Because teams cannot validate which east-west paths are normal, necessary or already being abused. When communication telemetry is fragmented, malicious traffic blends into ordinary workload traffic and containment becomes retrospective. Visibility is what turns segmentation from an idea into an enforceable control.
How visibility gaps turn segmentation into theory
lateral movement becomes much harder to stop when teams cannot see the real east-west graph of a multi-cloud estate. Without path visibility, segmentation rules are tested against assumptions instead of observed traffic, so exceptions, transitive trust and shadow integrations stay hidden until an incident exposes them. That makes the control look present while its enforcement is incomplete.
Fragmented telemetry is especially problematic in environments where workloads, service accounts and APIs interact across cloud boundaries. The same missing visibility that hides an attack path also hides the benign dependencies that should be preserved, which is why broad blocking often fails and narrow containment is delayed.
In practice, the problem is not only that traffic exists. It is that teams cannot reliably distinguish normal east-west communication from misuse, so the detection baseline is weak before an attacker ever starts moving.
Why attackers benefit from blind spots in multi-cloud traffic
Attackers do not need every path to be invisible, they only need enough uncertainty for malicious traffic to resemble normal workload behaviour. Once one foothold exists, they can probe for privileged connections, reuse existing trust relationships and move through administrative channels that were never fully observed in the first place.
That is why visibility gaps increase dwell time and slow containment. If defenders cannot tell which connections are legitimate, they cannot quickly decide whether a new flow is reconnaissance, compromise or an application dependency. In multi-cloud settings, that uncertainty is compounded by different logging models, inconsistent tagging and partial network telemetry.
When east-west movement is not mapped end to end, compromise often looks like ordinary service chatter. The result is that analysts spend time proving what should already be known, while the attacker uses that delay to expand access or reach data stores and control planes.
What to measure before you trust segmentation
The practical test is whether you can name the normal communication paths for critical workloads and verify them from telemetry, not from architecture diagrams alone. If you cannot inventory those paths, segmentation is a policy statement rather than an operational barrier.
Multi-cloud teams should pay closest attention to path completeness, log coverage and identity-to-traffic correlation. A flow that cannot be tied back to a known workload, cloud account or approved dependency is a warning sign that the monitoring model is incomplete.
For deeper background on how visibility and exposure show up across non-human and workload identities, see Ultimate Guide to NHIs, Key Challenges and Risks. For a broader view of the breach patterns that turn one cloud foothold into wider movement, Storm-2949 Azure Breach is a useful reference point. The mechanics of adversary movement are also well described in the MITRE ATT&CK Enterprise Matrix.
Risk and Threat Considerations
Visibility gaps create a compound risk: they weaken prevention, delay detection and make containment dependent on after-the-fact investigation. In multi-cloud estates, that matters because attackers can pivot through normal east-west traffic, shared identities and over-permissive trust links before defenders recognise the pattern.
Failure mechanism: Telemetry is split across clouds, logs do not cover every hop, and the organisation lacks a reliable map of approved communication paths. That lets malicious movement blend into ordinary workload traffic and keeps segmentation from being validated in real time.
Impact: Lateral movement becomes harder to stop quickly, so intrusion depth, response time and blast radius all increase. The control may still exist on paper, but the organisation cannot prove it is working when it matters.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | Lateral movement in multi-cloud often uses legitimate remote channels and admin paths. |
| Recommendation — Map east-west access paths to T1021 and monitor remote service abuse across cloud boundaries. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Visibility gaps are fundamentally an audit and detection problem across distributed telemetry. |
| AC-4 — Information Flow Enforcement | Segmentation must enforce and verify which workload-to-workload flows are permitted. | |
| Recommendation — Correlate and review cross-cloud audit data to expose abnormal east-west movement. Apply AC-4 to restrict and validate approved inter-workload communication paths. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Zero Trust depends on continuous verification, which visibility gaps directly undermine. |
| Recommendation — Use Zero Trust principles to require continuous path verification before allowing lateral access. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Cross-cloud lateral movement detection depends on complete and usable log coverage. |
| Recommendation — Centralize and retain logs so east-west abuse can be investigated and contained quickly. | ||
Practitioner Guidance
What to prioritise: Start with the highest-value workloads and the paths that cross cloud boundaries, because those routes are most likely to carry privilege, data and trust. If the path cannot be observed end to end, treat it as an open question, not an approved exception.
What to verify: Confirm that east-west flow logs, identity context and asset inventory can be joined into a single investigative view. If the same connection appears differently in each cloud, fix the observability gap before tightening policy further.
Common mistake: Teams often strengthen segmentation rules before they can see the traffic those rules are meant to govern. That usually creates brittle controls, noisy alerts and a false sense of containment.
Practitioner takeaway: In multi-cloud, visibility is the precondition for containment, because you cannot stop lateral movement fast enough if you have not first made normal movement measurable.
Related resources from NHI Mgmt Group
- Why do AI-assisted intrusions make lateral movement harder to stop?
- Why do legacy and OT environments make lateral movement harder to stop?
- Why do exposed credentials and service accounts make lateral movement harder to stop?
- Why do service accounts and workload identities make lateral movement harder to stop?