The five main types of microsegmentation are agent-based, agentless, identity-based, network-based, and host-based. Each approach differs in how policies are enforced, where visibility is gathered, and what operational overhead is required. Agent-based installs software on endpoints for process-level visibility. Agentless uses network infrastructure as the enforcement point. Identity-based uses contextual attributes like device type and user role instead of IP addresses. Network-based uses traditional VLANs, ACLs, and firewalls. Host-based uses OS-native firewalls. Many organizations deploy a combination of these approaches to cover different parts of their environment.

Agent-based microsegmentation installs software on each endpoint to monitor and enforce policy at the host level, providing deep process-level visibility but requiring deployment and maintenance on every device. Agentless microsegmentation enforces policy through network infrastructure such as switches and routers, or through cloud-native APIs, without touching endpoints. The practical implication is that agentless approaches deploy faster and work with devices that cannot run agents, like IoT and OT equipment, while agent-based approaches provide deeper visibility on devices that support them.

Agentless and identity-based microsegmentation are the most practical choices for IoT and OT environments. These devices typically run proprietary or embedded operating systems that cannot support third-party software agents. Identity-based approaches are particularly effective because they classify devices by what they are (an infusion pump, a PLC, a security camera) and enforce policy based on that identity, regardless of IP address or network location. This is critical in environments with thousands of diverse device types that change IP addresses frequently.

Network-based microsegmentation relies on IP addresses, VLANs, and firewall rules to control traffic between segments. Identity-based microsegmentation uses contextual attributes such as device identity, user role, device posture, and business function to determine access. The key advantage of identity-based approaches is that policies follow the asset regardless of where it connects on the network, eliminating the brittleness of IP-dependent rules that break every time the network changes.

Yes, and many organizations do. A common hybrid approach uses identity-based, agentless microsegmentation as the primary platform for comprehensive coverage across all device types, then layers agent-based microsegmentation on critical servers where process-level visibility adds value. Host-based firewall rules can serve as an additional defense-in-depth layer on managed endpoints. Gartner projects that organizations using multiple microsegmentation strategies will grow from under 5% to 25% by 2027.

Host-based microsegmentation uses built-in operating system firewalls (iptables on Linux, Windows Firewall, macOS pf) to enforce segmentation policies directly on individual hosts. While it leverages existing OS capabilities without additional software licensing costs, it requires managing firewall rules across potentially thousands of endpoints and does not work with devices that lack configurable host firewalls, like IoT sensors, OT controllers, and legacy embedded systems.