Topic starter
10/07/2026 9:28 pm
TL;DR: Nearly 90% of organisations experienced a security incident involving lateral movement in the past year, according to a 2025 cloud detection and response report cited by Illumio. The article argues that internal traffic visibility, reachable ports, and shared onboarding of flow logs are the practical inputs needed to narrow blast radius and contain compromise faster.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “3 Ways to Get the Most Out of Your Illumio Insights Free Trial”.
By the numbers:
- Nearly 90% of organizations experienced a security incident involving lateral movement in the past year.
Key questions
Q: What breaks when internal traffic visibility is missing in hybrid cloud?
A: Without internal traffic visibility, teams usually know the perimeter but not the paths an attacker can take after entry.
Q: Why does lateral movement become harder to stop in hybrid environments?
A: Hybrid environments mix cloud, on-premises, and shared service paths, which makes internal reachability difficult to model from one control point.
Q: How do security teams know whether containment is actually working?
A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded.
Practitioner guidance
- Ingest internal flow logs first Connect representative AWS, Azure, GCP, and on-premises flow sources so you can see real communication paths, unexpected flows, and exposure points before tuning policy.
- Map reachable ports and overexposed workloads Build a working inventory of workloads with unnecessary listening ports or broad internal reachability, then use that view to prioritise containment.
- Tie detection to quarantine actions Ensure suspicious lateral traffic can trigger immediate isolation of the affected workload or flow, with segmentation rules already defined.
Bottom line: Hybrid cloud lateral movement persists because internal reachability is often less visible than external exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:50 pm
Internal reachability is the governing problem in hybrid cloud containment. Perimeter-centric thinking fails once an attacker is inside, because the decisive question becomes which workloads can still be reached east-west. That makes blast radius a visibility problem as much as a policy problem. Practitioners should treat internal network pathing as part of identity and access governance, not as a separate networking concern.
A question worth separating out:
Q: What is the difference between seeing network traffic and containing lateral movement?
A: Seeing traffic is an observability function, while containing lateral movement is an enforcement function. Visibility tells you where workloads talk and which ports are reachable; containment limits what those systems can reach once risk is detected. Mature programmes need both, because observation without isolation still leaves the attacker room to move.
👉 Read our full editorial: Lateral movement visibility and containment gaps in hybrid cloud