By Brad Pierce, CISSP, CISA, CDPSE, PCIP, Structured VP of Security Solutions —

Traditional defensive strategy is organized around detection and remediation. Find the vulnerability, apply the fix, monitor for exploitation. That model works when the window between disclosure and exploitation is wide enough to act in, and modern AI is closing that window from both sides.

Attackers are developing exploits faster, and defenders are facing a larger volume of vulnerabilities, so triage now competes with remediation and neither gets done as quickly as the threat demands. Even a mature program will have open exposure windows. The question is what happens when something gets through one of them.

AI-assisted attacks are not a future problem

Threat models published by major security vendors and government agencies in the past 18 months have converged on a consistent finding: AI is being used to accelerate multiple phases of the attack lifecycle.

Model releases like Claude Mythos and ChatGPT-5.4-Cyber are a harbinger of the cyber sophistication on the horizon, and that horizon is less than six months away. AI can now reason, use tools, retain memory indefinitely, and generate code throughout, finding vulnerabilities and combinations of exploits that were previously unknown. There is also an emerging concern around AI-assisted lateral movement, where attackers use AI to map an environment they have accessed and identify the most efficient path to high-value targets.

The internal network, long overlooked for hardening, is now being navigated by adversaries who are better at finding paths through it than most organizations are at understanding what those paths look like.

Goals and systems

Immediate patching is the goal. Every security program should pursue it, resource it, and measure against it. But goals are not what hold the line when the threat moves faster than the program can react.

You do not rise to the level of your goals. You fall to the level of your systems.

— James Clear

In security, the system that catches you when patching cannot keep pace is your architecture. Specifically, it is a Zero Trust architecture in which the network does not extend implicit trust to anything inside it, and where lateral movement is not a free action available to anyone who has gained a foothold. When exploits arrive faster than patches can be deployed, the architecture is the part of the program that carries the load.

Zero Trust segmentation is the way

Zero Trust is often described as a strategy or a philosophy, but at the level of network design it resolves into a concrete posture. Nothing is trusted by default. Every connection is verified. Access is granted based on identity and context rather than location. The enterprise no longer has a trusted interior.

Microsegmentation enforces Zero Trust at the network and workload level. It takes the principle that no system should communicate with another without a deliberate reason and makes it operational. Every communication path becomes an explicit policy decision, and the implicit trust that flat networks extend across the perimeter is removed. This is the architectural shift that determines whether a single compromised endpoint becomes a contained incident or a breach that reaches the systems that matter most.

Blast radius

Security programs measure risk in terms of likelihood, but the common mantra is “not if, but when.” If exploitation is increasingly probable, the meaningful risk variable becomes how much damage a successful attack can do. That is the blast radius: the surface area of your environment an attacker can reach from any given entry point.

Zero Trust segmentation is a blast radius control. A well-segmented environment does not stop every breach, but it confines damage rather than making the whole environment available. That confinement limits exfiltration volume, reduces ransomware propagation, contains the scope of incident response, and shortens recovery. Organizations that have invested in perimeter and detection controls while leaving the internal network flat are optimizing for the wrong variable. Detection speed matters. Blast radius matters more when detection cannot be guaranteed to outrun exploitation.

Why now

These conversations used to be confined to the largest enterprises and the most regulated sectors. They are not anymore. Data centers, healthcare systems, financial services, manufacturers, and mid-market enterprises across every industry are working through the same questions, and three forces are pushing them in the same direction at the same time.

1. The threat landscape is the first. Ransomware now drives the majority of system-intrusion breaches, average breach cost crossed $4.4 million in 2025, and AI-assisted attacks are compressing the timeline at every phase. Adversaries are getting better at moving inside the network, which is where most of the damage actually happens.
   
2. Regulation is the second. The proposed HIPAA Security Rule update, expected to be finalized in 2026, moves network segmentation from an addressable specification to a mandatory requirement, with a 180-day compliance window after the final rule lands. PCI DSS 4.0 has tightened segmentation expectations. NIS2 and DORA have brought European critical infrastructure and financial services into the same posture. CMMC is doing it for the defense industrial base. The direction of travel across every regulatory regime is the same.
   
3. Cyber insurance is the third, and the most immediate. Carriers have moved from checklist underwriting to technical underwriting, and segmentation is increasingly the question they ask at renewal. Roughly 70 percent of insured organizations report their carrier now requires segmentation, more than a quarter have been required to prove it to maintain coverage, and many are seeing premium increases or reduced limits without it. The next renewal cycle is where this stops being a future problem.

None of this is getting easier. Forward motion is forward motion, and you do not get closer to your objective unless you move toward it. The organizations beginning their segmentation programs now are the ones who will have meaningful coverage and meaningful confinement when it counts.

The strategic imperative

This is one of the more concrete and addressable risks on the CISO agenda right now, and it is straightforward to frame for executive and board audiences because the logic is not technical. A program that concentrates investment on perimeter controls and endpoint detection while leaving the internal network flat is betting that detection will always be fast enough. That bet has worse odds than it did two years ago and will have worse odds still in two years’ time.

Zero Trust segmentation is not a replacement for perimeter security, endpoint detection, or response capability. It is the architectural layer that makes all of those investments more durable by limiting what an attacker can reach when any one of them falls short. Patching is the goal. Zero Trust architecture is the system. Organizations that have committed to building that system are significantly harder for adversaries to operate inside.

Structured designs and executes Zero Trust segmentation programs across complex enterprise environments. Our approach is platform-agnostic, grounded in environment visibility, organized around risk prioritization, and delivered through disciplined program management. Contact your Structured account manager or reach us at info@structured.com to discuss your program.

About the Author

Brad Pierce, CISSP, CISA, CDPSE, PCIP, is an accomplished cybersecurity professional with nearly 30 years’ experience in business leadership and also in hands-on threat mitigation work in complex IT environments.

As Vice President of Security Solutions at Structured, Brad skillfully leads a talented team of cybersecurity engineers, consultants, and solution architects who strive to make the world safer and more secure for every client. He has a deep interest in emerging technologies and a strong ability to learn and adapt quickly. His career has allowed him to apply security best practices to a broad range of disciplines, including networks, systems, AI, IoT, blockchain, and more.

Brad is passionate about security and privacy in all forms, spanning everything from digital domains like networks and AI to physical and social systems to medieval castle defense. He views security not just as a technical discipline but as a critical social function and an essential part of life.