Topic starter
02/08/2026 11:52 am
TL;DR: Modern attackers complete breakout sequences in 29 minutes on average, while many organisations still face 70-minute investigation timelines and 56-minute SOC delays, according to CrowdStrike’s 2026 Global Threat Report and D3’s analysis. The gap is no longer about seeing alerts, but correlating identity, endpoint, network, and cloud evidence fast enough to contain the full attack path.
Editorial analysis by NHI Mgmt Group, based on content published by D3: “Your Lateral Movement Detection Tools Are Missing 90% of Attacks. Here’s Why.”.
By the numbers:
- 90% of organisations experienced lateral movement in their last breach.
- The average eCrime attacker achieves a complete breakout in just 29 minutes.
Key questions
Q: What breaks when lateral movement detection tools only see isolated alerts?
A: Teams lose the attack sequence.
Q: Why do valid credentials make lateral movement so hard to detect?
A: Valid credentials let attackers appear to be normal users or administrators, so the traffic often blends into routine operations.
Q: How do security teams know if attack path analysis is working?
A: They should see fewer high-priority findings with unclear reachability and more fixes focused on routes that connect to privileged access or sensitive data.
Practitioner guidance
- Correlate identity and endpoint signals in one workflow Join authentication, credential use, process, and remote-access events so analysts can see whether a login, RDP session, or PowerShell action is part of a larger movement path.
- Prioritise malware-free lateral movement detections Tune detection content to flag legitimate tools used in abnormal sequences, especially cached credential reuse, internal pivoting, and unexpected privilege transitions.
- Measure time to attack-path context Track how long it takes your SOC to move from first alert to a usable path that identifies entry point, pivots, affected systems, and likely data access.
Bottom line: Traditional lateral movement detection is losing effectiveness because it produces isolated signals faster than analysts can assemble them into an attack path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:01 pm
Attack path correlation is now the decisive control gap: the issue is no longer whether a tool can flag one suspicious event. The failure is that most stacks still cannot connect identity, endpoint, network, and cloud evidence quickly enough to tell the attacker’s story. For practitioners, the governance question is whether investigations are built to reconstruct sequences or merely collect alerts.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: What should teams do immediately when lateral movement is detected?
A: Teams should isolate the communication path before the session completes its next hop, then confirm which workloads, identities, and services were reachable from that path. The first goal is to stop further spread, not to reconstruct every detail before acting.
👉 Read our full editorial: Lateral movement detection is too slow for modern attack paths