Hybrid cloud lateral movement is exposing NDR limits

At a glance

What this is: Illumio argues that traditional NDR is strongest for retrospective packet analysis, but hybrid cloud lateral movement now outpaces that model.

Why it matters: For IAM and security teams, the issue is that compromised credentials and misconfigurations can turn network visibility into a post-incident exercise unless containment happens in real time.

Context

Network detection and response works best when traffic is predictable enough for packet inspection and forensic reconstruction. Hybrid cloud breaks that assumption because workloads move across on-premises systems, multiple clouds, containers, APIs, and short-lived services, which creates a wider and faster attack surface for lateral movement.

The identity angle is real here: attackers often enter with stolen credentials, exposed services, or misconfigurations, then use trusted access paths to move inside the environment. That makes the problem as much about access governance and containment as it is about traffic analysis, which is why retrospective tools struggle once the breach is already in motion.

Key questions

Q: What breaks when NDR is used as the only control for hybrid cloud lateral movement?

A: NDR breaks when it is treated as a detection-only control, because the attacker can already move through trusted east-west paths before analysts finish reconstruction. In hybrid cloud, the control gap is not seeing traffic but stopping the spread once a foothold is established. That is why containment, not just visibility, has to be part of the operating model.

Q: Why does stolen credential access make lateral movement harder to detect in hybrid cloud?

A: Stolen credentials make movement harder to detect because the traffic may look legitimate once the attacker is inside. Hybrid environments also blend cloud logs, containers, and on-premises paths, so the defender sees more fragments than a single packet stream. The practical risk is that trusted access becomes the attacker’s transport layer.

Q: How should security teams stop lateral movement after an initial foothold?

A: Security teams should reduce the number of internal paths a compromised identity can use, not just watch for suspicious traffic. That means segmenting sensitive systems, restricting remote administration protocols, and binding east-west access to verified identity and purpose. The goal is to make one foothold unable to become a broad internal breach.

Q: When is packet-focused NDR still useful, and when is it no longer enough?

A: Packet-focused NDR is still useful for forensic analysis, regulated environments, and networks with stable traffic patterns. It is no longer enough when workloads are ephemeral, cloud flow logs replace packet detail, and attackers can spread laterally faster than investigators can reconstruct events. In those cases, real-time containment becomes the priority.

Technical breakdown

Why packet-level NDR loses coverage in hybrid cloud

Traditional NDR was built around deep packet inspection inside data centers, where sensors can observe traffic flows directly and retain metadata for later analysis. In hybrid cloud, much of that visibility disappears or becomes incomplete because cloud environments often expose only flow logs, not full packet content. That shifts detection away from payload inspection and toward inferred behaviour, which is weaker for fast-moving attacks and harder to tune across disparate infrastructure. The architectural mismatch matters more than the label on the tool. Practical implication: treat cloud-native blind spots as a design constraint, not a configuration issue.

Practical implication: validate where packet inspection ends and flow-log dependence begins before assuming NDR coverage extends into cloud workloads.

How lateral movement turns visibility gaps into breach expansion

Lateral movement is the stage where an attacker uses one compromised foothold to reach additional systems, often by exploiting trust relationships and broad east-west communication paths. In hybrid environments, short-lived workloads, distributed services, and mixed control planes make those paths difficult to model with retrospective tools alone. If detection only reconstructs the attack after the fact, the attacker has already expanded access, collected data, or established persistence. That is why the useful question is not whether a suspicious connection existed, but whether it could have been blocked in motion. Practical implication: align detection with containment, not with evidence collection alone.

Practical implication: design for east-west containment, because post-incident reconstruction does not prevent expansion across reachable workloads.

Why real-time communication control changes the security model

Illumio’s article frames a shift from observing network behaviour to controlling it during the attack. That means the operational value moves from summarising what happened to enforcing which workloads can talk to each other at the moment risk appears. In practice, this is a segmentation problem as much as a detection problem: if the environment already allows broad communication, an alert simply arrives after the attacker has moved. Real-time policy enforcement matters because containment closes the route the attacker is using, not just the one investigators will later study. Practical implication: make communication policy part of the response path, not a separate architecture concern.

Practical implication: pair detection with enforceable segmentation so suspicious traffic can be stopped before lateral spread completes.

Threat narrative

Attacker objective: The attacker aims to expand from one initial foothold into broader access across the hybrid environment before defenders can stop movement.

1. Entry occurs through stolen credentials, exposed services, or misconfigurations that place the attacker inside the hybrid environment.
2. Credentialed access then lets the attacker move laterally across cloud and on-premises workloads by following trusted communication paths.
3. Impact follows when the attacker expands access faster than packet-focused NDR can reconstruct or contain the activity.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hybrid cloud has created a visibility-to-containment gap: traditional NDR still helps with reconstruction, but it is no longer enough when attackers can use valid access paths to traverse cloud and on-premises estates in minutes. The underlying issue is not alert volume alone, but the mismatch between historical detection and live movement. Practitioners should treat containment as the primary control objective.

Lateral movement is now an identity-adjacent network problem: the article’s entry paths are stolen credentials, exposed services, and misconfigurations, which means network telemetry cannot be separated from access governance. When trusted access is abused, the security question becomes who or what can still talk to what after compromise. That pushes identity-aware segmentation into the centre of breach containment.

Real-time enforcement beats retrospective evidence in hybrid cloud: the old assumption that teams can investigate first and respond later breaks down once workloads are ephemeral and communication paths are dynamic. A named concept here is hybrid containment lag, the delay between observing suspicious east-west traffic and actually blocking it. Practitioners should aim to shrink that delay to near zero.

The operational value of NDR is changing, not disappearing: forensic visibility remains useful for regulated environments and post-incident analysis, but it is no longer the whole answer for modern attack paths. The market is moving toward tools that combine detection, prioritisation, and enforceable controls. Teams should re-evaluate whether their current stack can stop spread, not just describe it.

Hybrid segmentation is becoming a governance control, not just a network design choice: once workloads span multiple clouds and runtime models, communication policy becomes part of access governance and breach resilience. That changes how security, cloud, and IAM teams share responsibility for limiting blast radius. Practitioners should manage segmentation as an active governance layer.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Hybrid containment lag: the delay between detecting suspicious east-west traffic and actually blocking it is now a critical programme metric. In hybrid cloud, the security team is not failing because it cannot see activity, but because it cannot stop spread fast enough to matter.

NDR still has value as a forensic and compliance tool, but it should no longer be treated as the last word on breach containment. Practitioners should evaluate whether their current controls can enforce communication policy across cloud and on-premises workloads, not just collect evidence after the fact.

For practitioners

• Map east-west traffic paths across hybrid workloads Identify which workloads, services, and cloud segments can communicate today, then flag any path that an attacker could abuse after initial compromise.
• Separate detection from containment decisions Use detections to prioritise risk, but require an enforceable control path that can block or isolate suspicious communication without waiting for manual investigation.
• Review cloud coverage assumptions for NDR Check where your current tooling depends on flow logs rather than packet inspection, especially in clouds and container platforms where visibility is thinner.
• Define segmentation rules for compromised workloads Pre-authorise isolation actions for high-risk systems so a detected foothold can lose east-west reach before lateral movement expands.

Key takeaways

• Hybrid cloud lateral movement exposes a structural weakness in detection-first network tooling, because attackers can move through legitimate access paths before analysts finish reconstruction.
• The article’s core problem is not visibility alone, but the delay between seeing suspicious east-west activity and being able to stop it.
• Security teams need segmentation and response controls that can isolate compromised workloads while the attack is still unfolding.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Deep Packet Inspection: Deep packet inspection is the process of examining packet contents beyond basic headers to understand what traffic is actually doing. In IPS deployments, it improves detection accuracy by looking at application behaviour, protocol compliance, and known exploit patterns, but it also increases processing cost and tuning complexity.
• Breach Containment: Breach containment is the act of stopping an attacker from expanding access after detection. It goes beyond alerting by blocking communication paths, isolating workloads, or limiting privilege so the incident remains smaller than it otherwise would have been.
• Hybrid Cloud Security: Hybrid cloud security is the practice of protecting systems that span public cloud and on-premises infrastructure. The core challenge is consistent enforcement of identity, data, and monitoring controls across environments that use different native mechanisms and trust assumptions.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps identity and security practitioners align access control with breach containment in modern environments.