A contractor breach adds a route that segmentation does not address, because the contractor’s access is legitimate by design.