Topic starter
05/07/2026 10:44 pm
TL;DR: Attackers often use legitimate credentials, orphaned accounts, shared service access, and SaaS integrations to move laterally across environments, according to Zluri. The breach path is usually created by governance decisions that were never revisited, which makes access scope and review cadence the real security variables.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Lateral Movement in Identity Security: How Attackers Traverse What Your Governance Program Left Open”.
Key questions
Q: What breaks when identity governance leaves too many lateral movement paths open?
A: When identity governance leaves too many lateral movement paths open, a single compromised account can reach far more systems than its role should allow.
Q: Why do identity-based lateral movement attacks remain hard to detect in SaaS-heavy environments?
A: Because the activity often looks legitimate to both application logs and identity monitoring.
Q: What do security teams get wrong about lateral movement prevention?
A: They often treat lateral movement as a detection problem when it is also a design problem.
Practitioner guidance
- Map the identity entitlement graph Build a view of which users, service accounts, and integrations can reach which systems today, including cross-application links and shared credentials.
- Shorten access review cycles Replace annual-only review rhythms with review cadences that reflect how quickly role changes, SaaS adoption, and temporary access accumulate.
- Inventory shadow SaaS and integrations Discover applications outside the SSO catalog and document their OAuth grants, API links, and service-account dependencies before they become hidden pivot points.
Bottom line: Identity-based lateral movement succeeds because legitimate access paths often outlast the business need that created them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 10:47 pm
Identity-based lateral movement is an entitlement-graph problem, not a perimeter problem. The article shows that attackers are often just following access paths that governance already created. That means the real question is not how to spot every move, but how many reachable paths a compromised identity already has. For practitioners, the entitlement graph is the unit of security analysis.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: How should IAM teams reduce lateral movement risk across users and service accounts?
A: They should enforce current-function access, remove stale cross-domain permissions, and review application-to-application connections alongside human access. Service accounts and integrations need the same governance discipline as user accounts because they often form the bridges attackers use to move between systems. Least privilege has to cover the whole entitlement graph, not just the login layer.
👉 Read our full editorial: Identity-based lateral movement is the real breach accelerator