Notifications
Clear all
Topic starter
10/07/2026 9:14 pm
TL;DR: Hybrid cloud environments let attackers enter through stolen credentials, exposed services, or misconfigurations and then move laterally faster than packet-focused NDR can reliably contain, according to Illumio. The practical shift is from retrospective visibility to real-time communication control, because investigation without containment leaves too much attacker dwell time.
NHIMG editorial — based on content published by Illumio: NDR vs. Illumio Insights: Detecting and Containing Lateral Movement in the Hybrid Cloud
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, meaning organisations failing to scope AI access properly are 4.5x more likely to experience a security incident.
Questions worth separating out
Q: What breaks when network detection only works after the fact in hybrid cloud environments?
A: When detection is retrospective, attackers can use the time gap to expand access laterally before defenders intervene.
Q: Why do exposed credentials and service accounts make lateral movement harder to stop?
A: Because credentials turn a single foothold into legitimate-looking access across systems.
Q: How do security teams know if containment is actually working in hybrid environments?
A: Look for reductions in reachable paths, faster isolation of compromised workloads, and fewer communication channels left open after an alert.
Practitioner guidance
- Map east-west communication baselines Baseline normal workload-to-workload traffic across cloud, container, and on-premises environments so unexpected lateral paths can be flagged before they become a breach.
- Tie containment actions to segmentation policy Pre-authorise isolation steps for compromised workloads, high-risk subnets, and management-plane access so analysts can block risky communication paths without waiting for manual design decisions.
- Review credential-bearing identities for lateral reach Inventory service accounts, API tokens, and other non-human identities that can move between environments, then remove unnecessary reach into adjacent systems.
What's in the full article
Illumio's full blog covers the operational detail this post intentionally leaves for the source:
- How Illumio Insights maps live communication patterns across cloud and on-premises environments
- How the Insights Agent prioritises detections and maps them to MITRE ATT&CK techniques
- How segmentation is used to isolate compromised workloads and block risky communication paths
- Why the vendor argues packet capture is still useful in regulated environments, but less suited to cloud-native estates
👉 Read Illumio’s analysis of NDR limits and hybrid cloud lateral movement →
Hybrid cloud lateral movement: what NDR teams need to know?
Explore further
10/07/2026 9:36 pm
Hybrid cloud has turned lateral movement into an identity problem disguised as a network problem. The article is right to focus on communication patterns, but the underlying failure often starts with overbroad credentials, exposed services, or access paths that were never scoped tightly enough. Once a foothold exists, segmentation becomes the last line of defense rather than the first governance control. Practitioners should treat workload access and network containment as a single policy domain.
A question worth separating out:
Q: What should teams do when lateral movement is detected before the attacker expands access?
A: Block the communication path, isolate the compromised workload, and revoke any credentials that could extend the foothold. The goal is to stop expansion before the attacker reaches adjacent systems, management planes, or data-rich services.
👉 Read our full editorial: Hybrid cloud lateral movement is exposing NDR limits
