Topic starter
10/07/2026 9:25 pm
TL;DR: 80% of enterprise servers are reachable from anywhere inside the network, while attackers can begin moving laterally in as little as 27 seconds, according to Zero Networks’ analysis of 54 trillion activities across 300+ enterprise environments. Detection alone cannot keep pace with machine-speed breakout, so containment must shift to identity and network enforcement.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “10 Common Lateral Movement Techniques and How to Stop Them”.
By the numbers:
- 80% of enterprise servers are reachable from anywhere inside the network, according to Zero Networks' analysis.
- Attackers can begin moving laterally in as little as 27 seconds, according to Zero Networks' analysis.
Key questions
Q: What breaks when an attacker can move laterally with valid credentials?
A: The failure is that internal authentication no longer proves legitimacy.
Q: Why do valid accounts and native tools make lateral movement so hard to stop?
A: They collapse the difference between administrator activity and attacker activity.
Q: How do security teams know if lateral movement defences are actually working?
A: Teams should test whether one compromised identity can reach adjacent systems, SaaS apps, or production zones that it should not access.
Practitioner guidance
- Map east-west access paths Inventory which servers, management protocols, and service identities can reach critical assets without additional challenge, then remove default internal reach that is not explicitly required.
- Enforce identity-based access on privileged protocols Require verified identity and purpose for RDP, WinRM, SMB, SSH, and related administration paths instead of allowing access based only on network location.
- Segment high-value systems into smaller trust zones Use microsegmentation to break broad east-west connectivity so a single compromised account cannot pivot from one server class to another with the same credentials.
Bottom line: Lateral movement succeeds when internal trust is broader than the identity controls governing it, not simply when perimeter defenses fail.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:47 pm
Detection is no longer the primary containment control for lateral movement: The article's core lesson is that internal breakout now happens too quickly for alert-driven response to be the first line of defense. When attackers can move laterally in seconds and hide inside valid credentials or native tools, containment has to occur before or at the point of access, not after an alert fires. Practitioners should treat east-west enforcement as a control objective, not an optimisation.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: What should teams do when their environment still allows broad internal server access?
A: Treat that as a containment problem, not just a configuration issue. Restrict communication between workloads, enforce identity-based approval for privileged connections, and remove standing permissions that let one account pivot freely across the environment. Without those guardrails, lateral movement remains a default path rather than an exception.
👉 Read our full editorial: Lateral movement techniques expose the limits of detection-only defense