Topic starter
02/08/2026 11:52 am
TL;DR: 90% of organisations saw lateral movement in their last breach, and D3 says isolated alerts still slow response to that sequence. Correlation across identity, endpoint, network, and cloud is what lets defenders assemble the path before an attacker pivots again.
Editorial analysis by NHI Mgmt Group, based on content published by D3: “Your Lateral Movement Detection Tools Are Missing 90% of Attacks. Here’s Why.”.
By the numbers:
- 90% of organisations experienced lateral movement in their last breach.
- The average eCrime attacker achieves a complete breakout in just 29 minutes.
Key questions
Q: Why do valid credentials make lateral movement so hard to detect?
A: Valid credentials let attackers appear to be normal users or administrators, so the traffic often blends into routine operations.
Q: How do security teams know if attack path analysis is working?
A: They should see fewer high-priority findings with unclear reachability and more fixes focused on routes that connect to privileged access or sensitive data.
Q: What breaks when lateral movement detection tools only see isolated alerts?
A: Teams lose the attack sequence.
Practitioner guidance
- Correlate identity and endpoint signals in one workflow Join authentication, credential use, process, and remote-access events so analysts can see whether a login, RDP session, or PowerShell action is part of a larger movement path.
- Prioritise malware-free lateral movement detections Tune detection content to flag legitimate tools used in abnormal sequences, especially cached credential reuse, internal pivoting, and unexpected privilege transitions.
- Measure time to attack-path context Track how long it takes your SOC to move from first alert to a usable path that identifies entry point, pivots, affected systems, and likely data access.
Bottom line: Traditional lateral movement detection is losing effectiveness because it produces isolated signals faster than analysts can assemble them into an attack path.
Glossary terms: Lateral Movement, Attack path discovery, Attack correlation, Malware-Free Intrusion
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:01 pm
Attack path correlation is now the decisive control gap: the issue is no longer whether a tool can flag one suspicious event. The failure is that most stacks still cannot connect identity, endpoint, network, and cloud evidence quickly enough to tell the attacker’s story. For practitioners, the governance question is whether investigations are built to reconstruct sequences or merely collect alerts.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: What should teams do immediately when lateral movement is detected?
A: Teams should isolate the communication path before the session completes its next hop, then confirm which workloads, identities, and services were reachable from that path. The first goal is to stop further spread, not to reconstruct every detail before acting.
👉 Read our full editorial: Lateral movement detection is too slow for modern attack paths