Notifications
Clear all
Topic starter
10/07/2026 9:25 pm
TL;DR: 80% of servers are reachable from anywhere inside the network, 87% accept broad inbound RDP or SSH, and 43.2% of internal authentication still runs on NTLM, according to Zero Networks research analyzing 54 trillion activities across 312 enterprise environments. The exposure is not theoretical: internal trust is still giving attackers fast paths to move laterally once they land.
NHIMG editorial — based on content published by Zero Networks: Report 2026 Lateral Movement Exposure Report
By the numbers:
- Zero Networks analyzed 54 trillion activities across 312 live enterprise environments.
- 80% of enterprise servers are reachable from anywhere inside the network.
- 87% accept inbound RDP or SSH from broad internal sources.
Questions worth separating out
Q: What breaks when internal trust is too broad in enterprise networks?
A: When internal trust is too broad, a single compromise can become a lateral movement platform.
Q: Why do broad internal access paths increase breach severity so much?
A: Broad internal access paths increase breach severity because they let attackers convert one foothold into many reachable targets.
Q: How do security teams know whether lateral movement exposure is actually improving?
A: Teams should measure how many systems remain reachable from a single internal foothold, how many critical hosts accept broad RDP or SSH, and how much authentication still depends on legacy protocols.
Practitioner guidance
- Map internal reachability by privilege tier Inventory which servers, admin interfaces, and service paths are reachable from broad internal segments, then reduce exposure around high-value systems first.
- Eliminate legacy authentication where lateral reuse is possible Prioritise NTLM reduction on systems that can authenticate to critical infrastructure or privileged services, and replace it with stronger, modern authentication flows wherever compatibility allows.
- Constrain internal remote access protocols Restrict RDP and SSH to tightly scoped admin paths, remove broad internal source ranges, and require step-up controls for access to servers that can trigger downstream movement.
What's in the full report
Zero Networks' full report covers the operational detail this post intentionally leaves for the source:
- Benchmark breakdowns of server reachability and remote access exposure across live enterprise environments
- The 10-risk framework for lateral movement exposure and how each risk changes containment priorities
- Real-world attack scenarios that show how internal trust becomes business outage
- A first look at AI-Driven Lateral Movement and why it compresses breach timelines
👉 Read Zero Networks' report on lateral movement exposure and internal trust →
Lateral movement exposure: what internal trust gaps mean for defenders?
Explore further
10/07/2026 9:48 pm
Internal trust exposure is now a governance issue, not just a network design issue. When 80% of servers are reachable from anywhere inside the network, defenders are effectively relying on internal trust as a control. That is fragile because it assumes compromise stays local. In reality, attackers look for the easiest reuse path, and broad reachability gives them one. Practitioner conclusion: treat internal reachability as an access governance problem with board-level resilience implications.
A question worth separating out:
Q: Who is accountable when internal trust turns into a business outage?
A: Accountability sits across IAM, PAM, network engineering, and resilience leadership. Identity teams own privilege scope and authentication strength, infrastructure teams own segmentation and protocol exposure, and security leadership must treat lateral movement reduction as a measurable control objective, not an isolated tuning exercise.
👉 Read our full editorial: Internal trust is the real lateral movement exposure in enterprises
