Microsegmentation

Microsegmentation is a network control that divides an environment into small zones and allows only the connections policy explicitly permits between them, so a compromised host can reach little beyond its own segment. Identity-based microsegmentation writes those rules against who or what is connecting (a user, device, workload or AI agent) instead of IP ranges and VLANs. CISA's Microsegmentation in Zero Trust, Part One (July 2025) describes the shift: under zero trust, access rules move beyond IP addresses to contextual attributes, with a policy decision point drawing on identity, device and connection data.

The identity version exists because address-based rules break as soon as workloads move, scale or share addresses, and because the question an attacker exploits is "what can this identity reach", not "what can this subnet reach". It is the network-layer form of least privilege and the main control against lateral movement, especially for OT and unmanaged devices that cannot run an agent. The hard part is the same as in zero trust generally: an accurate inventory of identities and the flows they actually need. In October 2026 IonQ agreed to acquire Elisity, an identity-based microsegmentation vendor, for up to $1.3 billion; Illumio and Zero Networks compete in the same space.

See also: zero trust, ZTNA, zero trust architecture implementation guide, zero trust vendors