Lateral movement is the breach multiplier IAM teams still miss

At a glance

What this is: This is a practitioner-focused analysis of nine lateral movement techniques and the network-level controls that stop them, with the main finding that breakout happens in minutes, not hours.

Why it matters: IAM, PAM, and security teams need to treat internal network reachability as a control surface because stolen credentials and trusted tools become far more dangerous once east-west paths stay open.

By the numbers:

• The average eCrime breakout time from initial access to lateral movement is 29 minutes, 65% faster than the prior year, according to CrowdStrike 2026 Global Threat Report cited by Elisity.
• 82% of detections are malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike 2026 Global Threat Report cited by Elisity.
• 90% of ransomware breaches involve RDP abuse, according to Sophos 2024 Active Adversary Report cited by Elisity.
• 71% of living-off-the-land attacks include PowerShell, according to Picus Security 2025 Red Report cited by Elisity.

Context

Lateral movement is the phase where an attacker turns one compromised system into a broader enterprise breach. In practical terms, it is the point where internal trust assumptions matter more than perimeter controls, because the attacker is already inside and looking for the next reachable host, service, or privileged path.

This article focuses on east-west traffic, identity-aware network policy, and the protocol-level paths that attackers abuse after initial access. For IAM and NHI practitioners, the important question is not only whether credentials were stolen, but whether those credentials can be used to move laterally across an environment with little resistance.

Key questions

Q: What breaks when internal access paths stay open after an initial compromise?

A: Blast radius grows because the attacker can pivot from the first foothold into other systems, credentials, and trust zones. When internal reachability is broad, one compromised identity can turn into repeated privilege escalation opportunities, making the incident hard to contain before critical services are touched.

Q: Why do valid credentials still create lateral movement risk in segmented environments?

A: Valid credentials only stay low-risk when their reach is tightly scoped. If a service account or admin login can authenticate across many internal destinations, an attacker can reuse that trust to move laterally even without malware. The important question is not whether the login is real, but where that login is allowed to travel.

Q: How do security teams know if lateral movement defences are actually working?

A: Teams should test whether one compromised identity can reach adjacent systems, SaaS apps, or production zones that it should not access. If the answer is yes, segmentation or identity policy is too permissive. Effective controls show up as blocked traversal attempts, rapid isolation, and limited blast radius during simulations.

Q: Should organisations prioritise microsegmentation before tightening credential hygiene?

A: They should do both, but segmentation often delivers the faster containment gain. Password rotation and privileged access cleanup reduce how credentials are abused, while network restriction limits how far abuse can go once it happens. In flat networks, improved identity hygiene alone does not stop lateral spread.

Technical breakdown

How pass-the-hash turns stolen NTLM material into lateral movement

Pass-the-hash works because some Windows authentication flows accept the hash as proof of identity rather than requiring the plaintext password. Once an attacker captures an NTLM hash from memory, they can replay it against remote systems over SMB or WMI without cracking the password first. That makes the technique attractive whenever local admin reuse, broad host reachability, and weak segmentation align. The core failure is not just credential theft. It is allowing a stolen authenticator to remain network-valid across too many destinations. Identity-aware segmentation can still stop the traffic even if the authentication layer is fooled.

Practical implication: Restrict SMB and WMI reachability by device identity so a replayed hash cannot traverse the network.

Why RDP and PsExec become breach accelerants in flat networks

RDP and PsExec are legitimate administration channels, which is exactly why attackers like them. RDP gives interactive access with full GUI control, while PsExec pushes a service binary over SMB and executes it remotely through normal Windows management paths. In both cases, the attack succeeds when the environment lets too many endpoints initiate privileged sessions to too many targets. The protocol itself is not the problem. The problem is that broad administrative pathways turn a single compromised host into a launchpad for enterprise-wide spread. Containment depends on narrowing who may connect, from where, and to which destination classes.

Practical implication: Limit RDP and ADMIN$ access to designated admin workstations and management hosts only.

How service account abuse and living-off-the-land tools extend reach after initial access

Kerberoasting, WMI, PowerShell remoting, SSH key theft, and internal application exploitation all share a pattern: the attacker converts valid access into legitimate-looking movement. Kerberoasting targets service accounts whose tickets can be cracked offline, while living-off-the-land tools blend into administration traffic and reduce the chance of easy signature-based blocking. Once the attacker has a usable account or execution path, east-west segmentation becomes the last meaningful containment layer. This is why service account scope, protocol inventories, and destination restrictions matter together. You cannot rely on patching or detection alone if internal trust is too broad.

Practical implication: Map which service accounts and tools actually need each internal path, then deny everything else at the network layer.

Threat narrative

Attacker objective: The attacker wants to convert one compromised host or account into a larger, harder-to-contain breach that reaches multiple systems and privileged services.

1. Entry begins with a phished credential, exposed RDP service, or compromised vendor connection that gives the attacker an initial foothold.
2. Credential abuse follows as the attacker reuses valid logins, hashes, tickets, SSH keys, or remote administration tools to move beyond the first host.
3. Escalation and spread occur when broad east-west connectivity lets the attacker reach additional systems, administrative shares, or service accounts.
4. Impact arrives when the foothold becomes a domain-wide event, including ransomware deployment, persistence, or broad data exposure.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

East-west trust is the real breach multiplier: The article shows that initial access is often survivable, but lateral movement is what turns a contained incident into an enterprise event. That is a network governance problem as much as an IAM problem, because the attacker succeeds when internal paths remain broadly open. Practitioners should treat east-west reachability as a first-class control surface, not a side effect of segmentation.

Protocol-level admin convenience is an identity risk: RDP, PsExec, WMI, PowerShell remoting, and SSH are all legitimate operational tools, which makes them dangerous when authorization is too broad. The governance failure is not that these tools exist, but that too many identities can use them too widely. Security teams need to distinguish administration capability from blanket trust.

Identity-aware segmentation changes the blast radius equation: Restricting device-to-device and account-to-destination flows limits how far stolen credentials can travel, even when attackers have valid authentication material. That matters for NHI as well as human-admin pathways, because service accounts and shared admin channels often inherit the same over-permissioned network assumptions. The practical conclusion is to govern reachability by identity and function, not by network convenience.

Lateral movement exposes privilege scope debt: Many organisations accumulate a hidden debt in service accounts, remote management access, and legacy protocols that were never narrowed to actual business need. That debt becomes visible only when an attacker pivots successfully. The result is a programme that knows where the perimeter is, but not where trust ends.

Segmentation and credential hygiene are complementary, not interchangeable: The article correctly separates credential compromise from post-compromise spread. Even strong password rotation or better detection will not fully contain a flat internal network, and segmentation alone will not save an environment where service accounts are overprivileged and reusable. Practitioners need both a narrower identity scope and narrower network reach.

From our research library:

• 74% of organizations report identity-related breaches, and privileged access is a leading cause of lateral movement.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Identity-based east-west control is becoming a core IAM adjacency: The article’s central lesson is that identity governance does not end at authentication or privilege assignment. Once a compromised account can still traverse broad internal paths, the environment has already given the attacker room to expand. Practitioners should align microsegmentation, admin tiering, and identity scoping so reachability reflects business need, not inherited trust.

Lateral movement exposes a control gap that access review cadences do not catch: Access reviews tell you who still has access on paper, but they do not reveal whether a valid identity can move freely across the network in real time. That means teams need to validate reachability, remote admin channels, and service account destination scope as part of routine governance.

Service account scope is now a blast-radius question: When service identities can reach far more infrastructure than their jobs require, a single compromise becomes a spread event. That makes destination scoping, protocol restriction, and identity-aware network policy part of the same containment problem, not separate controls.

For practitioners

• Map east-west attack paths first Inventory which endpoints, subnets, and admin tiers can currently reach one another over SMB, RDP, WMI, SSH, and similar administrative channels. Use that map to identify where a single compromised workstation could reach server or domain assets that it should never touch.
• Restrict remote administration to approved management endpoints Allow RDP, PsExec-style management, and similar remote admin flows only from designated admin workstations or jump hosts. Block workstation-to-workstation and workstation-to-server administration paths unless a specific operational need is documented.
• Constrain service account destination scope Review service accounts, scheduled tasks, and application identities to ensure they can reach only the systems and protocols required for their function. Remove broad network access that lets a compromised service account pivot across unrelated workloads.
• Harden protocol exposure on internal networks Disable or tightly limit SMB, NTLM, RDP, and remote PowerShell where business use does not require them. Where they must remain available, place them behind identity-aware policy that checks the source device and intended destination.
• Test containment against known lateral techniques Run segmentation validation specifically against pass-the-hash, RDP abuse, PsExec, WMI, SSH key abuse, and internal application exploitation so you know which paths are actually blocked before an incident forces the test.

Key takeaways

• Lateral movement is the stage where many compromises become enterprise incidents, because it lets attackers turn one foothold into a wider spread event.
• The article ties breakout speed to minutes, with CrowdStrike cited at 29 minutes on average and 27 seconds in the fastest observed case, showing how quickly containment windows close.
• The most effective control is not detection alone but restricting east-west reach so stolen credentials, remote tools, and service accounts cannot roam freely.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
• Pass-the-Hash: An authentication abuse technique where an attacker uses a stolen password hash instead of the cleartext password. It matters in Windows environments because cached credentials can sometimes be enough to gain access, turning one compromised host into a broader lateral movement opportunity.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.