TL;DR: The F5 breach, attributed to UNC5221, showed that attackers can enter product-development environments, steal source code and vulnerability details, and still leave defenders with only partial visibility into internal movement, according to Illumio. The case underlines that containment, segmentation, and east-west traffic visibility now matter as much as edge defence.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Illumio's blog post: F5 breach perimeter controls alone do not stop attackers once they reach internal product-development environments and begin moving laterally.
Why it matters: It matters to IAM and security teams because internal movement, workload-to-workload access and containment speed are now central governance issues, not just SOC detection problems.
Context
Perimeter defence assumes that stopping entry is enough. The F5 breach shows why that model fails when attackers gain a foothold in engineering and development environments, then use internal connectivity to reach higher-value assets. For identity and access teams, the important question is not only who authenticated at the edge, but what those identities and workloads could reach afterwards.
The article also frames east-west traffic as a governance blind spot. Once access exists, the control problem shifts to segmentation, workload visibility and containment of machine-to-machine movement across subnets, virtual networks and service boundaries. That is a genuine NHI and workload identity issue because the exposed attack surface is defined by internal identities and their trust relationships, not just human logins.
Key questions
Q: What breaks when perimeter security is the main control for internal movement?
A: Perimeter security fails once an attacker has already established a foothold, because the next stage is usually lateral movement between workloads and services that trust one another. At that point, the key risk is not a blocked login at the edge but uncontrolled internal reachability. Organisations need segmentation, visibility and containment that operate inside the environment, not just at the boundary.
Q: Why does east-west traffic create more risk than perimeter traffic in modern environments?
A: Because internal traffic often moves through trusted paths once it is inside the network, attackers can pivot laterally if those paths are not explicitly constrained. The risk is not the traffic itself, but the residual trust model that lets internal movement go unchecked.
Q: What are the signs that internal segmentation is not working?
A: Common warning signs include workloads that can communicate far beyond their job function, repeated alert storms with no containment action, and service paths that remain open even after suspicious activity is confirmed. If a compromised workload can still reach sensitive systems, segmentation is either missing or too permissive.
Q: How should security teams respond when an internal workload is suspected to be compromised?
A: They should isolate the workload quickly, preserve the evidence needed for investigation and then review which internal systems it could reach before containment. The aim is to stop further movement while keeping enough context to understand scope. Predefined quarantine authority matters here because manual approval chains are usually too slow for an active pivot.
Technical breakdown
How lateral movement bypasses perimeter controls
Perimeter tools focus on ingress and egress, but lateral movement happens after the first compromise, inside the environment. Attackers use legitimate-looking remote access, service connectivity and trust between workloads to move from one subnet or virtual network to another. When observability is limited, those paths look like normal system communication, which makes detection harder than blocking a single inbound connection. The control gap is not only prevention at the edge, but understanding the internal graph of who can talk to whom and under what conditions.
Practical implication: map east-west pathways and treat internal trust as an access-control problem, not only a monitoring problem.
Why workload context matters more than raw traffic volume
High traffic volume alone does not indicate compromise. Security teams need context about which workloads are talking, whether the services are expected, and whether the destination is sensitive or unusual. In this breach pattern, the risk is not just data leaving the environment, but the attacker using internal communications to probe, stage and pivot. Security graphs help because they combine connectivity with behavioural context, showing unexpected links between development, VDI and production-style estates.
Practical implication: baseline workload relationships so that unusual service-to-service paths stand out before they become an incident.
Containment now has to be workload-level and fast
Once an attacker is inside, containment determines whether the event stays local or spreads. Manual firewall changes are too slow when the threat is already using internal reachability to pivot. One-click isolation changes the response model by separating a suspected workload from the rest of the estate while preserving evidence for investigation. This shifts the objective from trying to perfect detection before impact to reducing the blast radius as soon as suspicious behaviour appears.
Practical implication: pre-authorise rapid quarantine actions for compromised workloads so response does not depend on ad hoc approval chains.
Threat narrative
Attacker objective: The objective was to gain durable intelligence on F5 systems and vulnerabilities while extracting data that could support future exploitation and broader campaign planning.
- Entry occurred through a foothold in F5 product-development and engineering knowledge environments, giving UNC5221 access to high-value internal systems.
- The attackers stole BIG-IP source code, vulnerability details and a small subset of customer configuration data, which increased their knowledge of exploitable pathways.
- The likely next stage is future exploitation planning and broader lateral abuse informed by the stolen vulnerability intelligence, even though the article says there was no evidence of code tampering.
Breaches seen in the wild
- Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
- Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Perimeter defence is now a partial control, not a complete control. The F5 case shows that once attackers reach engineering or product-development environments, the decisive risk moves inside the network. Edge protection can still matter, but it no longer determines whether the adversary can progress. Practitioners should treat internal reachability as the real security boundary.
East-west traffic visibility is the missing governance layer in many estates. Traditional monitoring is strongest at the edges and weakest between workloads, subnets and virtual networks. That gap matters because internal movement is how modern state-backed actors translate a foothold into impact. The practical conclusion is that segmentation and observability must be managed as one control plane, not as separate projects.
Blast-radius control is the named concept this breach sharpens. The breach did not depend on overt code tampering, which means the most immediate failure mode was exposure of sensitive internal assets to an actor who could move beyond the initial point of entry. In NHI terms, the trust relationships between services, workloads and administration paths became the exploitable surface. Practitioners should reduce what any one compromised identity or workload can reach.
State-sponsored campaigns now force identity teams to think in terms of access topology. The article’s significance is not only that attackers were stealthy, but that mature environments can still lack a reliable picture of who and what is active internally. That is a governance problem for IAM, PAM and NHI programmes alike, because privilege is only meaningful when reachability is continuously understood. Security teams should align identity controls with runtime containment.
Security graphs are becoming operational evidence, not just visualisation. The article points to a shift from static policy to continuous contextual assessment of connections, services and anomalies. That matters because segmentation decisions depend on relationship data, and relationship data is what many estates cannot see well enough today. Practitioners should use graph-based context to prioritise the few paths that matter most.
What this signals
Blast-radius control: this breach shows why internal containment has become a first-order control for modern estates. If teams only optimise edge detection, they leave the more dangerous stage of compromise, lateral movement, under-governed. The programme response is to treat internal connectivity as an enforceable policy surface, not an after-the-fact investigation aid.
The article also signals a practical shift for identity and infrastructure teams. Workload relationships, service reachability and quarantine authority now need to be reviewed together because compromise inside the estate is no longer hypothetical. If internal trust cannot be observed and constrained, incident response will always arrive after the attacker has already moved.
For practitioners
- Review east-west communication paths Identify which workloads, subnets and virtual networks can communicate without being blocked by explicit segmentation policy, then flag unexpected development-to-production or VDI-to-sensitive-system routes.
- Baseline remote access services Track tools such as SSH, RDP and Rustdesk across your estate so that sudden growth in use or new host relationships is visible before it becomes a pivot path.
- Pre-authorise workload quarantine Define who can isolate a suspected host, what evidence must be preserved and how quarantine is triggered when anomalous connectivity appears.
- Correlate internal movement with privileged access Join workload connectivity data to admin activity and service-account usage so you can see whether a compromised identity is driving unusual internal traffic.
Key takeaways
- The breach reinforces that perimeter controls do not stop an attacker who already has internal foothold and service-to-service reachability.
- The most important evidence in this case is not just what was stolen, but what the attackers could learn about future exploitation and internal movement.
- Containment, segmentation and rapid quarantine are the controls that change the outcome once suspicious activity appears inside the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article centers on attacker movement after foothold and the visibility gaps that allow it. |
| Recommendation — Map internal movement to TA0008 and treat any unusual access path as a candidate pivot route. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Internal reachability and service permissions determine how far a foothold can spread. |
| Recommendation — Review entitlements so workload-to-workload access matches the minimum necessary communications. | ||
| CIS Controls v8 | CIS-5 — Account Management | The breach highlights the need to know which identities and services are active inside the estate. |
| Recommendation — Inventory and review active accounts and service identities so stale access does not widen attack paths. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege directly limits how much an internal compromise can reach. |
| Recommendation — Apply AC-6 to constrain internal workload and administrative access to the smallest viable scope. | ||
| CSA Cloud Controls Matrix | SEF — Security Event Management | The article emphasizes continuous internal observability and containment in cloud-connected estates. |
| Recommendation — Use SEF-aligned monitoring to correlate east-west traffic with suspicious behaviour and trigger containment. | ||
Key terms
- East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
- Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Security Graph: A security graph is a relationship map that shows how AI components connect to each other and to surrounding systems. In this context, it is more useful than a flat inventory because it reveals trust paths, data flows, and the likely blast radius of a model, agent, or tool integration.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management for practitioners who need to govern internal access relationships. It helps identity and security teams connect runtime trust decisions to the controls that contain lateral movement.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org