Notifications
Clear all
Topic starter
10/07/2026 9:28 pm
TL;DR: Breaches are accelerating faster than many SOCs can react, with CrowdStrike reporting average eCrime breakout time at 29 minutes in 2025 and a fastest case of 27 seconds. The operational gap is no longer detection quality but whether organisations can contain lateral movement fast enough to keep critical services running.
NHIMG editorial — based on content published by ColorTokens: You Have an EDR. Make Your Microsegmentation Agentless. Be Breach Ready
By the numbers:
- The average eCrime breakout time in 2025 dropped to just 29 minutes, a 65% increase in speed from the previous year.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
Questions worth separating out
Q: What fails when EDR is the only control stopping lateral movement?
A: EDR can detect malicious behaviour, but by itself it does not stop an attacker from using trusted internal paths to move elsewhere.
Q: Why do flat networks increase the impact of endpoint compromise?
A: Flat networks preserve too many internal trust paths after the first host is compromised.
Q: How do security teams know whether containment controls are actually working?
A: They should measure whether a compromised host can still reach critical assets after isolation triggers fire.
Practitioner guidance
- Map post-compromise movement paths Identify which systems a compromised endpoint, workload, or service account can still reach after an EDR alert.
- Tie EDR alerts to containment workflows Define automatic isolation actions that can narrow communication for the affected host or segment without shutting down the entire environment.
- Revalidate segmentation against live application flows Run regular flow discovery and policy simulation to confirm that segmentation still matches current dependencies.
What's in the full article
ColorTokens' full post covers the operational detail this post intentionally leaves for the source:
- How the vendor positions EDR-to-segmentation integration across CrowdStrike, Microsoft Defender, and SentinelOne deployments.
- The step-by-step breach readiness timeline the article proposes for discovery, policy generation, enforcement, and validation.
- The assessment workflow the vendor recommends for mapping lateral movement and identifying unsegmented critical assets.
- The article's specific framing for board-level recovery, containment, and business continuity conversations.
👉 Read ColorTokens' analysis of EDR, microsegmentation, and breach readiness →
EDR and microsegmentation: is containment finally the missing layer?
Explore further
10/07/2026 9:50 pm
EDR without segmentation is a detection layer, not a survivability control. The article correctly identifies the gap between seeing an intrusion and constraining what the intruder can still reach. That gap is now the decisive failure mode in fast-moving breaches because attackers do not wait for SOC workflows to complete. Practitioners should treat containment as a separate control objective, not as an implied outcome of endpoint visibility.
A question worth separating out:
Q: What should organisations do when an attacker bypasses endpoint detection?
A: They should isolate the affected segment before the attacker completes lateral movement, while preserving critical business services that are not involved. The goal is selective containment, not a full shutdown. Organisations should predefine response playbooks, test them against EDR alerts, and ensure the network can constrain communication fast enough to keep essential operations available.
👉 Read our full editorial: EDR alone does not deliver breach readiness without containment
