Topic starter
10/07/2026 9:09 pm
TL;DR: Lateral movement appears in nearly 90% of attacks while 82% of organisations still trust perimeter detection, according to Illumio citing The 2025 Global Cloud Detection and Response Report. Static firewall rules and fragmented policy governance leave modern hybrid environments exposed once attackers get inside.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Illumio + FireMon: Closing the Gaps Firewalls Can’t See”.
By the numbers:
- Nearly 90% of organizations faced a cyberattack that involved lateral movement in the past year.
- 82% still feel confident in their ability to detect threats at the perimeter.
Key questions
Q: What breaks when security relies on firewalls alone against lateral movement?
A: Firewall-only security breaks when attackers already have a foothold inside the environment.
Q: Why does lateral movement remain such a serious risk in hybrid environments?
A: Hybrid and multi-cloud environments change too quickly for static network rules to stay accurate.
Q: What are the signs that segmentation is failing in a real environment?
A: Segmentation is failing when a compromise in one zone quickly reaches other networks, critical services, or shared infrastructure that should have been separated.
Practitioner guidance
- Map east-west traffic paths Identify which workloads talk to each other across hybrid and multi-cloud environments, then flag any communication that is not required for the business process.
- Enforce workload-level segmentation Use labels such as application, role, and environment to define approved workload-to-workload communication and block everything else by default.
- Unify firewall and segmentation policy governance Create a single policy view that shows intended rules, enforced rules, and validation status so drift and misconfiguration are visible early.
Bottom line: Lateral movement turns internal reachability into the main security problem once an attacker gets inside.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
Firewall-only security is a legacy control model, not a containment strategy. Perimeter filtering still has value, but it is structurally weak once an attacker already holds internal access. In hybrid environments, the governance problem is not just blocking entry, but constraining post-entry movement across workloads and cloud segments. Practitioners should treat east-west enforcement as a core security boundary, not an optional add-on.
A question worth separating out:
Q: How should teams govern internal access when workloads change frequently?
A: Teams should govern internal access by combining segmentation, workload context, and continuous validation. The practical test is whether approved communication still holds after redeployment or scaling events. If policy depends on static network conditions, it will age faster than the environment and fail to contain internal movement.
👉 Read our full editorial: Firewall-only security fails when lateral movement reaches inside