security//lateral movement

Lateral movement is the attempt to expand from an initially compromised identity or machine into other systems. Attackers reuse credentials, trust relationships, remote administration paths and reachable services to move through an environment.

Lateral movement is the attempt to expand from an initially compromised identity or machine into other systems. Attackers reuse credentials, trust relationships, remote administration paths and reachable services to move through an environment.

The practice turns local compromise into organizational compromise. Network segmentation, role separation and identity monitoring matter because they break the chain even after one endpoint fails: scoped credentials (minimum privilege) leave fewer paths open, and cross-domain correlation (XDR) can reveal one identity or process touching several systems in sequence. A perfectly protected perimeter is fragile; a segmented interior assumes that somebody eventually gets through.

The blast radius is drawn by the paths between systems.