Topic starter
11/07/2026 8:44 pm
TL;DR: 80% of organisations monitor hybrid communications and 77% monitor east-west traffic, yet almost 40% of that traffic still lacks enough context to be useful, according to Illumio’s 2025 Global Cloud Detection and Response Report. That makes visibility a weak control unless teams can explain why connections exist, not just that they exist; the real governance issue is context, because detection without decision quality still leaves lateral movement and alert fatigue intact.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Global Cloud Detection and Response Report: Q&A on the Human Side of Cloud Security Gaps”.
Key questions
Q: What fails when cloud visibility has no context?
A: Without context, visibility produces telemetry but not decisions.
Q: Why does missing context make lateral movement harder to detect?
A: Lateral movement hides inside ordinary internal communications.
Q: How can organisations reduce alert fatigue from cloud security tools?
A: Reduce alert fatigue by filtering findings through runtime evidence, business context, and actual execution paths.
Practitioner guidance
- Build traffic baselines with identity context Correlate east-west traffic with workload ownership, service purpose, and known dependencies so analysts can tell legitimate communication from suspicious movement.
- Tune detections around known-good internal paths Use expected communication maps to suppress routine flows and elevate deviations that indicate lateral movement, especially across hybrid environments.
- Automate containment for high-confidence anomalies Trigger isolation or quarantine when a context-rich detection exceeds your accepted threshold for suspicious internal movement.
Bottom line: Cloud teams may have visibility into hybrid and east-west traffic, but without context they still lack the information needed to make sound security decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:11 pm
Context gap is the real cloud detection control gap. Visibility is only the first layer of detection, and organisations that stop there are left with data rather than decisions. The report shows that many teams can see hybrid and east-west communications but still cannot determine which flows are expected. That creates a governance failure in which monitoring success is mistaken for control effectiveness, and practitioners should treat context enrichment as part of the control plane.
A few things that frame the scale:
- Valid account abuse was responsible for 35% of cloud-related incidents, according to CrowdStrike's 2025 Global Threat Report.
A question worth separating out:
Q: How should IAM and SOC teams govern internal cloud trust relationships?
A: They should treat service-to-service and workload-to-workload relationships as governed access paths, not background traffic. That means documenting expected communication, validating whether each path is still needed, and removing trust links that no longer have a clear business or operational purpose.
👉 Read our full editorial: Cloud detection gaps persist when visibility lacks context