Microsegmentation splits an environment into small segments, down to a single workload, application or process, and controls the east-west traffic between them with fine-grained policy instead of trusting everything inside a VLAN or subnet zone. Its job is to limit lateral movement: CISA’s July 2025 guide, Microsegmentation in Zero Trust Part One: Introduction and Planning, says it “helps reduce the blast area that a compromised resource can impact.” ZTNA and SASE govern how users reach applications; microsegmentation governs what workloads can reach each other.
More security analysis is listed in Enterprise Techie’s topic index.
In this guide
Key facts
| Term | What the source says | Source |
|---|---|---|
| Microsegmentation | Divides the network, physically or virtually, by the communication needs of application and data workflows | CISA, quoting its TIC 3.0 definition (July 2025) |
| Micro segmentation | Breaks part of the network into smaller components to limit lateral data flows | NSA (March 2024) |
| Enforcement types | Network, endpoint, container, hypervisor and cloud, usually combined | CISA (2025) |
| Zero trust target | Distributed micro-perimeters with just-in-time, just-enough connectivity | CISA Zero Trust Maturity Model v2.0 (April 2023) |
What microsegmentation is
CISA’s guide starts from the traditional meaning: smaller zones or address ranges with “more granular, manually created and managed access rules” on firewalls, routers, switches or virtual networks. In zero trust, policy enforcement points (PEPs) can also sit in hosts, applications, databases, operating systems or virtualization platforms, and rules use attributes of the connection, not just IP addresses, checked at first access and while it lasts.
NSA’s network and environment pillar guidance puts it in organizational terms: macro segmentation keeps IT out of accounting’s network; micro segmentation means “employees in the same department should not have access to each other’s resources unless explicitly required.” In CISA’s data center example, servers talk only to the servers their business function needs. In advanced designs that follow application workflows, a microsegment’s boundary “may change from moment to moment.”
Microsegmentation vs network segmentation
| Network (macro) segmentation | Microsegmentation | |
|---|---|---|
| Unit of control | Zones: VLANs, subnets, departments, environments | Workloads, applications, users or workflows |
| Traffic governed | Between zones, with few limits inside them | Between workloads, including inside a zone |
| Policy basis | IP ranges and static rules | Labels, identities and connection attributes |
| Enforced on | Perimeter and internal firewalls, routers, switches | Hosts, hypervisors, cloud controls, orchestrators, firewalls |
CISA says macrosegmentation “is simpler to manage than Microsegmentation but lacks the granular control necessary to address modern threats.” The two work as layers: CISA expects traditional trust zones to remain, with microsegments that subdivide or cross them, and NSA recommends segmenting “at both the macro and micro levels.”
Why it matters: lateral movement and blast radius
NIST SP 800-207 notes that once attackers breach a perimeter, “further lateral movement is unhindered,” and NSA calls lateral movement one of the most common techniques after initial access. OMB memorandum M-22-09, quoted by CISA, requires federal agencies to isolate environments so an adversary who compromises one application or component “cannot easily move laterally.”
CISA lists the payoffs: less room for lateral movement, better containment of “malware, malicious code, bugs, misconfigured systems and insider threats,” and more visibility. NIST notes that an attacker with valid credentials can still reach whatever those credentials allow, and CISA says microsegmentation “does not replace defense-in-depth.” Against ransomware it limits what one infected host can reach but does not stop the infection; recovery still needs a tested ransomware recovery plan.
Enforcement approaches compared
CISA says a single solution across the enterprise may not be “feasible or advisable,” so most estates mix approaches:
| Approach | Where policy is enforced | What it sees | Strengths | Limits | Typical environment |
|---|---|---|---|---|---|
| Host agent or OS firewall | Each server or endpoint | Local applications, services, ports and peers | Moves with the host; application-aware | Agent on every host; may not run on appliances, IoT, OT or legacy systems | Servers, user devices, IaaS |
| Hypervisor or virtual network | Each VM’s virtual NIC on the hypervisor host | Traffic in and out of each VM | Enforced outside the guest; familiar firewall model | Tied to one hypervisor and to hardware the organization runs | Private cloud, vSphere estates |
| Cloud-native controls | The provider’s virtual network | Traffic to and from attached resources | Built in; rules can reference groups instead of IPs | Provider-specific; separate policy per cloud | IaaS and PaaS |
| Kubernetes NetworkPolicy | The cluster’s network plugin | Pod traffic at layers 3 and 4, selected by labels | Application-centric; fits CI/CD | Needs a supporting plugin; no logging or explicit deny in the API | Container platforms |
| Network fabric or firewall | Routers, switches, SD-WAN, next-generation firewalls | Traffic routed through the device | Reuses existing gear; covers devices that cannot run agents | Limited view of endpoints, identities and workflows | On-premises, OT, legacy |
| Identity-based | Service mesh proxies, gateways, logon controls | Service or user identity, often per request | Policy follows the identity wherever the workload runs | Needs identity infrastructure; network rules still required | Cloud-native apps, service and admin accounts |
NIST SP 800-207 covers “host-based micro-segmentation using software agents” or endpoint firewalls; Windows Firewall can filter by application or service. Broadcom’s VMware vDefend Distributed Firewall (the NSX distributed firewall) enforces at each VM’s vNIC on every ESXi host. AWS security groups accept allow rules only and can reference other groups; Azure network security groups process allow and deny rules by priority, and application security groups avoid “manual maintenance of explicit IP addresses.”
Kubernetes NetworkPolicy leaves pods open to all inbound traffic until a policy selects them, and a policy “without a controller that implements it will have no effect.” As of Kubernetes 1.37 the API cannot log connections or express explicit deny rules. NIST calls building it on less advanced gateways or stateless firewalls “a very poor choice” because of the administration cost. NIST SP 800-207A describes “identity-based segmentation,” with services authenticating over mutual TLS, and finds that combining identity-tier and network-tier rules beats either alone. For service accounts and agents, see the AI agent identity governance guide.
How a rollout works
CISA’s phases repeat one application or environment at a time. In practice:
- Discover assets and flows. NSA says network security “begins with establishing an accurate inventory of all current data flows.” Cloud flow records help; Azure NSG flow logs retire on September 30, 2027, in favor of virtual network flow logs.
- Map application dependencies. Record what each candidate depends on and what depends on it, and confirm with application owners.
- Define a label taxonomy. Rules written against labels such as environment, application and role survive IP changes; NIST SP 800-207A notes address-based rules need constant upkeep as workloads move.
- Run in monitor-only mode. CISA suggests a “permissive mode that flags policy violations”; NIST describes a “reporting-only mode” and warns that “Few enterprise policy sets are complete in their first iterations.”
- Enforce in stages. CISA suggests easy candidates first, then high-value assets. Broadcom’s vDefend guidance starts with shared services such as Active Directory, DNS and logging, then environment zones, then application tiers.
- Keep it under change control. CISA recommends a way to revert each policy update, published enforcement levels, a user feedback channel, and segmentation testing as part of application deployment.
Common failure points
- Incomplete dependency maps. Enforcing too early breaks applications; NIST notes administrator accounts may be denied access they need.
- Policy configured but not enforced. A new pod “may be started unprotected” until the network plugin applies policy, and Broadcom’s NSX host preparation turns on the distributed firewall with a default allow rule.
- Coverage gaps. OT, IoT and legacy devices may lack agents, so CISA expects network-based controls there.
- Segments too fine to maintain. CISA notes fine-grained segments are harder to build and maintain.
- Changes that miss live sessions. Azure NSG rules “only affect new connections”; Kubernetes leaves existing connections to the implementation.
- An exposed control plane. NSA says a software-defined networking controller “can become a priority target.”
- Treating it as a one-off project. CISA’s April 2026 OT zero trust guidance asks for segmentation as “a dynamic, enforceable security policy instead of a one-time architectural decision.”
Zero trust, ZTNA and SASE
NIST SP 800-207 lists micro-segmentation as one way to build a zero trust architecture. CISA’s Zero Trust Maturity Model moves its networks pillar from “large perimeter/macro-segmentation” at the Traditional stage to “fully distributed ingress/egress micro-perimeters” at Optimal; NSA’s pillar pairs micro segmentation with data flow mapping and software-defined networking. CISA’s site now labels the maturity model page as archived content; the 2025 microsegmentation guide still cites it.
NIST SP 800-207 calls traffic to cloud resources “north-south” and traffic within an enterprise perimeter “east-west.” Microsegmentation targets the second; ZTNA and SASE broker the user’s path to applications. They can overlap: in one CISA example, an agency made its SASE service the central enforcement point between endpoints and internal services. For the user-access side, see SASE vs SSE and the VPN to ZTNA migration playbook.
Evaluation checklist
- Platform coverage: operating systems including end-of-life versions, hypervisors, clouds, Kubernetes distributions, appliances, IoT and OT.
- Visibility and flow mapping: automatic discovery, dependency maps, flow history retention and export.
- Policy model and labels: allow-only or allow and deny, rule ordering, labels versus addresses, and inheritance for new workloads.
- Monitor and enforce modes: test mode per rule or segment, a preview of what a draft policy would block, and violation alerts.
- Integrations: CMDB for ownership and labels, identity provider, SIEM for flow and violation logs (see MDR vs EDR), and APIs for change pipelines.
- Scale: workload and rule limits, policy push time, and the quotas AWS and Azure publish for groups and rules.
- Break-glass and rollback: a tested path back to known-good policy, who may use it, and behavior if the management server is unreachable.
- Performance impact as the vendor documents it: Broadcom says the tradeoff “must be balanced against the latency and throughput requirements of the applications” and documents excluding data plane vNICs; AWS says flow logs sit outside the traffic path.
Selected vendors’ documented approaches, alphabetical and not ranked:
| Vendor | Product | Enforcement as documented | Before enforcing |
|---|---|---|---|
| Akamai | Akamai Guardicore Segmentation | Agent-based and agentless; agentless suggested for in-cloud PaaS, IoT and OT | Simulate policy impact |
| Broadcom | VMware vDefend Distributed Firewall | Hypervisor level, at each VM’s vNIC | Segmentation reports from Security Intelligence |
| Illumio | Illumio Segmentation | User-space agent, agentless options in cloud; policy from workload tags | Draft view of what a policy would block |
| Microsoft | Azure NSGs and application security groups; Windows Firewall | Cloud virtual network rules; host-based firewall | Virtual network flow logs |
| Zero Networks | Network Segmentation; Identity Segmentation | Agentless; restricts connections and account logons, with just-in-time MFA | Learning period before automated policy |
How to decide
- Mostly one public cloud: start with native security groups and NetworkPolicy; add a cross-platform tool when consistent policy across providers becomes the bottleneck.
- Large vSphere estate: hypervisor enforcement covers VMs without guest agents; plan separately for physical servers and cloud.
- Hybrid, mixed operating systems: an agent-based platform with agentless options gives one policy model; confirm legacy OS support first.
- OT and IoT: network-based enforcement at functional boundaries, per CISA’s OT guidance, which cites separating control systems from safety systems.
- Any environment: start with shared services and high-value assets, monitoring first.
Frequently asked questions
What is microsegmentation?
Microsegmentation divides an environment into small segments, down to individual workloads or applications, and allows only the traffic each needs, so attackers and malware cannot move freely between systems.
What is the difference between network segmentation and microsegmentation?
Network segmentation, or macrosegmentation, splits a network into large zones such as departments or environments and controls traffic between them. Microsegmentation subdivides those zones so workloads in the same zone reach only what they need. CISA calls macrosegmentation simpler to manage but less granular.
How does microsegmentation support zero trust?
Zero trust removes trust based on network location. NIST SP 800-207 names micro-segmentation as one deployment approach, and CISA’s maturity model defines its Optimal network stage by distributed micro-perimeters and extensive micro-segmentation.
What tools are used for microsegmentation?
Host firewalls and agents, hypervisor distributed firewalls, cloud security groups, Kubernetes NetworkPolicy, service meshes and network firewalls. Platforms such as Akamai Guardicore Segmentation, Illumio Segmentation and Zero Networks add asset discovery and automated policy across environments.
Sources
- CISA: Microsegmentation in Zero Trust Part One: Introduction and Planning (July 29, 2025)
- CISA Zero Trust Maturity Model v2.0
- CISA and partners: Adapting Zero Trust Principles to Operational Technology
- NIST SP 800-207
- NIST SP 800-207A
- NSA: Advancing Zero Trust Maturity Throughout the Network and Environment Pillar
- Kubernetes: Network Policies
- AWS: Security groups
- Microsoft: Network security groups
- Broadcom: vDefend Distributed Firewall
Last checked: October 2026. Guidance and product features change; check each source before you rely on it.
Buying? Start from RFPhub’s free ZTNA RFP template.