Lateral movement visibility and containment gaps in hybrid cloud

At a glance

What this is: Illumio argues that hybrid cloud lateral movement is driven by invisible internal traffic, exposed ports, and workloads that remain more reachable than intended.

Why it matters: IAM, NHI, and cloud security teams need east-west visibility because containment fails when internal paths and overexposed workloads are undiscovered.

By the numbers:

• Nearly 90% of organizations experienced a security incident involving lateral movement in the past year.

Context

Lateral movement is the phase of an intrusion where an attacker, after initial access, moves across internal systems to reach more valuable assets. In hybrid cloud environments, that movement is often hidden inside normal workload-to-workload communication, so perimeter controls and public-facing monitoring miss the most relevant risk.

The governance gap is visibility into east-west traffic, reachable ports, and unintended exposure across cloud and on-premises systems. That makes this topic relevant to IAM and NHI practitioners because service accounts, workload identities, and shared onboarding paths can expand the paths an attacker can use once inside. The article’s starting point is typical for modern hybrid estates, where internal reachability is usually under-instrumented.

Illumio’s message is not that visibility replaces segmentation, but that containment depends on understanding who and what can talk internally before an incident forces the question.

Key questions

Q: What breaks when internal traffic visibility is missing in hybrid cloud?

A: Without internal traffic visibility, teams usually know the perimeter but not the paths an attacker can take after entry. That leaves reachable ports, unexpected flows, and overexposed workloads unaddressed, so lateral movement can continue until the blast radius is already large. Containment depends on seeing east-west communication early enough to isolate risky workloads before spread accelerates.

Q: Why does lateral movement become harder to stop in hybrid environments?

A: Hybrid environments mix cloud, on-premises, and shared service paths, which makes internal reachability difficult to model from one control point. Attackers exploit that complexity by moving through ordinary workload connections rather than obvious edge traffic. The more fragmented the visibility, the easier it is for lateral movement to stay hidden long enough to matter.

Q: How do security teams know whether containment is actually working?

A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded. A working containment model prevents re-escalation, blocks credential regeneration, and remains effective even when the target is polling for state changes. If any of those fail, containment is only partial.

Q: What is the difference between seeing network traffic and containing lateral movement?

A: Seeing traffic is an observability function, while containing lateral movement is an enforcement function. Visibility tells you where workloads talk and which ports are reachable; containment limits what those systems can reach once risk is detected. Mature programmes need both, because observation without isolation still leaves the attacker room to move.

Technical breakdown

Why east-west traffic hides the real blast radius

East-west traffic is the internal communication between workloads, services, and systems after an initial foothold. In hybrid cloud estates, that traffic is often too noisy, too distributed, and too dynamic for perimeter tooling to reconstruct reliably. Reachable ports and unexpected flows matter because they show which assets an attacker can reach without triggering obvious edge defenses. This is also where identity and access decisions become operationally visible: workload accounts, service connectivity, and cloud permissions shape the network paths available to an intruder.

Practical implication: Measure internal reachability, not just internet exposure, to identify where segmentation or access scoping is missing.

How flow logs turn connectivity into investigation data

Flow logs provide the raw records of network communication between sources and destinations, but they are only useful when onboarded from the environments that matter. In hybrid cloud, that usually means AWS, Azure, GCP, and on-premises sources. Once ingested, the logs can surface top talkers, unexpected flows, and exposure points that point to risky lateral paths. The technical limit is that logs describe behavior, not intent, so they need context from asset criticality, workload role, and policy scope before they become actionable.

Practical implication: Onboard representative flow logs early so you can see which workloads are most reachable before tuning containment policy.

Why automatic containment depends on segmentation control

Containment requires more than detection because lateral movement is a progression problem, not a single event. When a platform flags suspicious traffic, the response value comes from the ability to quarantine a compromised workload or flow immediately, then preserve enough context for investigation. That works only when segmentation is already defined around workload relationships and not treated as a post-breach design exercise. In practice, the control is about shrinking what an attacker can reach once a foothold exists, which is especially important in hybrid estates where trust boundaries are fluid.

Practical implication: Link detection to segmentation rules so suspicious internal traffic can be isolated without waiting for manual triage.

Threat narrative

Attacker objective: The attacker wants to move laterally from an initial foothold to more valuable internal workloads while staying hidden long enough to expand impact.

1. Entry occurs after the attacker gets past the perimeter and inside the network, where the article says internal traffic becomes the real exposure surface.
2. Credential or access abuse is enabled by unseen connections and overexposed systems that let the attacker move quietly across workloads.
3. Escalation and spread happen as the attacker uses reachable ports and internal paths to widen access across the hybrid environment.
4. Impact is broader compromise, because the environment’s blast radius remains large until risky traffic and unnecessary reachability are contained.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Internal reachability is the governing problem in hybrid cloud containment. Perimeter-centric thinking fails once an attacker is inside, because the decisive question becomes which workloads can still be reached east-west. That makes blast radius a visibility problem as much as a policy problem. Practitioners should treat internal network pathing as part of identity and access governance, not as a separate networking concern.

Shared visibility is a control, not a convenience. When security, cloud, and infrastructure teams all see the same flow data, they can resolve exposure faster and with fewer false assumptions. That matters because lateral movement thrives on fragmented ownership, where one team sees cloud policy, another sees workload behavior, and nobody sees the full chain. The practical conclusion is that collaboration has to be built into the control plane.

Blast-radius reduction is the right named concept for this problem. The article’s core finding is that exposure lives in reachable ports, unexpected flows, and stale internal paths, not just in public-facing assets. Blast-radius reduction means designing and validating containment around what an attacker can reach after entry, especially in hybrid estates with mixed cloud and on-premises connectivity. Practitioners should measure success by how much internal movement they can prevent, not by how much traffic they can observe.

Hybrid cloud lateral movement exposes governance gaps in workload identity and service reachability. Service accounts, workload permissions, and shared onboarding of flow logs all influence how far an intruder can move after compromise. That is an identity governance issue because internal access scope determines containment scope. Teams should align workload identity review with segmentation and flow-visibility programs.

Containment maturity is shown by response linkage, not visibility alone. Seeing traffic is necessary, but quarantine capability is what turns detection into reduced dwell time. The article’s model implies that mature programmes connect observability directly to segmentation actions, so investigation and containment happen in the same operational loop. Practitioners should judge their control plane by how quickly suspicious internal paths can be isolated.

What this signals

Blast-radius reduction now sits at the centre of hybrid cloud defence. The article’s strongest message is that internal traffic, not just perimeter posture, determines how far an attacker can move once inside. For practitioners, that means containment design has to account for workload reachability, shared services, and the operational paths that logs reveal after the fact.

Workload identity and network reachability are converging governance concerns. When service accounts, cloud accounts, and internal connectivity are evaluated together, teams can see where access scope quietly becomes movement scope. That is especially important in mixed environments, where identity review and segmentation still live in separate operational queues.

Shared visibility reduces decision latency. When cloud, security, infrastructure, and network teams validate the same flow data, they can act on the same exposure picture instead of reconciling conflicting views. In practice, that improves both prioritisation and containment confidence.

For practitioners

• Ingest internal flow logs first Connect representative AWS, Azure, GCP, and on-premises flow sources so you can see real communication paths, unexpected flows, and exposure points before tuning policy.
• Map reachable ports and overexposed workloads Build a working inventory of workloads with unnecessary listening ports or broad internal reachability, then use that view to prioritise containment.
• Tie detection to quarantine actions Ensure suspicious lateral traffic can trigger immediate isolation of the affected workload or flow, with segmentation rules already defined.
• Share the same visibility set across teams Include cloud, infrastructure, security, and network stakeholders in the same trial or operational view so they can validate what the traffic data means together.
• Review workload identity scope alongside network reachability Check which service accounts and workload paths can still reach adjacent systems after compromise, then narrow both access scope and connectivity where they overlap.

Key takeaways

• Hybrid cloud lateral movement persists because internal reachability is often less visible than external exposure.
• The article points to flow logs, reachable ports, and exposure points as the data that turns hidden movement into something teams can contain.
• Practitioners should measure containment success by how quickly suspicious internal paths can be isolated, not by visibility alone.

Key terms

• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Flow Log: A record of network traffic metadata that shows source, destination, protocol, and timing without capturing full content. Flow logs are valuable for cloud investigations because they reveal movement patterns, service exposure, and outbound behaviour that can be correlated with threat and asset context.
• Workload Reachability: Workload reachability describes which internal systems a workload can connect to, whether by network policy, routing, or service configuration. High reachability increases compromise impact because a single foothold can become a path to additional assets unless segmentation and access scope are tightly controlled.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course if your programme needs to connect identity controls to broader security operations.