Topic starter
10/07/2026 9:28 pm
TL;DR: 71% of enterprise risk flows through SMB, RDP, WinRM, and RPC, according to Zero Networks’ analysis of 3.4 million threat activities, while CrowdStrike says malware-free attacks account for 82% of cyber incidents. The control problem is no longer visibility alone. It is shrinking the number of trusted internal paths attackers can reuse.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “The 4 Protocols Driving Enterprise Risk in 2026: Managing SMB, RDP, WinRM, & RPC Traffic”.
By the numbers:
- Zero Networks’ analysis of 3.4 million threat activities found that 71% of enterprise risk flows through SMB, RDP, WinRM, and RPC.
Key questions
Q: What breaks when SMB, RDP, WinRM, and RPC are left broadly open inside the network?
A: They create reusable lateral movement routes that let a single foothold expand into wider compromise.
Q: Why do trusted administrative protocols increase blast radius after initial compromise?
A: Because they turn a small compromise into an authenticated pathway across many systems.
Q: What are the signs that internal access controls are failing to contain lateral movement?
A: Look for protocols that are broadly permitted across subnets, remote admin rights that are shared too widely, and service accounts that can access many hosts without task-specific limits.
Practitioner guidance
- Tighten east-west protocol allowances Replace broad internal SMB, RDP, WinRM, and RPC permissions with explicit host-to-host and role-to-role rules based on real operational need.
- Enforce just-in-time admin access Require time-bound, approval-backed elevation for remote administration so standing credentials cannot be reused freely across systems.
- Segment service accounts from human admin paths Separate automation identities, admin accounts, and user access so a compromised service account cannot inherit the same lateral movement routes.
Bottom line: The core risk is not exotic exploitation but overexposed internal protocols that attackers can reuse after gaining a foothold.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:50 pm
Trusted admin protocols are now a governance problem, not just a network design problem. SMB, RDP, WinRM, and RPC concentrate risk because they encode operational trust into the fabric of the environment. When those channels stay broadly open, identity controls lose precision and attack paths remain reusable. Practitioners should treat protocol reachability as an access-governance issue, not a pure connectivity choice.
A question worth separating out:
Q: How should teams balance operational continuity with tighter control of admin traffic?
A: Use identity-aware containment rather than blanket blocking. The goal is to preserve necessary admin work while removing implicit trust, so approved systems, approved users, and approved sessions can proceed and everything else is denied by default. That approach reduces disruption because it narrows the allowed path instead of trying to stop administration altogether.
👉 Read our full editorial: Enterprise risk now concentrates in SMB, RDP, WinRM, and RPC