IDC Research: Frontier AI Makes Breach Containment a Cybersecurity Imperative

For years, cybersecurity has been built around one job: keep attackers out. Patch the holes, harden the perimeter, and catch intruders at the door.

That job still matters. But the assumptions behind it are breaking down — fast.

Generative AI, agentic AI, and new frontier AI models are reshaping the threat landscape. Attacks that once took highly skilled hackers days or even weeks to pull off can now potentially be carried out at machine speed by attackers with far less skill. AI can speed up how fast attackers find vulnerabilities, automate how they exploit them, and sharply cut the time between breach and impact.

To understand what this shift means and how organizations should prepare, Illumio commissioned new research from IDC: Segmenting for the Frontier: Preparing Zero Trust Architectures for the Next Wave of Frontier-AI-Driven Threats by IDC Research Manager Pete Finalle.

The report's core finding is one every security leader needs to hear: in an era of AI-powered attacks, prevention alone is no longer enough. Some attackers will get past the perimeter. What happens next — whether they can move freely through your network or get stopped in place — decides how much damage they can do. That's why breach containment now has to sit alongside prevention as a core security strategy, and why IDC points to microsegmentation as a key way to get there.

AI threats are moving at machine speed

According to the IDC research, frontier AI models represent more than an incremental improvement over today's generative AI tools. These emerging systems are increasingly capable of identifying vulnerabilities, generating exploits, and automating offensive security activities at a pace that traditional defensive approaches were never designed to address.   

The bigger problem isn't that attacks may become more sophisticated. It's that they may happen faster.

Many security products rely heavily on known signatures, historical patterns, static rules, and human-speed response cycles. That barely works when threats change slowly. It breaks down completely when AI speeds up how fast attackers find and exploit weaknesses. As IDC notes, traditional network security controls can struggle against machine-speed threats that evolve faster than signature-based detection mechanisms can adapt.   

At the same time, networks are getting more complex. Enterprises now run across hybrid and multi-cloud infrastructure while managing a mix of IT, IoT, OT, and AI-enabled systems. Every new connection is another path an attacker can use to move laterally once they get in.

Security leaders need to ask a different question

Historically, the prevention approach had organizations investing primarily in technologies designed to stop attackers at the perimeter.

But the IDC research argues that the conversation is shifting.

Instead of asking, "How do I prevent every breach?" organizations should increasingly ask, "How do I minimize the impact when a breach inevitably occurs?"   

It's a small change in wording with big consequences. Success is no longer measured by keeping every attacker out, but by limiting what an attacker can do once inside.

No security control can guarantee complete prevention. Even the strongest defenses will eventually be bypassed through stolen credentials, unpatched vulnerabilities, supply chain compromises, insider threats, or emerging AI-enabled attacks.

When prevention fails, one factor separates a minor incident from a major business disruption: how far the attacker can move laterally through your environment.

Why microsegmentation is becoming essential 

IDC identifies microsegmentation as a critical capability for limiting lateral movement and supporting Zero Trust. Instead of relying only on perimeter defenses, microsegmentation cuts unnecessary connections between workloads, applications, systems, and environments. That limits where an attacker can go, helps contain threats, and shrinks the potential blast radius of a breach.

The research points to strong adoption momentum and positive outcomes among organizations that have implemented microsegmentation.

According to IDC's 2026 Microsegmentation Buyer Adoption Survey:

• 87.3% of buyers said microsegmentation visibly improved the completeness of their asset inventory.
• 87.8% said it improved the level of detail in their visibility.
• More than 99% of organizations that completed deployment described their microsegmentation solution as effective or very effective.
• 90% reported improvements across areas including security posture and protection of critical assets.

These results point to a broader shift: security leaders increasingly see resilience and containment — not just prevention — as key measures of cyber readiness.

Visibility alone is not enough

The IDC report makes an important point: visibility only reduces risk when it leads to enforcement.

Yes, organizations must maintain a clear understanding of assets, workloads, dependencies, communication flows, and business-critical resources. But intelligence without action does nothing to reduce risk.   

IDC advocates for a framework built around three interconnected capabilities:

1. A security graph that provides contextual visibility into assets and relationships.
2. Attack path and risk analysis to identify likely avenues of compromise.
3. Granular segmentation policies that continuously evolve alongside the environment.   

Together, these capabilities help organizations move from simply understanding risk to actively limiting it.

Compliance requirements are reinforcing the trend

The move toward segmentation isn't being driven by AI alone.

IDC notes that an increasing number of frameworks and regulations either explicitly reference segmentation and Zero Trust architectures or require outcomes that segmentation helps achieve. These include PCI DSS 4.x, NIST SP 800-207, CISA guidance, IEC 62443, DORA, NIS2, HIPAA, and SOC 2.   

For organizations trying to modernize security and meet regulatory requirements at the same time, segmentation helps them do both — building resilience while supporting compliance.

Preparing for the next wave of AI-driven threats 

IDC's message is simple: organizations have a window of opportunity right now to prepare for AI-driven threats — and they should use it.

The goal isn't to stop every new attack technique before it appears. It's to build environments where attackers can't move freely after they get in.

When workloads communicate only with the systems they genuinely require, opportunities for lateral movement are dramatically reduced. When organizations have granular visibility into dependencies and enforce least-privilege access, they are better positioned to contain breaches before they become business crises.   

As frontier AI continues to evolve, cyber resilience will increasingly depend on an organization's ability to assume compromise, limit exposure, and contain the blast radius of inevitable attacks.

Attackers now have AI that works at machine speed. Defenders can't count on stopping every one of them at the door. But they can make sure that when an attacker gets in, there's nowhere to go. That's why microsegmentation is a foundational part of modern Zero Trust architecture.

Get the full IDC analyst brief, Segmenting for the Frontier: Preparing Zero Trust Architectures for the Next Wave of Frontier-AI-Driven Threats, by Pete Finalle, Research Manager, IDC, to see the complete survey findings and IDC's framework for preparing your organization for frontier AI.