At A Glance
- Flexera’s 2026 State of the Cloud report found that 88% of organizations use more than one cloud, and 73% run a hybrid mix of public and private cloud.
- Legacy “hybrid cloud” microsegmentation usually means a separate tool and policy model for each environment, and attackers move through the gaps between those models.
- An identity-first fabric enforces one policy everywhere and handles overlapping IP ranges with no re-addressing, so a workload keeps its security posture when it moves.
- Points of presence and edge routers are policy objects, which turns data residency into a configuration choice. The data plane can stay inside the customer environment, and NetFoundry cannot access customer data.
Microsegmentation Series · Part 4 of 6
The modern enterprise has no single edge to defend. Flexera’s 2026 State of the Cloud report found that 88% of organizations use more than one cloud, and that figure still undercounts the sprawl. It leaves out the on-premises systems, edge sites, and third-party SaaS applications those cloud workloads connect to. Segmentation built for a single data center breaks into pieces when it has to cover all of that. To see why, start with what multi-cloud microsegmentation actually has to do.
What Is Multi-Cloud Microsegmentation?
Multi-cloud microsegmentation applies one consistent access policy to every workload, whether it runs in AWS, Azure, Google Cloud, an on-premises data center, or an edge site. Each workload can reach only the specific services that policy allows, and that rule holds in whichever environment hosts it. Standard microsegmentation stops lateral movement inside one network. The multi-cloud version has to stop it across networks run by different providers, each with its own native controls.
Why Legacy Microsegmentation Breaks in Hybrid and Multi-Cloud Environments
Most legacy microsegmentation vendors say they cover hybrid and multi-cloud. In practice, that coverage usually means security groups in AWS, network security groups in Azure, a host agent on the on-premises servers, and yet another tool at the edge. Each layer has its own policy language and its own console, and each one fails in its own way. What the datasheet calls hybrid support turns into an integration project that never finishes, because the team has to keep four or five separate policy models in sync by hand.
Why Inconsistent Segmentation Policy Across Clouds Creates Security Gaps
When each environment runs its own policy model, nobody owns the space between them. A rule written tightly in one cloud drifts loose in another. A workload that moves from on-premises to a public cloud leaves its policy behind and picks up a new one. Overlapping private IP ranges across clouds break address-based rules outright, so teams add network address translation (NAT) gear to work around the collision, which creates one more place where policy can drift. Every seam between two policy models is a gap, and an attacker with a foothold looks for exactly those gaps.
How an Identity-First Fabric Unifies Microsegmentation Across Cloud and Edge
An identity-first fabric closes those seams because it works the same way regardless of the infrastructure underneath. NetFoundry creates a software-defined fabric that spans every environment as one network, whether a workload runs in a public cloud, a colocation facility, an edge device, or behind carrier-grade NAT (CGNAT). Teams write policy once, in terms of identity, and connectors enforce it the same way everywhere. The fabric also handles overlapping IP ranges across NAT, CGNAT, and private RFC 1918 address space with no re-addressing, so IP collisions no longer break policy.
When policy attaches to identity, a workload keeps the same security posture wherever it runs. A team can move a workload from one cloud to another without rewriting a single rule, because the workload’s identity and its policy move with it.
How Multi-Cloud Microsegmentation Handles Data Residency and Resilience
Distributed environments raise a second question that address-based tools handle badly: where traffic is allowed to go. On the NetFoundry fabric, points of presence and edge routers are policy objects, so confining traffic to a specific region or jurisdiction takes a policy change with no re-architecture. The data plane can run entirely inside the customer environment with enforcement at the edge, which removes the hairpinning and cloud backhaul that many overlay networks require.
Encryption keys stay with the customer’s endpoints, so NetFoundry cannot inspect the traffic that crosses the fabric. If a network path fails, the control plane reroutes around it, backed by a platform SLA of up to 99.95%. For a regulated or multinational business, residency and resilience become settings the team configures in policy.
How to Extend Microsegmentation Across Every Cloud and Edge Site
A borderless enterprise needs a security boundary that travels with the workload. Stitching cloud-specific agents together produces a boundary that changes shape at every environment line and leaks at every seam. An identity-first fabric gives security teams one consistent control across all of it, with no re-addressing.
This post is Part 4 of our Microsegmentation series. Part 1, The Microsegmentation Trap, Part 2, The CFO’s Guide to Microsegmentation ROI, and Part 3, Beyond the Firewall build the case that leads here. Next, Part 5 takes on the objection that segmentation slows engineering down and shows how building segmentation into the deployment pipeline speeds up software delivery.
NetFoundry built its fabric on OpenZiti, the open-source Zero Trust networking platform its founders created and still maintain. Identity-First Reachability™ connects workloads across clouds, data centers, OT sites, and edge devices with no open inbound ports, no VPNs, and no firewall changes. To see how it works across your own environments, explore NetFoundry microsegmentation.
Frequently Asked Questions
What is multi-cloud microsegmentation?
Multi-cloud microsegmentation is a security approach that applies one consistent access policy to every workload, whether it runs in a public cloud, an on-premises data center, or an edge site. Each workload can reach only the services that policy allows, which limits how far an attacker can move after a breach. NetFoundry delivers multi-cloud microsegmentation through an identity-first fabric, so we enforce the same policy in every environment without a separate tool for each one.
Why is microsegmentation hard across multiple clouds and the edge?
Each cloud and edge environment comes with its own native security controls, policy language, and console. Flexera’s 2026 State of the Cloud report found that 88% of organizations use more than one cloud, so most security teams maintain several policy models at once (security groups in AWS, network security groups in Azure, host agents on-premises). Keeping those models in sync by hand is slow, and any mismatch between them opens a gap. NetFoundry replaces
What’s the problem with “hybrid cloud” support from legacy microsegmentation vendors?
Legacy “hybrid cloud” support often means stitching a different agent or native control into each environment. Each tool enforces its own version of the policy, and nobody owns the gaps between them, so a rule written tightly in one cloud can drift loose in another. Think of it like translating one contract into five languages and hoping every version still says the same thing. Attackers who get a foothold look for exactly those gaps.
How does an identity-first fabric secure multi-cloud and edge workloads?
An identity-first fabric ties access policy to each workload’s verified identity, so a workload’s IP address and network location no longer decide what it can reach. Because the policy follows the identity, it stays the same when a workload moves between clouds or out to an edge site. NetFoundry’s fabric spans public clouds, data centers, and edge devices as one network, and we write each policy once and enforce it everywhere.
How does identity-first segmentation handle overlapping IP ranges across clouds?
Overlapping IP ranges happen when two networks use the same private addresses, which is common across clouds and after mergers. Address-based segmentation rules break when two workloads share an address, so teams usually add network address translation (NAT) gear to work around it. Identity-first segmentation recognizes each workload by its verified identity, so duplicate addresses have no effect on policy. NetFoundry’s fabric handles overlapping NAT, carrier-grade NAT, and private IP ranges with no re-addressing.
Can microsegmentation enforce data residency and sovereignty?
Yes. Microsegmentation can enforce data residency when the network lets teams control where traffic flows. On the NetFoundry fabric, points of presence and edge routers are policy objects, so confining traffic to a specific region or country takes a policy change with no network redesign. Encryption keys stay with the customer’s endpoints, and we cannot inspect the traffic that crosses our fabric.
Does multi-cloud microsegmentation add latency?
Some overlay networks route traffic through a central cloud before it reaches its destination, which adds latency. NetFoundry’s data plane can run entirely inside the customer’s own environment with enforcement at the edge, so traffic takes a direct path between workloads. If a path fails, our control plane reroutes around it under a platform SLA of up to 99.95%.
