Topic starter
11/07/2026 1:56 pm
TL;DR: Lateral movement turns an initial foothold into enterprise-wide compromise faster than many teams can react, with CrowdStrike cited by Elisity reporting a 29-minute average breakout time, 82% malware-free detections, and 90% of ransomware breaches involving RDP abuse. The control gap is east-west access, not detection alone: if internal paths stay open, a compromised identity can spread the breach.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “9 Lateral Movement Techniques Attackers Use (and How to Stop Them)”.
By the numbers:
- The average eCrime breakout time from initial access to lateral movement is 29 minutes, 65% faster than the prior year, according to CrowdStrike 2026 Global Threat Report cited by Elisity.
- 82% of detections are malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike 2026 Global Threat Report cited by Elisity.
- 90% of ransomware breaches involve RDP abuse, according to Sophos 2024 Active Adversary Report cited by Elisity.
Key questions
Q: What breaks when internal access paths stay open after an initial compromise?
A: Blast radius grows because the attacker can pivot from the first foothold into other systems, credentials, and trust zones.
Q: Why do valid credentials still create lateral movement risk in segmented environments?
A: Valid credentials only stay low-risk when their reach is tightly scoped.
Q: How do security teams know if lateral movement defences are actually working?
A: Teams should test whether one compromised identity can reach adjacent systems, SaaS apps, or production zones that it should not access.
Practitioner guidance
- Map east-west attack paths first Inventory which endpoints, subnets, and admin tiers can currently reach one another over SMB, RDP, WMI, SSH, and similar administrative channels.
- Restrict remote administration to approved management endpoints Allow RDP, PsExec-style management, and similar remote admin flows only from designated admin workstations or jump hosts.
- Constrain service account destination scope Review service accounts, scheduled tasks, and application identities to ensure they can reach only the systems and protocols required for their function.
Bottom line: Lateral movement is the stage where many compromises become enterprise incidents, because it lets attackers turn one foothold into a wider spread event.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:07 pm
East-west trust is the real breach multiplier: The article shows that initial access is often survivable, but lateral movement is what turns a contained incident into an enterprise event. That is a network governance problem as much as an IAM problem, because the attacker succeeds when internal paths remain broadly open. Practitioners should treat east-west reachability as a first-class control surface, not a side effect of segmentation.
A few things that frame the scale:
- 74% of organizations report identity-related breaches, and privileged access is a leading cause of lateral movement.
A question worth separating out:
Q: Should organisations prioritise microsegmentation before tightening credential hygiene?
A: They should do both, but segmentation often delivers the faster containment gain. Password rotation and privileged access cleanup reduce how credentials are abused, while network restriction limits how far abuse can go once it happens. In flat networks, improved identity hygiene alone does not stop lateral spread.
👉 Read our full editorial: Lateral movement is the breach multiplier IAM teams still miss