Lateral movement techniques expose the limits of detection-only defense

At a glance

What this is: This article maps common lateral movement techniques and shows that detection-only strategies cannot keep up with machine-speed internal breakout once an attacker has a foothold.

Why it matters: IAM, PAM, NHI, and security teams need to treat internal reachability and privileged pathways as enforcement problems, not alerting problems, because valid credentials and native tools make lateral movement hard to spot in time.

By the numbers:

• 80% of enterprise servers are reachable from anywhere inside the network, according to Zero Networks' analysis.
• Attackers can begin moving laterally in as little as 27 seconds, according to Zero Networks' analysis.

Context

Lateral movement is the phase of an intrusion where an attacker uses an initial foothold to move across internal systems, seek higher privilege, and reach sensitive assets. In identity terms, the problem is not just how access is obtained but how far a compromised credential, session, or service account can travel once it is trusted inside the environment.

Zero Networks argues that detection-first models fail because the attacker can operate faster than alerting, and because built-in tools, valid accounts, and internal protocols often look normal until damage is already underway. For IAM and NHI programmes, that makes containment architecture part of the identity control plane, not a separate security layer.

The article is a practitioner guide to the main techniques attackers use after initial access, but its broader message is that internal trust boundaries remain too porous for security teams to rely on visibility alone. That is typical of modern enterprise environments where identity sprawl and permissive east-west access reduce the value of after-the-fact detection.

Key questions

Q: What breaks when an attacker can move laterally with valid credentials?

A: The failure is that internal authentication no longer proves legitimacy. Once a valid identity can reach multiple hosts, the attacker can impersonate normal administration, reuse trust relationships, and blend into expected traffic while expanding access. That is why lateral movement turns identity governance into a containment problem, not just a login problem.

Q: Why do valid accounts and native tools make lateral movement so hard to stop?

A: They collapse the difference between administrator activity and attacker activity. Native tools such as PowerShell, WMI, RDP, and SSH are already trusted in many environments, and valid credentials let the attacker ride that trust without malware. The risk rises when permissions are excessive and east-west paths are left open by default.

Q: How do security teams know if lateral movement defences are actually working?

A: Teams should test whether one compromised identity can reach adjacent systems, SaaS apps, or production zones that it should not access. If the answer is yes, segmentation or identity policy is too permissive. Effective controls show up as blocked traversal attempts, rapid isolation, and limited blast radius during simulations.

Q: What should teams do when their environment still allows broad internal server access?

A: Treat that as a containment problem, not just a configuration issue. Restrict communication between workloads, enforce identity-based approval for privileged connections, and remove standing permissions that let one account pivot freely across the environment. Without those guardrails, lateral movement remains a default path rather than an exception.

Technical breakdown

How lateral movement works through valid credentials and native tools

Lateral movement often succeeds because the attacker does not need new malware or a fresh exploit after the first foothold. Instead, they reuse valid accounts, stolen hashes, Kerberos tickets, or built-in administration tools such as PowerShell, PsExec, WMI, RDP, and WinRM. That blend of legitimate-looking activity and native protocols makes the traffic hard to distinguish from routine administration. Once inside, the adversary can pivot to remote services, harvest more credentials, and expand access across systems that were never intended to be part of the same trust zone.

Practical implication: Treat internal authentication paths, not just perimeter entry points, as a control surface for enforcement and detection.

Why detection-only controls lose against machine-speed breakout

Detection tools still matter, but they are reactive by design. The article notes that attackers can begin lateral movement in as little as 27 seconds, while breach identification and containment often take far longer. When lateral movement is executed with valid credentials or native utilities, the signal-to-noise problem becomes severe, especially if the environment allows broad internal reach by default. The gap is not just speed, but the fact that many internal actions are technically authorised even when they are operationally hostile.

Practical implication: Use prevention controls on east-west paths so security teams are not relying on alert triage to stop a live breakout.

How microsegmentation and identity-based access control change the attack path

Microsegmentation limits which systems can talk to one another, while identity-based access control ties that communication to verified identity and purpose rather than simple network presence. In practical terms, this shifts the decision from 'is the user inside the network?' to 'is this specific identity allowed to reach this specific workload for this purpose?' That matters because many lateral movement techniques depend on internal default trust, open server-to-server paths, or privileged protocols that were never constrained to the minimum necessary scope. Blocking those paths changes the economics of the intrusion.

Practical implication: Map internal communication paths to least-privilege policy and remove broad east-west reach before an attacker can reuse it.

Threat narrative

Attacker objective: The attacker wants to turn a single foothold into broad internal reach that exposes sensitive systems, privileged accounts, and business-critical data.

1. Entry usually starts with phishing, compromised credentials, or another foothold that gives the attacker a valid internal starting point.
2. Credential access follows through credential dumping, pass-the-hash, pass-the-ticket, SSH hijacking, or reuse of existing sessions and remote services.
3. Escalation and lateral movement then expand access through SMB, RDP, WinRM, Kerberoasting, or living-off-the-land tools until higher-value systems are reached.
4. Impact is achieved when the attacker reaches sensitive systems such as domain controllers, critical databases, or other high-value assets and can persist or disrupt operations.

Breaches seen in the wild

• Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Detection is no longer the primary containment control for lateral movement: The article's core lesson is that internal breakout now happens too quickly for alert-driven response to be the first line of defense. When attackers can move laterally in seconds and hide inside valid credentials or native tools, containment has to occur before or at the point of access, not after an alert fires. Practitioners should treat east-west enforcement as a control objective, not an optimisation.

Identity blast radius is the real measure of lateral movement risk: A single compromised login matters less than the number of systems it can reach without challenge. That means privilege scope, session trust, and internal protocol reach are more important than simple account counts. The governance question becomes how far one credential can travel before control boundaries stop it, which is a stronger operating metric than traditional perimeter-centric thinking.

Living-off-the-land turns routine administration into an adversary advantage: When PsExec, WMI, PowerShell, RDP, and SSH are already accepted inside the environment, the attacker does not need novel tooling to evade scrutiny. This collapses the distinction between legitimate operator activity and malicious movement, especially in environments with excessive standing privilege. The practical conclusion is that governance has to assume attacker reuse of normal administrative pathways.

Internal network trust is still being treated as a default rather than an entitlement: The article shows that 80% of enterprise servers are reachable from anywhere inside the network, which is a governance failure as much as a technical one. The problem is not just exposure, but the assumption that internal location equals legitimate access. Teams need to re-evaluate whether network adjacency, rather than explicit authorization, is still doing too much of the access-control work.

Lateral movement is now a convergence problem across IAM, PAM, and network enforcement: The techniques described are not separate threat classes. They are different ways of turning valid identity into internal reach, which means identity governance, privilege management, and segmentation have to be designed together. For practitioners, the control gap is not one product category but the absence of a coordinated containment model.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Identity blast radius is becoming a better control metric than raw account counts: If one valid login can reach most of the internal estate, the environment is already overexposed. Practitioners should measure how much east-west access each identity really has, then reduce the reachable surface until compromise stops at the first meaningful boundary.

Lateral movement control is now a design discipline, not a detection outcome: Waiting to observe malicious movement is too late when attackers can hide inside remote administration traffic and built-in tools. The programme implication is to enforce segmentation and identity checks where systems talk to each other, not where the alert queue sees them.

Living-off-the-land changes how internal trust should be governed: When the attacker uses the same utilities your operators use, the security boundary has to move from tool inspection to path and privilege control. That is a governance shift for IAM, PAM, and network teams because the safe default is no longer broad internal trust.

For practitioners

• Map east-west access paths Inventory which servers, management protocols, and service identities can reach critical assets without additional challenge, then remove default internal reach that is not explicitly required.
• Enforce identity-based access on privileged protocols Require verified identity and purpose for RDP, WinRM, SMB, SSH, and related administration paths instead of allowing access based only on network location.
• Segment high-value systems into smaller trust zones Use microsegmentation to break broad east-west connectivity so a single compromised account cannot pivot from one server class to another with the same credentials.
• Reduce standing privilege on service and machine identities Review service accounts, admin groups, and machine identities for unused permissions, especially where internal protocols can be reused after compromise.

Key takeaways

• Lateral movement succeeds when internal trust is broader than the identity controls governing it, not simply when perimeter defenses fail.
• The article's data shows a wide attack surface and extremely fast breakout timelines, which makes post-event detection insufficient as a containment strategy.
• Practitioners should focus on reducing internal reach, tightening privileged protocol access, and using segmentation to force a compromise to stop early.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.