Topic starter
11/07/2026 8:24 pm
TL;DR: A simple complement-rule probability model shows how lateral movement becomes easier to estimate when defenders treat each pivot path as a graph, then combine sequential hops and alternate routes mathematically, according to ColorTokens. The lesson is that microsegmentation decisions should focus on reducing the highest-probability pivot paths, not just shrinking the number of possible connections.
Editorial analysis by NHI Mgmt Group, based on content published by ColorTokens: “License Plates to Lateral Movement: How a School Probability Trick Helps Model It”.
By the numbers:
- P(at least one repeat) = 1 − (9×8×7) / 10³ = 0.496, almost 50%.
Key questions
A: Security teams should start with identity based policy design, not broad network redrawing.
Q: Why do some lateral movement paths matter more than others?
A: Because lateral movement is not just a question of whether a route exists.
Q: What are the signs that segmentation is failing to contain lateral movement?
A: The clearest signal is when one or two access paths dominate the reachability of critical assets even though the environment appears segmented.
Practitioner guidance
- Map pivot paths as weighted edges Represent RDP, SSH, WinRM, SMB, and service-account flows as probabilities so you can compare routes by reachability, not just presence.
- Prioritise controls on the highest-probability hops Reduce the likelihood of the strongest remote-management and identity-linked edges first, because those changes produce the largest drop in overall reachability.
- Model alternate routes separately from chained hops Treat multiple entry options as a union problem and multi-step exploitation as a sequence problem, then combine them to estimate total spread potential.
Bottom line: The article frames lateral movement as a weighted graph problem, where the likelihood of each hop matters more than the mere presence of connectivity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:54 pm
Path probability is a better control lens than connection count: defenders routinely over-focus on reducing the number of possible routes, when the real issue is which routes remain most likely to succeed. A graph with fewer edges can still be highly traversable if a small number of edges carry high pivot potential. For practitioners, this means microsegmentation design should be driven by weighted reachability, not cosmetic segmentation density.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: How can teams decide whether a segmentation change is actually working?
A: Recalculate the probability of reaching critical nodes before and after the change. If the weighted reachability drops sharply on the most likely pivot paths, the change is reducing lateral movement in a way that matters operationally.
👉 Read our full editorial: License plate probability shows why lateral movement is hard to model