Topic starter
10/07/2026 9:14 pm
TL;DR: Hybrid cloud environments let attackers enter through stolen credentials, exposed services, or misconfigurations and then move laterally faster than packet-focused NDR can reliably contain, according to Illumio. The practical shift is from retrospective visibility to real-time communication control, because investigation without containment leaves too much attacker dwell time.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “NDR vs. Illumio Insights: Detecting and Containing Lateral Movement in the Hybrid Cloud”.
Key questions
Q: What breaks when NDR is used as the only control for hybrid cloud lateral movement?
A: NDR breaks when it is treated as a detection-only control, because the attacker can already move through trusted east-west paths before analysts finish reconstruction.
Q: Why does stolen credential access make lateral movement harder to detect in hybrid cloud?
A: Stolen credentials make movement harder to detect because the traffic may look legitimate once the attacker is inside.
Q: How should security teams stop lateral movement after an initial foothold?
A: Security teams should reduce the number of internal paths a compromised identity can use, not just watch for suspicious traffic.
Practitioner guidance
- Map east-west traffic paths across hybrid workloads Identify which workloads, services, and cloud segments can communicate today, then flag any path that an attacker could abuse after initial compromise.
- Separate detection from containment decisions Use detections to prioritise risk, but require an enforceable control path that can block or isolate suspicious communication without waiting for manual investigation.
- Review cloud coverage assumptions for NDR Check where your current tooling depends on flow logs rather than packet inspection, especially in clouds and container platforms where visibility is thinner.
Bottom line: Hybrid cloud lateral movement exposes a structural weakness in detection-first network tooling, because attackers can move through legitimate access paths before analysts finish reconstruction.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:36 pm
Hybrid cloud has created a visibility-to-containment gap: traditional NDR still helps with reconstruction, but it is no longer enough when attackers can use valid access paths to traverse cloud and on-premises estates in minutes. The underlying issue is not alert volume alone, but the mismatch between historical detection and live movement. Practitioners should treat containment as the primary control objective.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: When is packet-focused NDR still useful, and when is it no longer enough?
A: Packet-focused NDR is still useful for forensic analysis, regulated environments, and networks with stable traffic patterns. It is no longer enough when workloads are ephemeral, cloud flow logs replace packet detail, and attackers can spread laterally faster than investigators can reconstruct events. In those cases, real-time containment becomes the priority.
👉 Read our full editorial: Hybrid cloud lateral movement is exposing NDR limits