Glossary
Lateral Movement
An attacker's movement from one compromised system to other machines on the same network, in order to expand access and reach high-value targets. It often relies on stolen credentials, trust relationships between systems, or unpatched internal flaws. Network segmentation and a zero trust architecture sharply limit its progress.
Why lateral movement is decisive
An isolated entry point has little value to an attacker. It is lateral movement that turns the compromise of a peripheral machine — a workstation, a web server, a container — into access to sensitive systems: databases, domain controllers, secret vaults. Reducing lateral movement is often more effective than hoping to block every initial intrusion.
Slowing the spread
Network segmentation prevents a compromised system from freely reaching others. Zero trust requires authentication at every hop rather than implicit trust inside the network. Add secret rotation and isolation, environment separation (dev/prod), and monitoring of anomalous internal connections. Together, these measures contain an attacker instead of letting them spread.
Frequently asked questions
How does an attacker move laterally?
By reusing stolen credentials, exploiting trust relationships between machines (service accounts, Kerberos tickets), or leveraging unpatched internal flaws. Each hop brings them closer to high-value systems.
Does zero trust prevent lateral movement?
It makes it much harder by removing implicit trust within the network: every access must be authenticated and authorized, even internally. Combined with segmentation and secret isolation, it markedly reduces an attacker's ability to spread.