A security analyst is evaluating the controls of a manufacturing environment. During assessment, the analyst finds that endpoint antivirus is deployed and up to date, firewalls exist at the perimeter, and all servers are patched monthly. However, a recent penetration test showed that once a single workstation was compromised, the tester could reach the SCADA controllers, HR database, and financial systems without crossing any internal filtering point. Which control gap should the analyst prioritize in the improvement recommendation?