Enterprise risk now concentrates in SMB, RDP, WinRM, and RPC

At a glance

What this is: Zero Networks argues that risk in modern enterprise environments is concentrating in four widely used internal protocols because attackers abuse legitimate east-west pathways more than exotic exploits.

Why it matters: IAM, PAM, and network security teams need to reduce implicit trust in administrative protocols because valid credentials and broad internal access can turn routine operations into lateral movement paths.

By the numbers:

• Zero Networks’ analysis of 3.4 million threat activities found that 71% of enterprise risk flows through SMB, RDP, WinRM, and RPC.

Context

Enterprise risk often accumulates in the control paths that operations depend on most, not only in internet-facing entry points. SMB, RDP, WinRM, and RPC are legitimate management channels, but when they remain broadly reachable they become high-trust routes for lateral movement, privilege reuse, and rapid spread across hybrid estates.

This matters to IAM and PAM because the exposure is not just network reachability, but who or what is allowed to use these protocols and under what conditions. The article’s core point is that internal trust assumptions can turn normal administration into an attack surface, especially where service accounts, remote admin access, and implicit east-west permissions are left too open.

Key questions

Q: What breaks when SMB, RDP, WinRM, and RPC are left broadly open inside the network?

A: They create reusable lateral movement routes that let a single foothold expand into wider compromise. Once those protocols are allowed across large internal segments, attackers can behave like legitimate operators, reuse stolen credentials, and move without needing novel malware. The failure is not the protocol itself, but the lack of task-specific restriction around who can use it and where.

Q: Why do trusted administrative protocols increase blast radius after initial compromise?

A: Because they turn a small compromise into an authenticated pathway across many systems. When remote management tools, internal file sharing, and RPC services are reachable by default, attackers can pivot through normal workflows instead of forcing noisy exploits. That is why standing access and broad east-west trust matter more than endpoint alerts once an attacker is already inside.

Q: What are the signs that internal access controls are failing to contain lateral movement?

A: Look for protocols that are broadly permitted across subnets, remote admin rights that are shared too widely, and service accounts that can access many hosts without task-specific limits. Another warning sign is when defenders can only explain access after the fact, not before it is granted. Those patterns show that containment is still being done by assumption, not by policy.

Q: How should teams balance operational continuity with tighter control of admin traffic?

A: Use identity-aware containment rather than blanket blocking. The goal is to preserve necessary admin work while removing implicit trust, so approved systems, approved users, and approved sessions can proceed and everything else is denied by default. That approach reduces disruption because it narrows the allowed path instead of trying to stop administration altogether.

Technical breakdown

Why trusted internal protocols become lateral movement highways

SMB, RDP, WinRM, and RPC are not risky because they exist. They become risky when they are broadly reachable across hosts, roles, and subnets, creating reusable pathways that attackers can adopt after initial access. SMB enables file and service operations, RDP provides interactive remote login, WinRM enables scripted administration, and RPC exposes many background services, often with dynamic ports that are hard to constrain with coarse policy. The mechanism is simple: if legitimate administrative channels are left open beyond actual business need, stolen credentials or a compromised host can pivot through them as if the attacker were a valid operator.

Practical implication: replace broad internal reachability with explicit protocol-level allow rules tied to identity and asset relationships.

How standing privilege turns remote admin tools into attack accelerators

Remote management tools are powerful because they are designed for legitimate operational reuse. That same reuse becomes a problem when service accounts, admins, or automation identities hold standing rights across too many systems. Attackers do not need malware-heavy tradecraft when they can authenticate through the same administrative surfaces used by IT. WinRM is especially exposed here because it often underpins automation and PowerShell remoting, which can be abused for fast, low-noise lateral expansion. The underlying weakness is not the tool itself but the combination of persistent access, broad scope, and insufficient context at the moment of use.

Practical implication: scope remote admin access to specific systems and force just-in-time verification for elevated sessions.

Why static firewall rules and detect-and-respond controls fall short

Traditional perimeter logic assumes that once traffic is inside the network, it is less risky. That assumption breaks down in environments where east-west movement is the main blast-radius multiplier. Static allow rules for internal SMB or RDP traffic cannot distinguish a legitimate administrator from a compromised session, and endpoint detection cannot stop all abuse when the protocol use itself is valid. RPC complicates this further because dynamic ports and many callable functions make blanket allowance attractive to operations teams, but dangerous from a governance perspective. The result is a control model that sees activity too late and constrains too little.

Practical implication: shift control enforcement closer to the protocol and identity layer instead of relying on alerts after movement begins.

Threat narrative

Attacker objective: Use trusted internal protocols to expand access, evade detection, and increase blast radius before defenders can contain the compromise.

1. Initial access often comes through compromised credentials or weakly protected remote access, especially where RDP is exposed or reused across environments.
2. After entry, attackers abuse legitimate admin protocols such as SMB, WinRM, and RPC to move laterally without dropping obvious malware.
3. The objective is to expand reach across the environment, disable protections, stage payloads, or deploy ransomware while blending into normal operational traffic.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• AnyDesk breach 2024: Attackers compromised AnyDesk's production systems; it revoked its code signing certificate and reset all portal passwords. Stolen keys were reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trusted admin protocols are now a governance problem, not just a network design problem. SMB, RDP, WinRM, and RPC concentrate risk because they encode operational trust into the fabric of the environment. When those channels stay broadly open, identity controls lose precision and attack paths remain reusable. Practitioners should treat protocol reachability as an access-governance issue, not a pure connectivity choice.

Containment-first architecture is the right named concept for this risk pattern. The article describes a world where detection cannot keep pace with legitimate-looking lateral movement. That means the decisive control is not visibility after the fact, but the removal of reusable internal pathways before an attacker can chain them together. Security leaders should align access decisions to actual business relationships and session context.

Standing privilege is the failure mode the article exposes most clearly. The network is assumed to be a safe interior, yet the interior is exactly where compromised credentials and overbroad admin access do the most damage. That assumption fails when remote management rights persist beyond the task, leaving no meaningful boundary between operator and intruder. Practitioners should redesign for ephemeral, task-scoped access.

Identity-based enforcement has to extend into east-west traffic if organisations want material reduction in blast radius. The article’s examples show that coarse subnet rules and blanket internal trust do not distinguish authorized admin use from abuse. NIST CSF access control concepts and Zero Trust principles both point to the same conclusion: if identity is not part of the transport decision, the transport remains too permissive. Practitioners should make internal protocol use conditional, not default.

Operational convenience is still being purchased with structural exposure. Teams tolerate broad protocol access to avoid breaking automation, yet that convenience accumulates into systemic risk over time. The discipline required here is to trade implicit trust for constrained, observable, pre-approved access patterns. Practitioners should measure success by how much lateral freedom disappears, not by how many alerts appear.

What this signals

Containment has become the primary control variable for east-west risk. The article shows that the threat is not lack of visibility alone, but the continued availability of trusted internal pathways. Security programmes that still treat remote administration as an unrestricted interior service will keep expanding the blast radius they are trying to reduce.

Internal protocol governance is now part of identity governance. If RDP, WinRM, and SMB are accessible without task scoping, then IAM and PAM decisions are already being made at the network layer. That makes protocol-level policy a governance control, not just an infrastructure setting.

Attackers do not need to break the model when the model already assumes trust inside the perimeter. The practical shift for practitioners is to measure how much legitimate access can be removed, narrowed, or made conditional without breaking operations. That is the clearest indicator that containment-first design is taking hold.

For practitioners

• Tighten east-west protocol allowances Replace broad internal SMB, RDP, WinRM, and RPC permissions with explicit host-to-host and role-to-role rules based on real operational need.
• Enforce just-in-time admin access Require time-bound, approval-backed elevation for remote administration so standing credentials cannot be reused freely across systems.
• Segment service accounts from human admin paths Separate automation identities, admin accounts, and user access so a compromised service account cannot inherit the same lateral movement routes.
• Apply protocol-aware containment to RPC and RDP Use controls that evaluate the operation being requested, not just the source IP, so legitimate traffic can continue while unsafe calls are blocked.

Key takeaways

• The core risk is not exotic exploitation but overexposed internal protocols that attackers can reuse after gaining a foothold.
• The article’s key evidence is that 71% of enterprise risk flows through SMB, RDP, WinRM, and RPC, which are normal operational channels.
• Reducing blast radius now depends on identity-aware containment, just-in-time administrative access, and narrower east-west permissions.

Key terms

• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Containment Architecture: A security design approach that assumes compromise will happen and focuses on limiting what the attacker can reach next. It uses segmentation, trust boundaries, and access restrictions to keep a local failure from becoming a broader incident.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to operational security and governance outcomes.