Microsegmentation
Enforcing fine-grained network policy between individual workloads rather than between broad network zones, so a compromise cannot move laterally.
Traditional segmentation divides a network into zones — DMZ, application tier, database tier — and permits broad communication within each. An attacker who compromises anything in a zone can reach everything else in it, which is how a single vulnerable service becomes an estate-wide incident.
Microsegmentation reduces the unit of policy to the workload: this service may talk to that service, on that port, and nothing else. Everything not explicitly permitted is denied.
The practical obstacle is knowing what the rules should be, and guessing produces either an outage or a permissive policy that achieves nothing. The workable method — which Monzo published a good account of — is to derive policy from observed traffic: run in audit mode, record what actually communicates, generate policy from that, review it, then enforce.
Implementations: Kubernetes NetworkPolicy with a CNI that enforces it (Calico, Cilium), service mesh authorisation policies, cloud security groups referencing other security groups, and identity-based segmentation that keys on workload identity rather than IP — which is the strongest form, because addresses are ephemeral and identity is not.
The measure of success is the honest one: how far can an attacker who owns one workload get? That is a question you can test, and it is what segmentation is for.