Topic starter
11/07/2026 8:30 pm
TL;DR: Lateral movement remains central to modern breaches in IoT and OT environments, with Elisity citing IBM’s $4.88 million global average breach cost and research showing 60% of successful breaches involve lateral movement, while attackers dwell for 280 days on average before detection. The problem is not just detection; it is whether segmentation, access control, and response coordination actually work under realistic pressure.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Cyber Resilience Best Practices: Tabletop Exercises for Testing Lateral Movement Prevention”.
By the numbers:
- The global average cost of a data breach reached $4.88 million, according to IBM's 2024 Cost of a Data Breach Report cited by Elisity.
- Research from Elisity's Microsegmentation Buyer's Guide 2025 indicates that 60% of successful breaches now involve lateral movement.
- Elisity says attackers dwell in networks for an average of 280 days before detection.
Key questions
Q: What breaks when IoT devices are not segmented from core systems?
A: When IoT devices are not segmented, compromise of one weak endpoint can become a bridge into business systems, identity services, or sensitive data stores.
Q: Why does lateral movement create such a high risk for manufacturing and healthcare networks?
A: Lateral movement is dangerous because a single foothold can turn into broad access across connected systems, including OT controllers and medical devices that are hard to patch or monitor.
Q: What are the signs that lateral movement controls are not working well enough?
A: Weak lateral movement controls usually show up as unusual authentication patterns, unexpected process creation, and network traffic between systems that rarely communicate.
Practitioner guidance
- Define realistic pivot paths Build tabletop scenarios around the exact paths attackers would use in your environment, such as IT-to-OT pivots, vendor remote access, and compromised IoT devices.
- Test containment authority Document who can isolate an engineering workstation, vendor connection, or production segment, and make that authority part of the exercise decisions.
- Validate segmentation under pressure Use the exercise to confirm that identity-based microsegmentation and least privilege access actually block movement between mixed IT and OT zones.
Bottom line: IoT and OT resilience depends on whether segmentation and access controls can stop an attacker after the first foothold, not just whether the initial alert fires.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:59 pm
Lateral movement is a governance failure before it is a detection failure: In IoT and OT environments, the decisive question is whether network and identity boundaries still hold after the first foothold. If a contractor login, dual-homed workstation, or exposed device can pivot into production systems, the programme has treated segmentation as architecture rather than as enforceable access governance. The practitioner conclusion is simple: containment has to be proven under realistic movement paths, not assumed from the diagram.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: Should organisations use tabletop exercises or live red team testing for IoT and OT resilience?
A: They should use both, but for different purposes. Red and purple team testing validates adversary technique and control gaps in depth, while tabletops validate whether people, process, and authority can coordinate containment safely across IT and OT. The better programme combines both, because technical blocking without response coordination still leaves a large blast radius.
👉 Read our full editorial: Lateral movement tabletop exercises expose IoT and OT resilience gaps