Notifications
Clear all
Topic starter
10/07/2026 9:27 pm
TL;DR: Lateral movement can turn a single compromise into enterprise-wide impact in under 30 seconds, and Zero Networks cites analysis of 5.4 trillion activities across 312 enterprise environments to show that excessive reachability, overprivileged service accounts, and weak east-west visibility are the core enablers. The governance lesson is blunt: prevention, not alerting, has to carry the load when attackers can already live off the land.
NHIMG editorial — based on content published by Zero Networks: How to Prevent Lateral Movement
By the numbers:
- A single compromised system exposes 85% of the network within one hop.
- Attackers can begin moving laterally in as little as 27 seconds.
- Zero Networks analysed 5.4 trillion activities across 312 enterprise environments.
Questions worth separating out
Q: What breaks when lateral movement controls are too weak?
A: When lateral movement controls are too weak, one compromised identity can pivot into many systems, turning a local incident into a broad breach.
Q: Why does lateral movement remain so damaging in modern networks?
A: Lateral movement remains damaging because modern environments still contain exposed admin paths, service accounts with excessive privileges, and flat internal trust.
Q: How do teams know if microsegmentation is actually working?
A: Microsegmentation is working when a compromised workload cannot reach anything outside its explicit policy boundary.
Practitioner guidance
- Map internal reachability by identity type Inventory which users, service accounts, and workload identities can reach critical systems across east-west paths.
- Segment high-value systems with explicit allow rules Apply microsegmentation to workloads, applications, and admin paths so communication is permitted only where there is an explicit business need.
- Reduce standing privilege on internal admin paths Remove always-on internal administrative access where possible and enforce just-in-time elevation for sensitive systems.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- Zero Networks' per-control breakdown of microsegmentation deployment challenges and why implementations stall at scale
- Its specific examples of AI-driven lateral movement and the identity conditions that make those pivots possible
- The vendor's prevention stack for blocking east-west movement across endpoints, workloads, and privileged ports
- Its incident references and practitioner-oriented discussion of where detection stops being enough
👉 Read Zero Networks' analysis of lateral movement risks and prevention strategies →
Lateral movement and microsegmentation: are your controls keeping up?
Explore further
10/07/2026 9:49 pm
Lateral movement is an identity governance problem before it is a network problem. The article is right to emphasise microsegmentation, but the deeper issue is that broad east-west reach usually reflects unmanaged identity scope, not only bad routing. When service accounts, admin paths, and internal trust are overly permissive, the attacker’s path is already partly authorised. Practitioners should read lateral movement as a symptom of weak governance over what identities can reach once inside.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to the 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: Who is accountable when lateral movement leads to a breach?
A: Accountability sits with the teams that own internal access, privileged identity governance, and containment controls, not only with detection operations. If service accounts, admin pathways, or workload identities can move freely across the environment, the governance failure is structural. A breach caused by lateral movement usually reflects shared ownership gaps across IAM, PAM, and network security.
👉 Read our full editorial: Lateral movement is the control gap behind fast breach spread
