Lateral movement exposes the limits of password-based identity

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OLOID's blog post: lateral movement is the post-access phase that lets attackers expand from one foothold into enterprise-wide impact by abusing valid credentials and native tools.

Why it matters: IAM, PAM and security teams need to treat lateral movement as an identity problem as much as a network problem, because standing access, reused credentials and weak segmentation determine how far a breach can spread.

By the numbers:

• Attackers move from initial access to lateral movement in an average of just 48 minutes, according to OLOID.

Context

Lateral movement is the phase of an intrusion where an attacker uses one valid foothold to reach other systems, accounts and data stores. The control failure is rarely at the first login; it is the lack of barriers that stop one compromised identity from becoming many. In environments with shared devices, cached sessions and broad administrative rights, that gap is structural rather than accidental.

The governance problem is that many IAM programmes still assume access can be reviewed, certified or contained after initial compromise. That model breaks once an attacker is using legitimate credentials and native tools inside the environment. Treat key NHI security challenges as the broader context, but the practical issue here is how quickly identity sprawl becomes lateral reach.

Key questions

Q: How do attackers move laterally after stealing valid credentials?

A: Attackers move laterally by reusing stolen credentials, captured session material, or delegated tokens to authenticate to other hosts without re-entering a password. Common paths include Pass-the-Hash and Pass-the-Ticket, remote admin protocols, and service account abuse. Kerberos tickets, NTLM hashes, and privileged accounts widen reach when access is not constrained by segmentation, JIT access, or MFA on high-risk paths.

Q: Why do shared workstations make lateral movement easier?

A: Shared workstations make lateral movement easier because cached sessions, reused logins, and locally stored tokens can give the next user access to active resources. If users share profiles, admins share jump boxes, or sign-out is weak, an attacker can harvest credentials, reuse browser sessions, or pivot from the workstation into file shares, admin consoles, and cloud portals.

Q: How should teams limit the blast radius of a compromised account?

A: Teams limit the blast radius by reducing standing access, separating trust zones, and removing unnecessary privileges from accounts, service identities, and admin roles. Least privilege, network and application segmentation, JIT elevation, PAM for privileged accounts, and scoped service permissions stop a compromise on one account from becoming broad domain, cloud, or data access.

Q: What are the signs that lateral movement is already underway?

A: Look for unusual login patterns, unexpected admin tool use, suspicious internal connections, unexplained permission changes, and anomalous endpoint activity. None of these signals alone proves compromise, but together they often indicate an attacker is testing trust boundaries and expanding reach. The most useful signals are the ones that break normal identity and host behaviour baselines.

Technical breakdown

How valid credentials enable lateral movement

Lateral movement is effective because authentication systems often cannot distinguish a legitimate administrator from an attacker using stolen credentials. Pass-the-Hash, Pass-the-Ticket and Kerberoasting all exploit reusable secrets or tickets that can be replayed. Once an attacker has a valid login, native tools such as RDP, SMB, PowerShell and WMI provide ordinary-looking paths between hosts. The technical problem is not exotic malware, but trust in credentials that can be copied, reused and moved across systems without changing their appearance to the identity stack. Read T1021 Remote Services.

Practical implication: Treat credential replay as an identity control failure, not just an endpoint event, and reduce the number of secrets that can be reused across hosts.

Why shared-device environments expand the blast radius

Shared terminals, shift-based workflows and centrally managed workstations change the identity model because many people authenticate to the same device over time. Cached sessions, broad group membership and operational convenience make it easier for attackers to inherit someone else’s foothold. In those environments, the device becomes a credential reservoir and a pivot point. The risk is not only exposure of a single account, but the fact that one compromised session can be reused to reach multiple internal systems before it is noticed. See the Cloud Workload Identity Guide.

Practical implication: Map shared-device workflows to the accounts, cached sessions and admin rights they expose, then remove any access path that one user does not genuinely need.

How Zero Trust and microsegmentation limit post-access spread

Zero Trust Architecture changes lateral movement by refusing to treat internal traffic as trustworthy. Instead of assuming that a login inside the perimeter is safe, it revalidates identity, device posture and context at each step. Microsegmentation adds path controls so a compromised endpoint cannot freely reach high-value systems. The useful insight is that containment has to happen between systems, not just at the perimeter, because attackers already start inside the trust boundary once credentials are stolen. Read Top 10 NHI Issues.

Practical implication: Use path-based segmentation and continuous verification together so a single compromised account cannot traverse the environment unchecked.

Threat narrative

Attacker objective: The attacker wants to turn one trusted login into broad reach across internal systems so they can steal data, deploy ransomware or maintain persistence.

1. Entry begins when the attacker obtains a valid credential or session that can authenticate without raising an obvious alarm.
2. Escalation follows as the attacker collects additional credentials, abuses native administration paths and reaches accounts with broader privileges.
3. Impact occurs when the attacker reaches high-value systems, deploys payloads or exfiltrates data after moving across the network undetected.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password reuse is the enabling premise that lateral movement exploits. The common thread across Pass-the-Hash, Pass-the-Ticket and Kerberoasting is not the specific protocol, but the fact that credentials can be replayed after initial access. Once a secret can be copied, the attacker no longer needs to break in again; they can move as a legitimate user. Practitioners should treat reusable credentials as a structural expansion path, not an isolated authentication weakness.

Shared-device identity creates a wider blast radius than conventional enterprise IAM assumes. Workstations used by multiple employees, especially across shifts, blur the boundary between one person, one session and one device. Cached credentials, lingering sessions and broad group membership mean the compromise of one terminal can expose multiple identities and multiple downstream systems. The implication is that shared-device governance has to be designed as a distinct identity pattern, not as a variant of standard office IAM.

Blast-radius control, not perimeter certainty, is the decisive variable once an attacker is inside. Lateral movement is what converts a contained compromise into an enterprise incident, and the decisive failures are usually pathing, privilege scope and trust in internal traffic. Zero Trust, microsegmentation and least privilege matter because they reduce the number of systems a valid credential can reach. Practitioners should measure how far one compromised identity can travel, not just whether the first login was blocked.

Identity analytics now have to watch legitimate behaviour, not only failed authentication. Lateral movement often looks normal at the protocol layer because the attacker is using valid accounts and native tools. That makes authentication events, privilege changes and east-west traffic more important than perimeter alerts alone. Security teams need to focus on trust relationships that let one account enumerate and traverse the environment, because that is where the control gap becomes visible.

Credential attack surface is the right named concept for frontline and shared-workstation environments. These environments accumulate reusable secrets, cached sessions and operational exceptions that attackers can exploit repeatedly. The issue is not simply more endpoints, but more places where identity can be copied, replayed and inherited without friction. Practitioners should manage that surface as a first-class governance object, because it determines how quickly an intrusion spreads.

Read next: Lateral Movement Guide

What this signals

Credential replay will remain the shortest path from one foothold to enterprise-wide reach. As long as passwords, hashes and tickets can be reused across systems, lateral movement stays cheap for attackers and expensive for defenders. Programmes that still treat internal authentication as trusted need to shift toward proof at each hop, not just at the front door.

Shared-device governance is becoming a core identity control problem. Frontline terminals, shift handoffs and pooled workstations create identity inheritance that conventional office IAM models do not describe well. The next control frontier is not only stronger login policy, but tighter control over where one user’s session can be reused or extended.

Identity telemetry has to move closer to east-west traffic. The signal of compromise is often not a failed login, but a valid login in the wrong place at the wrong time. That means teams need correlation between authentication events, device trust and internal network paths if they want to spot lateral movement early.

For practitioners

• Audit reusable credential paths Identify where passwords, hashes, Kerberos tickets and cached sessions can be replayed across systems, then remove the paths that let one login authenticate in multiple places.
• Segment shared-device workflows Separate frontline and shift-based terminals from high-value administrative systems so a compromised workstation cannot pivot freely into core services.
• Reduce standing administrative reach Review privileged groups, service accounts and inherited rights that let one account move between hosts without a fresh approval boundary.
• Baseline east-west identity behaviour Watch for authentication bursts, unexpected host-to-host logins and admin tooling used outside normal operator patterns, then investigate the trust relationship behind them.
• Replace passwords on shared endpoints Use passwordless methods or device-bound credentials where shared terminals make password hygiene unreliable and replay attacks easy.

Key takeaways

• A single valid credential can become a full breach path when internal trust is broad and movement between systems is easy.
• The article's example and threat data show that attackers can move from first access to lateral spread in minutes, not hours.
• Reducing replayable credentials, segmenting shared devices and tightening privilege scope are the controls that matter most.

Related NHI Mgmt Group resources: Lateral Movement Guide · T1021 Remote Services · Cloud Workload Identity Guide · Top 10 NHI Issues

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Pass-the-Hash: An authentication abuse technique where an attacker uses a stolen password hash instead of the cleartext password. It matters in Windows environments because cached credentials can sometimes be enough to gain access, turning one compromised host into a broader lateral movement opportunity.
• Pass the Ticket: Pass the Ticket is an attack method in which an adversary reuses a stolen Kerberos ticket to impersonate a user or service. The ticket becomes a bearer credential, so anyone holding it can access protected resources until the ticket expires or is invalidated.
• Kerberoasting: Kerberoasting is an Active Directory attack that targets service accounts by requesting Kerberos tickets and attempting to crack the underlying password offline. It is dangerous because weak service account passwords and excessive permissions can turn one ticket into elevated access across critical systems.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.