user, service, device, or workload’s authenticated context, not a new subnet map. That makes the control easier to phase in around fragile plants, vendor access, and always-on systems.

It also fits places where topology is already a constraint. Legacy controllers, flat zones, shared services, and tightly coupled process networks can make network redesign slow, risky, or politically impossible. Identity-based policy lets teams narrow who can talk to what while leaving the underlying industrial layout intact.

For teams comparing it with redesign, the key question is whether the security objective is policy enforcement or architectural reconstruction. If you can enforce access decisions at the point of request, then a redesign is not always necessary. If the problem is broken segmentation by design, weak routing boundaries, or uncontrolled shared infrastructure, a network change may still be the cleaner long-term fix.

Where identity-based segmentation outperforms VLAN or firewall rework

It tends to win in brownfield operations, staged modernization, and environments with high change sensitivity. A plant that cannot absorb downtime can usually accept incremental policy control more easily than a redesign that touches addressing, routing, ACLs, and validation across multiple cells or sites. That is why identity-centric security is often paired with NIST SP 800-207 Zero Trust Architecture when teams want to reduce trust by decision, not by network geography.

It is also the stronger option when access patterns are already identity-rich. If operators, engineers, vendors, or automated services authenticate individually, policy can follow the credential or device state across segments. For industrial networks, that matters because a shared VLAN may still contain many trust relationships, but identity-based controls can distinguish what each actor is allowed to reach. NHIMG’s OT and ICS Identity and Access Guide covers the shared-account and vendor-access conditions that make this approach practical.

It is less attractive when the real issue is infrastructure debt that should be removed, not abstracted. If the plant has chronic flatness, unmanaged exceptions, or repeated firewall bypasses, segmentation by identity can reduce exposure, but it does not eliminate weak architecture. In that case, identity-based controls should be treated as a containment step while the longer-term network design is still planned.

How to decide whether the control objective is containment or redesign

The decision is usually not about which approach is “more secure” in the abstract. It is about which one can be adopted safely enough, fast enough, and with enough coverage. If the team cannot tolerate service interruption, cannot retest every dependency, or cannot coordinate a broad routing change across OT and IT boundaries, then identity-based segmentation is often the more realistic control.

That is especially true when you need to preserve process uptime while still cutting off unnecessary east-west access. Identity-centric policies can be introduced in layers, starting with the highest-risk paths. NHIMG’s Zero Trust Identity Guide is useful here because it frames segmentation as an identity and policy problem rather than a pure network remodel.

Use network redesign when you need durable structural simplification, when segmentation boundaries are consistently violated, or when the environment is already due for a migration. Use identity-based segmentation when the operational cost of change is too high and the immediate security win comes from reducing blast radius. A practical team will often start with identity-based controls first, then redesign the network later where the architecture still justifies it.

Risk and Threat Considerations

The main risk in choosing the wrong approach is false confidence. Identity-based segmentation can reduce lateral movement, but only if identities are clean, access rules are well-scoped, and policy coverage is broad enough to matter. If the environment still has shared accounts, stale credentials, or poor visibility into service access, attackers can abuse legitimate trust paths even when the network is “segmented.”

Failure mechanism: The control fails when identities remain over-privileged, reused, or difficult to attribute, allowing compromise of one actor to reach multiple industrial assets through permitted paths.

Impact: Lateral movement becomes easier, incident containment weakens, and the organisation may discover that it replaced a topology problem with an access-governance problem.

Practitioner Guidance

What to prioritise: Start with the paths that would cause the most operational damage if abused, such as vendor access, engineering workstations, remote support, and shared services. Those are the places where identity-based segmentation can reduce risk fastest without forcing a redesign of the whole plant.

What to verify: Confirm that the control is enforced at the actual choke points, not just documented in policy. In practice, that means checking whether identities are unique, whether access decisions are specific enough to prevent broad lateral reach, and whether exceptions are tracked rather than informally tolerated.

Practitioner takeaway: Choose identity-based segmentation when the plant needs immediate blast-radius reduction without architectural disruption; choose redesign when the network itself is the root cause and the environment can safely absorb the change.

Related resources from NHI Mgmt Group

• When should teams choose identity-first access over network segmentation for workloads?
• What is the difference between OT network segmentation and identity-based access control?
• How should security teams choose between browser-based and network-level AI governance?
• How should teams choose a Kubernetes ingress controller for identity-based access?