Topic starter
10/07/2026 9:25 pm
TL;DR: 80% of servers are reachable from anywhere inside the network, 87% accept broad inbound RDP or SSH, and 43.2% of internal authentication still runs on NTLM, according to Zero Networks research analyzing 54 trillion activities across 312 enterprise environments. The exposure is not theoretical: internal trust is still giving attackers fast paths to move laterally once they land.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “2026 Lateral Movement Exposure Report”.
By the numbers:
- Zero Networks analyzed 54 trillion activities across 312 live enterprise environments.
- 80% of enterprise servers are reachable from anywhere inside the network.
- 87% accept inbound RDP or SSH from broad internal sources.
Key questions
Q: What breaks when internal trust is too broad in enterprise networks?
A: When internal trust is too broad, a single compromise can become a lateral movement platform.
Q: Why do legacy authentication protocols increase lateral movement risk?
A: They allow attackers to reuse captured authentication material instead of forcing a fresh, mutually verified login.
Q: How do security teams know if identity-based segmentation is actually working?
A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services.
Practitioner guidance
- Tighten east-west access paths Inventory which internal systems can reach sensitive servers, then remove broad any-to-any paths that are not required for operations.
- Reduce reliance on NTLM Identify systems still using NTLM for internal authentication and create a deprecation plan that includes higher-risk domains first.
- Restrict RDP and SSH to named sources Limit remote administration protocols to explicit management sources rather than broad internal ranges.
Bottom line: Internal trust can turn one compromised host into broad enterprise exposure when internal reach is left too open.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:48 pm
Internal trust is now a governance failure, not a network convenience. The article shows that broad east-west reach still exists across most enterprise environments, which means the default trust model inside many organisations is too permissive. That matters because attackers do not need to invent new privileges if the environment already grants them reachable paths. Practitioners should treat internal trust as a control surface, not an architectural leftover.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: What should defenders prioritise first when internal trust creates lateral movement exposure?
A: Start with the routes that allow the fastest spread: broad internal server reachability, unrestricted admin protocols, and legacy authentication dependencies. Those are the conditions that turn one compromise into many. After that, separate human, service, and administrative reach so one identity type cannot borrow another's access profile.
👉 Read our full editorial: Internal trust is the real lateral movement exposure in enterprises