TL;DR: A simple complement-rule probability model shows how lateral movement becomes easier to estimate when defenders treat each pivot path as a graph, then combine sequential hops and alternate routes mathematically, according to ColorTokens. The lesson is that microsegmentation decisions should focus on reducing the highest-probability pivot paths, not just shrinking the number of possible connections.
At a glance
What this is: This is a probability-based way to model lateral movement as paths through a directed graph, with the key finding that high-probability pivots drive reachability more than raw path count.
Why it matters: IAM, PAM, and microsegmentation teams should use path probability, not just topology, to decide which routes and identities deserve the strongest restrictions.
By the numbers:
- P(at least one repeat) = 1 − (9×8×7) / 10³ = 0.496, almost 50%.
Context
Lateral movement becomes hard to reason about when defenders think only in terms of possible connections instead of likely attack paths. A directed graph helps by turning assets and pivot opportunities into a structure that can be scored, compared, and constrained.
This matters for identity-led defence because pivotability is often created by RDP, SSH, WinRM, SMB, service accounts, and other access paths that behave like machine-to-machine trust relationships. The article’s starting point is a practical one for security teams, not an abstract mathematical curiosity.
Key questions
A: Security teams should start with identity based policy design, not broad network redrawing. Map critical assets, define allowed communications at the workload, user, and device level, then enforce least privilege across east west traffic. Pair the policy model with continuous visibility and monitoring so exceptions can be refined as applications change and attackers try to reuse legitimate access.
Q: Why do some lateral movement paths matter more than others?
A: Because lateral movement is not just a question of whether a route exists. The probability of each hop succeeding, plus the presence of alternate routes, determines how likely an attacker is to reach the target through that path.
Q: What are the signs that segmentation is failing to contain lateral movement?
A: The clearest signal is when one or two access paths dominate the reachability of critical assets even though the environment appears segmented. If remote admin and identity-linked routes still connect key systems with high probability, the control is too weak to change blast radius meaningfully.
Q: How can teams decide whether a segmentation change is actually working?
A: Recalculate the probability of reaching critical nodes before and after the change. If the weighted reachability drops sharply on the most likely pivot paths, the change is reducing lateral movement in a way that matters operationally.
Technical breakdown
How complement rules model alternate pivot paths
The article applies the complement rule to attack modelling: calculate the probability that no repeat or no successful path occurs, then subtract that from 1. In lateral movement terms, that means multiple independent routes to a target are combined as alternatives, because the attacker only needs one route to work. This is useful because network diagrams often overstate safety when they count routes without weighting them. The model turns reachability into a probability problem instead of a yes-or-no question, which is a better fit for real environments where controls vary by path.
Practical implication: score alternate paths by likelihood, not just existence, when deciding which routes microsegmentation should suppress first.
Why sequential hops amplify privilege and trust
Sequential attack steps compose multiplicatively, so each hop reduces or raises the total probability of reaching a target. The article explicitly ties each edge’s pivot potential to how the attacker landed and what privilege they hold, which is the right mental model for service accounts, remote admin channels, and identity flow. This makes privilege a path property, not just an account property. A weakly protected first hop can be tolerable alone, but when chained into a second and third hop it becomes a much larger reachability issue.
Practical implication: review service-account and admin-hop chains as attack sequences, not isolated permissions.
How microsegmentation changes probability, not just connectivity
Microsegmentation is valuable here because it changes the probability of traversal on the highest-risk edges, not merely the count of allowed or denied connections. The worked example shows that reducing the stronger RDP path sharply lowers overall reachability, while weakening a low-probability HTTP route has a smaller effect. That is the key architectural insight. Defenders should think in terms of risk concentration across graph edges, because a few dominant pivot paths usually matter more than a large set of low-value edges.
Practical implication: target the edges with the greatest contribution to reachability, especially remote management and identity-linked pivot channels.
NHI Mgmt Group analysis
Path probability is a better control lens than connection count: defenders routinely over-focus on reducing the number of possible routes, when the real issue is which routes remain most likely to succeed. A graph with fewer edges can still be highly traversable if a small number of edges carry high pivot potential. For practitioners, this means microsegmentation design should be driven by weighted reachability, not cosmetic segmentation density.
Identity and privilege are embedded in every lateral movement edge: the article’s model is effectively an identity model in disguise because each edge probability depends on how the session was established and what privilege it holds. That makes service accounts, remote admin channels, and machine-to-machine trust the true variables behind reachability. For IAM and PAM teams, lateral movement reduction starts with shrinking the privilege value of each hop.
Weighted graph thinking exposes the real blast radius: once you model alternate paths and sequential hops separately, you can see which route dominates the chance of compromise spreading. That is a more actionable signal than a generic statement that the network is “segmented.” The named concept here is pivot path weighting: the practice of prioritising controls against the edges that most increase attacker reachability. For security programmes, that is where measurement should move next.
Probability models can make segmentation governance more defensible: the article gives teams a way to explain why one access path deserves stronger restriction than another. That matters because segmentation is often argued as a binary design choice when it is really a prioritisation problem. For risk committees, the useful question becomes which hop reductions materially lower the chance of lateral spread, not whether segmentation exists at all.
From our research library:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
What this signals
Pivot path weighting: segmentation is most useful when it changes the probability of moving laterally along the routes attackers actually prefer. Teams should treat service-account flows, remote management, and identity-linked hops as the edges that define blast radius, not as incidental network detail.
Microsegmentation programmes become easier to justify when they are scored against weighted reachability instead of simple allow-or-block lists. That shift aligns control design with how real attackers move through mixed identity and network pathways.
For practitioners
- Map pivot paths as weighted edges Represent RDP, SSH, WinRM, SMB, and service-account flows as probabilities so you can compare routes by reachability, not just presence.
- Prioritise controls on the highest-probability hops Reduce the likelihood of the strongest remote-management and identity-linked edges first, because those changes produce the largest drop in overall reachability.
- Model alternate routes separately from chained hops Treat multiple entry options as a union problem and multi-step exploitation as a sequence problem, then combine them to estimate total spread potential.
- Use the model to justify segmentation decisions Document why one path gets stricter policy than another by showing its effect on the probability of moving laterally to critical assets.
Key takeaways
- The article frames lateral movement as a weighted graph problem, where the likelihood of each hop matters more than the mere presence of connectivity.
- A few high-probability pivot paths can determine most of the blast radius, so defenders need to focus on the routes attackers are most likely to use.
- Microsegmentation is most defensible when it demonstrably lowers weighted reachability on the strongest remote and identity-linked paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0008 — Lateral Movement | The article models how attackers traverse multiple pivot paths through a network graph. |
| TA0006 — Credential Access | The model ties each edge’s success to how the attacker landed and what privilege they hold. | |
| Recommendation — Map dominant pivot paths to TA0008 and prioritize controls that reduce traversal probability. Use TA0006 to hunt for credential-driven paths that make lateral movement more likely. | ||
| CIS Controls v8 | CIS-5 — Account Management | Service accounts and privilege-bearing identities are central to the path model. |
| Recommendation — Apply CIS-5 to inventory and constrain accounts that create high-probability pivot routes. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article’s reachability logic depends on reducing the privilege carried across each hop. |
| Recommendation — Enforce AC-6 to shrink the permissions that make chained movement across assets possible. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Weighted reachability is driven by the permissions attached to remote and identity-linked paths. |
| Recommendation — Use PR.AA-05 to review entitlements that create the strongest traversal paths. | ||
Key terms
- Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
- Pivot Path: A pivot path is a sequence of systems, services, or identities an attacker can traverse to reach a target. It is useful for security analysis because it makes blast radius measurable and shows where segmentation or privilege reduction will have the biggest effect.
- Weighted Reachability: Weighted reachability is a way of estimating how likely an attacker is to reach a target by assigning probabilities to each path or hop. It is more realistic than counting connections alone because it reflects how controls, privilege, and route choice affect success.
- Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in practical terms. It helps security practitioners connect identity controls to the wider access paths that shape lateral movement.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org