Firewall-only security fails when lateral movement reaches inside

At a glance

What this is: Illumio argues that firewall-only security breaks down once attackers move inside the environment, because lateral movement is common and perimeter-focused controls do not govern east-west traffic well enough.

Why it matters: IAM, PAM, NHI, and security teams need to treat segmentation and policy governance as runtime controls, because internal movement often bypasses edge-first assumptions once access is established.

By the numbers:

• Nearly 90% of organizations faced a cyberattack that involved lateral movement in the past year.
• 82% still feel confident in their ability to detect threats at the perimeter.

Context

Firewall-only thinking assumes attackers must cross the perimeter to do damage. In hybrid and multi-cloud environments, that model is no longer sufficient because once a foothold exists, east-west traffic becomes the real path of compromise. The identity implication is direct: access control, segmentation, and privilege boundaries have to hold after initial access, not just at login or the network edge.

The article is really about governance drift under changing infrastructure. Static rules, workload churn, and split ownership between firewall policy and segmentation policy create a control gap that is easy for attackers to exploit and hard for teams to validate. For identity programmes, that makes workload-to-workload access a policy problem, not just a network problem.

Key questions

Q: What breaks when security relies on firewalls alone against lateral movement?

A: Firewall-only security breaks when attackers already have a foothold inside the environment. At that point, the main risk is east-west movement between workloads, which perimeter controls are not designed to govern. Without segmentation and continuous policy validation, internal trust paths stay broad enough for attackers to expand their access.

Q: Why does lateral movement remain such a serious risk in hybrid environments?

A: Hybrid and multi-cloud environments change too quickly for static network rules to stay accurate. Workloads move, scale, and redeploy, which makes IP-based trust brittle. Attackers exploit that mismatch by using whatever internal connectivity remains open after initial access, so the blast radius grows before defenders can intervene.

Q: What are the signs that segmentation is failing in a real environment?

A: Segmentation is failing when a compromise in one zone quickly reaches other networks, critical services, or shared infrastructure that should have been separated. Another warning sign is when teams can describe many security layers in theory but still cannot stop broad attacker movement in practice. If an incident spreads faster than expected, containment boundaries are too weak.

Q: How should teams govern internal access when workloads change frequently?

A: Teams should govern internal access by combining segmentation, workload context, and continuous validation. The practical test is whether approved communication still holds after redeployment or scaling events. If policy depends on static network conditions, it will age faster than the environment and fail to contain internal movement.

Technical breakdown

Why east-west traffic defeats perimeter-first security

Perimeter controls inspect traffic entering and leaving a network boundary, but lateral movement happens after the attacker is already inside. East-west traffic, meaning workload-to-workload communication within the environment, is often the path used to reach higher-value systems. In hybrid estates, those internal flows change quickly as applications scale, migrate, and reconfigure. Firewall rules built around static IP-based assumptions struggle to track that motion, so the control surface decays even when the tooling is still online.

Practical implication: treat internal communication paths as enforceable policy objects, not as incidental network noise.

How segmentation changes the attack path

Segmentation limits which workloads can talk to each other, ideally enforcing least privilege at the network and application boundary. When policies follow labels such as application, role, and environment, the control is less dependent on fixed addresses and more resilient to infrastructure churn. That matters because lateral movement thrives on broad east-west reach. If a compromised system can only speak to approved peers, the attacker’s room to expand collapses even when the initial compromise is not immediately contained.

Practical implication: define workload communication by business context so segmentation survives redeployments and cloud changes.

Why policy drift becomes a security failure

Policy governance fails when intent, enforcement, and validation sit in different places. One team may define firewall rules, another may enforce segmentation, and neither may continuously prove that the rules still match the intended access model. Over time, exceptions accumulate, drift grows, and controls become harder to reason about. That is not just an operational nuisance. It creates blind spots where teams believe access is constrained but the live policy no longer matches reality, which is exactly the condition attackers exploit during internal movement.

Practical implication: continuously validate enforced policy against intended policy so drift does not become an attacker path.

Threat narrative

Attacker objective: The attacker’s objective is to expand from a single foothold into broader internal access before defenders can contain the breach.

1. Entry occurs when an attacker gains an initial foothold and gets inside the environment rather than trying to break the perimeter directly.
2. Credential or access reuse then enables movement across internal workloads, where broad east-west connectivity can expose additional systems.
3. Escalation follows when the attacker reaches higher-value assets or pivots into less restricted segments, increasing the blast radius of the compromise.
4. Impact is wider breach spread and harder containment because perimeter-only controls do not meaningfully restrict internal propagation.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Firewall-only security is a legacy control model, not a containment strategy. Perimeter filtering still has value, but it is structurally weak once an attacker already holds internal access. In hybrid environments, the governance problem is not just blocking entry, but constraining post-entry movement across workloads and cloud segments. Practitioners should treat east-west enforcement as a core security boundary, not an optional add-on.

Policy drift is the hidden failure mode behind many segmentation programmes. The issue is rarely the absence of policy language. It is the split between policy definition, policy enforcement, and policy validation, which lets exceptions and infrastructure churn erode control integrity. That gap is especially relevant where identity, workload access, and network segmentation intersect, because the same access path may be governed by different teams and different tools. Practitioners need a single view of intent and enforcement.

Hybrid and multi-cloud environments create a segmentation trust gap. The more quickly workloads change, the less credible static firewall assumptions become. This is a named governance problem: the environment moves faster than the control model. For identity-led security programmes, that means access should be judged by runtime reachability and policy evidence, not by whether a perimeter exists. Practitioners should anchor segmentation to actual workload relationships.

Least privilege must extend to workload communication, not just user access. IAM and PAM programmes often focus on who can sign in or elevate, but internal workload paths are where lateral movement turns a compromise into an incident. That makes segmentation part of the identity governance conversation whenever service accounts, automation, or workload-to-workload trust are involved. Practitioners should align segmentation with identity boundaries and blast-radius reduction.

Blended governance beats tool silos when breach containment is the goal. The article shows why separate control planes for firewall policy and segmentation are harder to validate and easier to drift. The operational lesson is not vendor-specific: governance must prove that enforced policy still matches intended policy. Practitioners should design for continuous validation across the full internal attack surface.

What this signals

East-west reachability is now a governance signal. If a compromised workload can move laterally without meaningful friction, the problem is not just detection coverage but policy scope. Identity and access programmes should care because workload communication paths are effectively authorisation decisions, and they need the same discipline as privileged user access.

Policy drift is the real control erosion in hybrid estates. Static firewall rules are not enough when infrastructure changes continuously. The programme response is to shift from annual confidence in perimeter controls to continuous evidence that segmentation policy still matches the live workload map.

Internal containment has become the practical measure of maturity. Security teams that cannot show where east-west movement is blocked are depending on hope, not governance. For identity-led programmes, that means treating workload access boundaries as part of blast-radius reduction, not as a separate network afterthought.

For practitioners

• Map east-west traffic paths Identify which workloads talk to each other across hybrid and multi-cloud environments, then flag any communication that is not required for the business process.
• Enforce workload-level segmentation Use labels such as application, role, and environment to define approved workload-to-workload communication and block everything else by default.
• Unify firewall and segmentation policy governance Create a single policy view that shows intended rules, enforced rules, and validation status so drift and misconfiguration are visible early.
• Review internal blast-radius assumptions Test whether a compromised workload can reach sensitive systems without passing through a meaningful control boundary, and tighten any overly broad internal trust paths.

Key takeaways

• Lateral movement turns internal reachability into the main security problem once an attacker gets inside.
• The article links that risk to a persistent confidence gap, with nearly 90% of organisations facing lateral-movement attacks and 82% still trusting perimeter detection.
• Containment depends on segmentation, policy governance, and continuous validation that keep workload communication aligned with current infrastructure.

Key terms

• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Segmentation: The practice of dividing an audience into groups so that messages, offers or experiences can be tailored. In identity terms, segmentation depends on reliable attributes, and it fails quickly when the source data is stale, duplicated or poorly governed.
• Scope drift: Scope drift is the gradual mismatch between what an integration was meant to do and what its credentials still allow it to do. It happens when permissions are not revalidated as business needs change, creating hidden over-privilege across SaaS and API-connected systems.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course if your programme needs a structured way to govern non-human identities and access boundaries.