Internal trust is the real lateral movement exposure in enterprises

At a glance

What this is: Zero Networks reports that internal trust conditions still leave most enterprise environments widely reachable once an attacker gains a foothold.

Why it matters: For IAM and NHI practitioners, this shows that authentication and access scope inside the environment remain a live governance problem, not just a perimeter issue.

By the numbers:

• Zero Networks analyzed 54 trillion activities across 312 live enterprise environments.
• 80% of enterprise servers are reachable from anywhere inside the network.
• 87% accept inbound RDP or SSH from broad internal sources.
• 43.2% of internal authentication still runs on NTLM.

Context

Internal trust is the assumption that once a device, user, or workload is inside the network, it can move with fewer checks and broader reach. That model fails when attackers reuse valid access, inherited permissions, or weak internal authentication to turn a single foothold into wider compromise.

In identity terms, the exposure is not only about human accounts. Service paths, remote administration channels, and authentication protocols all create lateral movement opportunities when access is broad and persistence is easy.

Zero Networks' data suggests this is not an edge case but a typical enterprise condition, which makes internal segmentation and access scoping a governance issue rather than a niche hardening task.

Key questions

Q: What breaks when internal trust is too broad in enterprise networks?

A: When internal trust is too broad, a single compromise can become a lateral movement platform. Attackers do not need to defeat each system individually if network reachability, remote access protocols, and reused identities let them move laterally with minimal friction. The result is larger blast radius, faster escalation, and much harder containment.

Q: Why do legacy authentication protocols increase lateral movement risk?

A: They allow attackers to reuse captured authentication material instead of forcing a fresh, mutually verified login. When the protocol trusts the hash or supports relaying, one compromised endpoint can become a launching point for broader account impersonation and downstream system access.

Q: How do security teams know if identity-based segmentation is actually working?

A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services. If lateral movement, management-plane access, or service-to-service discovery still succeeds, segmentation is too coarse. Effective segmentation shows up as denied pathways, reduced reachable surface, and a clear separation between user, management, and critical workloads.

Q: What should defenders prioritise first when internal trust creates lateral movement exposure?

A: Start with the routes that allow the fastest spread: broad internal server reachability, unrestricted admin protocols, and legacy authentication dependencies. Those are the conditions that turn one compromise into many. After that, separate human, service, and administrative reach so one identity type cannot borrow another's access profile.

Technical breakdown

Why internal trust accelerates lateral movement

Internal trust reduces the number of checks an attacker faces after first access. If servers accept connections from broad internal sources and authentication is weakly segmented, the attacker can use the same network privileges that normal operations rely on. That is why lateral movement often succeeds without malware, privilege escalation exploits, or noisy command-and-control. The core problem is that internal reach is often treated as a default rather than a policy decision, so one compromised host can see and touch far more than it should.

Practical implication: treat internal reach as an access policy problem and narrow what can talk to what.

Why NTLM and broad remote administration widen the blast radius

NTLM persists in many environments because it is compatible and deeply embedded, but it does not create the same modern trust signals as stronger authentication patterns. When combined with broad RDP or SSH exposure, it gives attackers multiple ways to reuse or relay access once they are inside. This is especially relevant for environments with service accounts, admin jump paths, and legacy systems, where authentication controls lag behind network reality. The mechanism is not just weak login security. It is a trust fabric that still assumes the inside is safe.

Practical implication: reduce legacy authentication and separate administrative channels from general internal traffic.

How internal segmentation changes the attack path

Segmentation changes lateral movement by constraining which identities, hosts, and protocols can reach sensitive systems. Instead of relying on detection after movement begins, segmentation narrows the usable path set before an attacker can pivot. In practice, this matters for both human and non-human identities because service accounts, automation, and admin tooling often have broader internal reach than users realise. The article's data shows that broad reach is common, which means segmentation is less about perfection and more about shrinking the number of viable next hops.

Practical implication: map internal trust zones and enforce route-specific access for admin and service traffic.

Threat narrative

Attacker objective: The attacker aims to turn one internal compromise into broad lateral reach across servers, administrative paths, and business systems.

1. Entry begins when an attacker compromises a single internal foothold and uses that position to inspect reachable systems and protocols.
2. Credential access or trust abuse follows when the attacker leverages broad internal access, remote administration channels, or legacy authentication such as NTLM to extend reach.
3. Escalation and lateral movement occur as the attacker pivots from that foothold to additional hosts, expanding control across the environment.
4. Impact arrives when internal spread turns one compromise into business disruption, including outage conditions and wider operational exposure.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Internal trust is now a governance failure, not a network convenience. The article shows that broad east-west reach still exists across most enterprise environments, which means the default trust model inside many organisations is too permissive. That matters because attackers do not need to invent new privileges if the environment already grants them reachable paths. Practitioners should treat internal trust as a control surface, not an architectural leftover.

Lateral movement exposure is increasingly an identity problem disguised as a network problem. Authentication protocols, remote admin channels, service accounts, and internal reach permissions all shape whether one foothold becomes a breach. In that sense, the boundary between IAM, NHI governance, and network segmentation is thin in practice. Teams that manage identity without constraining network paths will keep discovering that access scope, not just credential strength, determines blast radius.

Legacy authentication persistence creates hidden privilege debt. The continued use of NTLM inside enterprise environments is a signal that old trust assumptions still sit inside modern stacks. That creates a form of governance debt where the environment remains operable but over-permissive. The practical conclusion is simple: hidden legacy auth should be treated as a compounding exposure until it is measured and reduced.

Blast-radius control is becoming the decisive security variable. The article's numbers point to a world where the first compromise is no longer the main event. The real determinant of loss is how quickly an attacker can move once inside, which elevates segmentation, protocol restriction, and internal authorization boundaries. Security teams should evaluate controls by how much movement they prevent, not only by how many intrusions they detect.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Internal trust has become a blast-radius problem. The practical question for defenders is no longer whether a hostile actor can get in, but how much of the environment becomes reachable after that first step. That shifts programme priorities toward route restriction, identity scoping, and segmented administration rather than relying on post-compromise detection alone.

Legacy authentication is a governance debt item, not just a compatibility choice. When NTLM remains embedded in internal operations, the environment is preserving trust assumptions that attackers can exploit laterally. Teams should measure where those assumptions still exist and reduce them before they define the next incident.

Lateral movement control now sits at the intersection of IAM, NHI governance, and network policy. Service accounts, admin tools, and automated paths often have broader reach than human users, so identity teams cannot treat network exposure as somebody else's problem. The control objective is to shrink the set of identities and routes that can progress from one compromise to many.

For practitioners

• Tighten east-west access paths Inventory which internal systems can reach sensitive servers, then remove broad any-to-any paths that are not required for operations. Prioritise administrative and service traffic, because those routes create the fastest lateral movement opportunities.
• Reduce reliance on NTLM Identify systems still using NTLM for internal authentication and create a deprecation plan that includes higher-risk domains first. Replace legacy authentication paths where modern controls are available and isolate remaining exceptions.
• Restrict RDP and SSH to named sources Limit remote administration protocols to explicit management sources rather than broad internal ranges. Apply the same control to automation, jump hosts, and service access so remote management does not become a universal pivot channel.
• Separate service identity reach from user reach Audit non-human identities and automation paths to confirm they cannot traverse the same internal network paths as interactive users. Service accounts often inherit broad reach that should be narrowed to the exact systems they need.

Key takeaways

• Internal trust can turn one compromised host into broad enterprise exposure when internal reach is left too open.
• Zero Networks' analysis of 54 trillion activities across 312 environments shows that broad reachability and legacy authentication remain common.
• Defenders need to focus on blast-radius reduction, internal segmentation, and tighter authentication paths rather than assuming the inside is safe.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Internal Trust: Internal trust is the assumption that activity originating inside a network or environment is inherently safer than external activity. In modern enterprises, that assumption often creates hidden risk because it allows attackers or abused identities to reuse access across many systems once they get in.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle. It helps practitioners connect identity controls to the broader security programme they run.