When should manufacturers prioritise segmentation over other security projects?

Why segmentation moves ahead of other security work

Manufacturing is one of the few environments where a single security weakness can become an operational event very quickly. Segmentation is worth moving up the queue when the plant depends on shared networks, shared credentials, or legacy systems that were never built for fine-grained access control. It is also the right early investment when the business needs Zero Trust Architecture principles such as least privilege and micro-segmentation to reduce blast radius.

That priority shifts even further when production lines, engineering workstations, historians, or remote support paths are connected in ways that let an incident move laterally across the environment. In that situation, segmentation is not just a network design preference. It is a containment decision that can preserve uptime, isolate an infected zone, and prevent an outage from turning into a plant-wide shutdown.

For OT-heavy environments, the case becomes stronger because plant networks often have long-lived assets, vendor-maintained equipment, and protocol dependencies that make a flat trust model too risky. NIST’s OT Security Guide treats segmentation as a core way to limit propagation between zones and to separate control functions from less trusted enterprise connectivity.

What makes segmentation more urgent than other projects

Segmentation rises to the top when the likely impact of compromise is broader than the value of the initial target. If one workstation compromise can reach controllers, safety systems, remote administration paths, or multiple production cells, then the control is solving a concentration problem, not merely a hygiene problem. That is especially true where cyber insurance, customer assurance, or plant resilience commitments depend on showing that critical zones are separated and monitored.

It is also often the right priority when legacy assets cannot be patched quickly, cannot support modern authentication, or are too fragile for disruptive remediation. In those cases, segmentation compensates for weak endpoints by reducing how far an attacker or outage can travel. It does not fix the vulnerable asset, but it can stop the asset from becoming a gateway to everything else.

In practice, this is why segmentation often outranks projects such as broad tool replacement, lower-risk hardening, or cosmetic policy work. If the environment still allows broad lateral movement, the organisation is effectively betting that nothing important will be reached after the first compromise. That is usually the wrong bet for manufacturing.

When to treat segmentation as the next containment layer

Prioritise it when you can answer yes to any of these conditions: a production outage would cascade across multiple lines; remote access or shared service paths reach too much of the plant; a legacy platform must remain online for the near term; or your insurer, auditor, or customer requires evidence of zone separation. In those cases, segmentation should be treated as a containment layer with direct operational value, not as a background architecture improvement.

Where the environment includes industrial control systems, the supporting control logic should reflect the plant’s actual process boundaries, not just the IT network diagram. The most effective programmes separate critical operations, vendor access, engineering access, and corporate IT traffic into distinct trust zones and enforce explicit flows between them. That is consistent with the guidance in NIST SP 800-82 Rev. 3 and with broader CIS Controls v8 priorities around limiting attack paths and reducing the consequences of compromise.

Where segmentation decisions also affect access to APIs, remote maintenance, or shared machine credentials, the control should be designed so that each flow is intentional, logged, and narrowly allowed. That makes the environment easier to defend during a crisis and easier to explain to insurers, operations leaders, and third parties.

Practitioner Guidance

What to prioritise: Put segmentation ahead of projects that do not materially shrink blast radius. If one compromised asset can still reach production control, remote support, or multiple plants, the architecture remains too flat.

What to verify: Confirm that you can describe the permitted flows between corporate IT, OT, remote access, vendors, and safety-critical zones in plain language. If you cannot explain those boundaries, they are not yet enforceable enough to trust.

Decision rule: If the control is needed to stop lateral movement, preserve uptime, or satisfy a binding insurance condition, treat it as a resilience project with security benefits, not as a discretionary network cleanup.

Practitioner takeaway: In manufacturing, segmentation becomes a priority when containment is the business outcome. The question is not whether the network is cleaner, it is whether a single compromise can still become a plant-level event.

Related resources from NHI Mgmt Group

• When should organisations prioritise quantum risk work over other security projects?
• When should security teams prioritise PQC work over other cryptographic projects?
• When should organisations prioritise NHI security over other identity work?
• Should organisations prioritise phishing-resistant MFA over other identity projects?