More locations, more tools, more teams, more rules. And more problems.
TL;DR
- Distributed sites are the weak spot: hundreds of locations with flat networks and no local IT staff.
- You can't segment what you can't see, and adding more segmentation tools makes seeing harder, not easier.
- Without automation, rules and exceptions pile up faster than any team can explain them.
- The hardest hurdle is people. Until the teams agree on what "done" means, segmentation won't stick.
The situation: intent isn't the problem
In [the last post](⟦link to Manual Segmentation Is Death by a Thousand Cuts⟧), we met Sam, and his daily grind of changes, exceptions and firefighting. Manual segmentation, we saw, is death by a thousand cuts.
We also saw regulators asking for more: segmentation you can prove, not just draw.
And we saw the gap. In a Cisco-commissioned survey of 1,000 people, 79% said segmentation was a top priority for their organisation, but only 33% had fully implemented both macro- and micro-segmentation.
So the will is there. Nobody needs convincing that segmentation matters. Doing it is the hard part.
What's actually standing in the way?
Hurdle 1: Distributed sites
Headquarters and data centres get the security budget: firewalls, Security Information and Event Management (SIEM) platforms, a dedicated security team, regular penetration tests.
Branches and remote sites are out of sight and out of mind. Many run flat, unsegmented networks where a teller workstation, an ATM, a security camera and the Heating, Ventilation and Air Conditioning (HVAC) system all share one segment.
No local IT staff to manage configurations. No separation between device types. No visibility into what's connected.
One segmentation vendor calls bank branches "the soft underbelly of financial services cybersecurity". It's a vendor with something to sell, but the flat networks above make the case for them.
And it's not just banks. The same pattern shows up in hospital clinics, government offices, factory floors and remote critical infrastructure sites.
Each site is a potential way in, and nobody can configure segmentation by hand across hundreds or thousands of them.
Hurdle 2: Technical complexity
Distributed sites are the physical challenge. Technical complexity is the architectural one.
Applications are no longer one big program. They're split into dozens of smaller services spread across on-premises servers, cloud and containers, all changing and all talking to each other. In regulated industries, that sits on top of legacy systems nobody is allowed to switch off.
With more to protect, the natural response is more layers: more segmentation approaches, more tools.
Cisco's survey suggests that backfires. Organisations using five segmentation approaches struggled more than those using just one: 58% reported challenges from complex environments (against 41%), 36% a lack of visibility (against 22%), and 40% difficulty telling legitimate traffic from everything else (against 26%). The five-approach group was small, 55 respondents, so treat it as a signal rather than proof.
The root cause? You can't segment what you can't see.
And seeing everything is harder than it sounds.
Take VLAN tagging. A VLAN tag is like a coloured sticker on an envelope that tells the mailroom which department it belongs to. In a modern data centre, tagging is straightforward and often works out of the box.
In brownfield environments, built up over years, it isn't. Medical devices and heavy industrial equipment sometimes arrive with the vendor's own switches, and some of those ignore the stickers completely. You can't replace the switch without replacing the whole system, and good luck getting funding to replace something that "still works".
So the switch stays. All the mail goes in one pile, and if something confidential lands on the wrong desk, so be it.
Then there are the devices nobody knows about. A colleague once told me about two: a switch a contractor installed in a new hospital wing and never documented, and a whole network inherited in a merger, with no clear picture of what was on it.
These devices never appear in any asset inventory. They're the phantoms of your infrastructure. And they turn up in banking, manufacturing, energy and government too.
If you don't know what's on your network, you don't know how it's connected. And you can't secure what you don't understand.
Hurdle 3: Policy management
Segmentation creates policy sprawl. Every new device, workload, application or connection needs a rule that someone has to define, justify and maintain.
Think of a home kitchen with one drawer for utensils. Everything has its place, and you can find what you need.
Now picture a commercial kitchen with 50 drawers, 20 chefs and new tools arriving every month. No one labels anything. No one remembers where anything is, or why it's there.
That's policy sprawl in a multi-cloud, container-heavy environment.
In the same Cisco survey, 53% said their organisation struggled to keep up with ever-changing networks and application behaviour.
No wonder that when Cisco asked what people most wanted from a segmentation tool, 65% put policy automation in their top three.
The same colleague described what comes next: teams start keeping their own unofficial rules outside the official repository, because it's quicker.
Without automation, policy debt grows faster than teams can pay it down. Then one fine day, the auditor asks why a rule exists, and no one has a clue.
Hurdle 4: Team alignment
The last hurdle, and arguably the hardest, is human.
(Computers do exactly what you tell them to. People rarely do.)
A typical segmentation effort involves at least three teams:
- IT infrastructure or network
- Security / SecOps
- DevOps / cloud engineering
IT cares about connectivity and stability. Security cares about risk and compliance. DevOps cares about speed and delivery.
Here's how that can play out:
- DevOps opens ports "just for testing" and forgets to close them.
- IT adds broad allow rules to keep things running, quietly bypassing the segmentation.
- Security tries to enforce policy without the context or the authority to make it stick.
Then people move on. The engineer who designed the original segmentation leaves. The analyst who tracked the exceptions changes teams. The DevOps engineer who spun up a test machine is made redundant and never cleans it up.
The history walks out the door with them. The documentation, if it exists, is incomplete or six months out of date.
New team members inherit rules they can't explain and a network they're afraid to touch. Leaving it alone feels safer. So the drift continues.
What DevOps sees as "done", Security sees as "risky". What IT sees as "stable", DevOps sees as "too slow".
The data backs this up. In Cisco's survey, 87% of respondents at organisations that had fully implemented segmentation said their teams were fully aligned. At organisations that hadn't, it was 52%.
Segmentation is rarely just a technical problem. It's a people and process problem. Until those worldviews line up, segmentation won't stick.
The common thread: more is less
Across all four hurdles, the pattern is the same. More locations, more approaches, more devices, more teams and more rules don't solve a complexity problem. They amplify it.
- Distributed sites: more branches → more attack surface → more manual work → more gaps
- Technical complexity: more tools → more approaches → more complexity → harder to see
- Policy management: more rules → more exceptions → more drift → harder to audit
- Team alignment: more teams → more coordination → more misalignment → harder to execute
Throwing more tools and more people at the problem doesn't fix it. It scales up whatever was already broken: the slow processes, the bottlenecks, the wrong configurations, the flawed design.
I've watched it happen in a team I worked in, and too many times since in other organisations: the more we added, the more we struggled. A manual, fragmented, reactive approach was never built for something this complex.
That's where governance comes in.
Where we go from here
None of these hurdles kills a segmentation effort on its own. It's the friction across all four (scope, visibility, policy and people) that wears it down.
But none of them is insurmountable.
In the next post, I'll look at governance: the foundation that has to be in place before automation and AI can help. I'll walk through how to set policy intent, consistency and control before you automate anything.
Over to you: which of these four hurdles is the one your organisation keeps tripping over?
Previous: Manual Segmentation Is Death by a Thousand Cuts
References
- Cisco, "2025 Cisco Segmentation Report", research by Vanson Bourne, updated 14 October 2025.
- Aamer Akhter, "2025 Cisco Segmentation Report Sheds Light on Evolving Technology", Cisco Blogs, 23 October 2025.
- Charlie Treadwell, "PCI DSS Network Segmentation: The Bank Branch Blind Spot", Elisity (vendor blog), 4 April 2026.
