Vertical Movement

How vertical movement works

Vertical movement is a privilege-escalation pattern inside an environment. Instead of spreading broadly across equal-access systems, the attacker tries to step upward from a lower-privilege account into an administrator, service account, or other more powerful identity so they can reach protected functions and higher-value data.

That upward step can happen through stolen credentials, reused passwords, weak delegation boundaries, exposed secrets, or misconfigurations that make a higher-privilege context easier to assume than intended. The important feature is not the path itself, but the increase in authority and the wider trust zone that comes with it.

Why vertical movement is dangerous

Once an attacker reaches a higher-privilege account, the impact usually expands quickly. A single compromised admin or service account can expose configuration controls, sensitive records, security tooling, or further credentials that were never available to the original foothold. MITRE ATT&CK Enterprise Matrix is a useful reference for understanding how credential access, privilege escalation, and lateral movement combine into a full attack chain.

Vertical movement is especially dangerous because defenders often treat privileged accounts as trusted once authentication succeeds. That assumption can fail when the same account is reachable from a weak workstation, a phished session, a leaked secret, or an overly broad delegation path. In those cases, the attacker does not need to “break in” again, they only need to climb.

How defenders spot exposure

Exposure checks start with understanding where privileged accounts exist, who can reach them, and whether lower-trust systems can invoke them directly. Review account inventory, role assignments, credential storage, and any path that lets a standard user, script, or application inherit elevated authority. Access-control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant here because it ties privilege control to accountable authentication, authorization, and auditability.

Detection also depends on knowing what “normal” privileged use looks like. Unusual elevation attempts, new admin sessions from non-admin endpoints, unexpected token use, or service accounts operating outside their usual scope are all signs that vertical movement may be underway. ZT principles are helpful here because they reduce implicit trust and force explicit verification of each access decision.

Containment, recovery, and identity impact

When vertical movement is suspected or confirmed, the response is not only about the compromised endpoint. It is about every credential, session, or delegated access path that might now be exposed because the attacker reached a higher-privilege context. For environments built on non-human credentials, the OWASP Non-Human Identity Top 10 is a useful lens for secret leakage, overprivilege, and long-lived access material.

Recovery should treat the elevated account as potentially toxic until proven otherwise. That often means revoking active sessions, rotating exposed credentials, reviewing privilege grants, and checking whether the attacker used the elevated identity to create persistence or access additional systems. If the privileged account can impersonate other identities or mint new tokens, the blast radius can extend well beyond the original compromise.

Risk and Threat Considerations

Vertical movement matters because privilege is a force multiplier. A compromise that begins with a low-value account can become a domain-wide or environment-wide incident if the attacker finds a path into an admin, service, or automation identity.

Failure mechanism: The attacker abuses weak credential hygiene, excessive delegation, or misconfigured privilege boundaries to assume a more powerful identity without triggering strong resistance.

Impact: The attacker can expand access, disable controls, access sensitive resources, and use the elevated account to establish persistence or move into other high-value systems.

Practitioner Guidance

Why practitioners should care: Vertical movement is often the point where a contained intrusion becomes a serious breach, because the attacker’s permissions, reach, and ability to hide all increase at once. Treat any path from low privilege to high privilege as a high-value control boundary, not just an account-management detail.

What to watch for: Focus on accounts that can cross trust boundaries, especially admin, service, and delegated identities that are reachable from routine user workflows. Sudden privilege changes, unusual logon sources, or elevated use outside the account’s normal purpose deserve immediate review.

Practitioner takeaway: The best defence is not only stronger authentication, but tighter privilege design, shorter-lived access, and better visibility into who can become powerful, when, and by which path.

Related resources from NHI Mgmt Group

• Why do autonomous agents create more lateral movement risk?
• Why do SSO environments increase the risk of lateral movement?
• What is the difference between SaaS lateral movement and traditional network lateral movement?
• Why does unconstrained delegation increase the risk of lateral movement?