Lateral movement is the multiplier in breaches across sectors

At a glance

What this is: ColorTokens argues that across healthcare, telecom, SaaS and OT, the real breach multiplier is internal lateral movement after the first foothold, not the initial compromise alone.

Why it matters: For IAM, PAM and NHI teams, the lesson is that access scope, east-west controls and privilege boundaries must be designed to limit attacker mobility once an account, app or session is compromised.

By the numbers:

• The Change Healthcare ransomware attack hit 192.7 million people, according to ColorTokens.

Context

Lateral movement is the stage where an attacker who has already gained a foothold starts moving across systems, applications or environments to expand impact. In practice, that is where many breaches become much more expensive, because internal trust and excessive reach let a small intrusion turn into a broad incident.

This article sits at the intersection of security operations, access governance and identity control. The identity angle is clear: once an account, session or application trust boundary is abused, the attacker is no longer limited to the original entry point. That makes privilege scope, segmentation and containment part of identity security, not separate concerns.

Key questions

Q: What breaks when lateral movement is not contained after initial access?

A: When lateral movement is not contained, the attacker’s first foothold becomes a bridge into many more systems. That is when isolated compromise turns into broader data exposure, service disruption or ransomware leverage. The failure is usually excessive internal trust, broad privilege and weak zone separation, which lets the attacker reuse legitimate pathways instead of forcing a fresh breach at every step.

Q: Why does lateral movement make breaches much more damaging?

A: Lateral movement increases damage because the attacker can expand access after the first compromise instead of staying limited to one system. Every additional system reached raises the blast radius, whether the outcome is stolen records, production disruption or operational downtime. The risk grows fastest where identities, workloads and applications are trusted to move through the environment with too few constraints.

Q: How do security teams know whether containment is actually working?

A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded. A working containment model prevents re-escalation, blocks credential regeneration, and remains effective even when the target is polling for state changes. If any of those fail, containment is only partial.

Q: What should teams do when compromised access could spread across SaaS, cloud and OT systems?

A: They should prioritise containment over assuming the initial compromise is the main problem. The practical response is to narrow internal trust, separate critical zones and remove unnecessary account reach so one compromised path cannot spread across environments. In mixed estates, the question is not whether intrusion can happen, but how far it can travel once it does.

Technical breakdown

How lateral movement turns one foothold into many

Lateral movement is the post-compromise phase where an attacker reuses valid access, stolen credentials, weak trust relationships or overly broad network reach to pivot from one system to another. The core problem is not just entry, but the ability to discover adjacent systems and use legitimate pathways to blend in. In cloud, SaaS and enterprise environments, that often means moving through privileged sessions, service accounts or connected applications rather than exploiting the same bug twice. Once movement is possible, the attacker can escalate reach without repeatedly breaking in.

Practical implication: reduce the internal pathways an attacker can reuse after the first compromise.

Why identity boundaries matter more than perimeter blocks

Perimeter controls can stop some initial access, but they do little once an attacker is inside an environment that trusts authenticated users, workloads or applications too broadly. Identity becomes the enforcement layer that determines what a compromised principal can touch next. If service accounts, admin roles, federated apps or SaaS connectors have excessive reach, the attacker inherits that reach. This is why lateral movement is often an IAM, PAM and NHI problem as much as a network problem: the breach grows through authorised pathways, not only through malware.

Practical implication: constrain privilege and trust relationships so compromise does not automatically expand access.

Microsegmentation and east-west control as containment mechanisms

Microsegmentation limits how far a compromised system, user or workload can move by restricting east-west traffic and separating zones with explicit policy. It does not prevent every compromise, but it changes the attacker’s economics by breaking the chain from one accessible asset to the next. In OT and hybrid environments, that containment is especially important because uptime, safety and regulatory exposure rise quickly when movement crosses business-critical boundaries. Segmentation works best when paired with identity-aware access policy and continuous monitoring, because the goal is to make internal movement visible and expensive.

Practical implication: treat segmentation as a containment control and test whether a compromised principal can still traverse critical zones.

Threat narrative

Attacker objective: The attacker’s objective is to turn one compromised entry point into broad operational, financial or data impact by expanding access across the environment.

1. Entry occurs through a single foothold such as a zero-day, phishing, social engineering or another initial access path.
2. Credential and trust reuse then allow the attacker to pivot laterally through connected systems, apps or OT zones.
3. Escalation follows when the attacker reaches more privileged data, service controls or operational assets, increasing blast radius.
4. Impact appears as large-scale data exposure, service disruption, ransomware leverage or operational downtime.

Breaches seen in the wild

• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.
• Google API Keys Exposure — Gemini AI: Google API keys exposed in client-side code via Gemini AI integrations, creating data leak risk.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Lateral movement is the real breach multiplier, not the headline entry vector. Organisations often over-focus on how attackers got in and under-focus on what they could touch next. The article’s examples show that the second phase, not the first, determines whether an incident becomes a contained event or a sector-level problem. For practitioners, the control question is how far a compromised principal can travel before it is stopped.

This is an identity governance problem as much as a network design problem. Once authenticated access is too broad, the attacker inherits the organisation’s own trust structure. That makes PAM scope, service-account reach and SaaS connector permissions central to containment, especially where cloud and NHI pathways cross business systems. Practitioners should view internal access boundaries as part of their identity control plane, not an afterthought.

Containment trust gap: many environments still assume authenticated access is inherently safe inside the perimeter. The article shows that assumption fails when lateral movement is unconstrained across sectors and architectures. NIST-CSF and MITRE-ATT&CK both reinforce the need to model post-compromise movement, while OWASP-NHI is relevant wherever non-human credentials can be reused across systems. Practitioners need to design for hostile internal movement, not just external intrusion.

Microsegmentation becomes a governance issue when operational impact is the real loss event. In healthcare and OT, the cost of movement is not just data exposure but delayed care, downtime and safety exposure. That means containment must be measured against business-critical pathways, not only technical topology. Security teams should be asking which identities, workloads and sessions still have the ability to cross those boundaries after compromise.

The market lesson is that attack-path reduction is becoming a core security requirement across identity, cloud and OT estates. The article reflects a broader shift away from assuming endpoint prevention or edge controls are enough. Buyers should expect more scrutiny of east-west visibility, access scoping and post-compromise containment because those are the controls that change breach economics. Practitioners should align governance around how movement is prevented, detected and limited after the first foothold.

From our research library:

• 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.

What this signals

Lateral movement is now a governance metric, not just a detection problem. Security teams should measure how quickly a compromised identity, workload or SaaS connector can reach sensitive systems, because that speed is what turns a local incident into enterprise impact. For identity programmes, the practical test is whether privilege boundaries still hold once a session is already trusted.

Containment has to be designed into identity, cloud and OT control planes together. If admin reach, application trust and east-west network access are managed separately, attackers will exploit the seams. Practitioners should align segmentation, privileged access and session controls so the same principal cannot traverse critical zones unchallenged.

Attack-path reduction is becoming the most defensible way to lower breach impact. In sectors where downtime or exposure is expensive, preventing every initial intrusion is unrealistic, but limiting traversal remains achievable. Teams that can prove constrained movement will be better positioned to limit regulatory, operational and financial fallout.

For practitioners

• Map east-west movement paths Identify which users, service accounts, workloads and SaaS connectors can traverse critical zones after one compromise, then remove unnecessary paths.
• Tighten privileged access scope Review admin roles, service accounts and delegated access to ensure no principal can reuse a single credential set across multiple sensitive systems.
• Segment business-critical zones Apply containment boundaries around healthcare, OT, finance and identity systems so a compromised endpoint cannot freely pivot into crown-jewel assets.
• Test post-compromise traversal Run breach simulations that start with a single foothold and measure how quickly an attacker can reach sensitive data, production systems or backup infrastructure.
• Harden SaaS and application trust chains Audit integrated applications, federated sessions and third-party access so a compromised app or token cannot be reused to move deeper into the environment.

Key takeaways

• The central lesson is that the most damaging part of a breach often happens after the first compromise, when the attacker can move laterally through trusted systems.
• The article ties that pattern to major incidents across healthcare, telecom, SaaS and OT, showing that internal movement drives the size of the loss.
• Teams should treat segmentation, privilege scope and trust boundaries as containment controls that determine whether an intrusion stays small or becomes systemic.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps identity and security practitioners turn governance intent into enforceable controls across their programmes.