Microsegmentation
In network security, microsegmentation enforces access policy at the level of the individual workload rather than the subnet, so that each server, container or service only talks to the specific others it needs. It is what actually stops the lateral movement a red team demonstrates on an internal test, and it operates a layer below network segmentation.
How it works
Where network segmentation draws boundaries between zones, microsegmentation draws them between workloads. Policy is attached to the workload itself (by identity, label or role) and follows it, so a database accepts connections only from the application tier that needs it and rejects everything else, including other machines in the same subnet. This is enforced by host agents, hypervisor controls, or platform-native policy such as network policies in Kubernetes. The result is that east-west traffic, the movement between internal systems, is constrained by default rather than permitted by default, which is the practical expression of zero trust inside the network.
What goes wrong
The failure microsegmentation is meant to prevent is the one internal tests find constantly: a single foothold that reaches everything, because within a segment the network is open. Coarse segmentation stops movement between zones but not within them, and most valuable systems sit in the same zone as the things that talk to them. From the attacker’s side, weak or absent workload-level policy means lateral movement is just connecting to the next machine. When microsegmentation exists but is misconfigured, the usual gaps are default-allow rules left in place, policies scoped too broadly, or agents not deployed everywhere, so the enforcement has holes the attacker maps quickly. The reason it is often absent altogether is operational: working out which workloads legitimately need to talk to which is real effort, so teams default to open and never return to it.
Where this shows up in an audit
We test microsegmentation by attempting east-west movement from a compromised workload: which other workloads can it reach, and are those paths the intended ones. The finding is the reachable neighbour that should have been blocked, demonstrated, and written against the specific policy gap. It is assessed as one layer of defence in depth, valuable precisely because it limits the blast radius of any single compromise. This is part of how we test east-west controls between workloads.