Lateral movement is the point in a breach where an attacker stops being a curiosity and starts being a real problem. It is the process of spreading from one compromised machine to the rest of your network. The attacker is hunting for data, credentials and higher access. Most businesses picture a breach as a single dramatic moment. In reality, it is usually a series of small, quiet steps, and lateral movement is where most of them happen.
Table of Contents
The myth of the strong perimeter
A lot of security spending still assumes the main job is keeping attackers out. Firewalls, email filtering, endpoint protection: all useful, all focused on the front door. NCSC’s own guidance on lateral movement starts from a different, more honest premise. Assume an attacker with enough time and resources will eventually get in.
Once you accept that, spending your entire budget on the perimeter looks like a mistake. A network with strong outer defences but no internal controls has a real problem. An attacker who gets past that perimeter has free rein to go anywhere they like, completely unchallenged.
What lateral movement actually looks like
MITRE ATT&CK, the standard reference for how real attacks unfold, lists nine main technique categories under its Lateral Movement tactic. Strip away the jargon and most of them boil down to something uncomfortably simple: attackers use tools you already have, with credentials they already stole.
Pass the hash lets an attacker authenticate using a stolen password hash, without ever knowing the actual password. Pass the ticket does the same with a stolen Kerberos authentication ticket. Neither requires custom malware. Both use protocols that were already running on your network before the attacker arrived.
Why this is a detection problem, not just a prevention one
Here is the uncomfortable truth: prevention will eventually fail somewhere. A phished employee, an unpatched service, a reused password. It only takes one. What happens next determines whether that single failure becomes a minor incident or a full breach. That is fundamentally a detection and containment problem.
Most lateral movement looks exactly like an administrator doing their job, because in a technical sense, it is. The same protocols, the same tools, often the same accounts. Traditional antivirus, built to catch malicious files, frequently has nothing to flag. This is why NCSC’s guidance leans so heavily on behavioural baselines: you cannot spot an anomaly if you never established what normal looks like.
The controls that actually change the outcome
| Control | What it stops |
|---|---|
| Network segmentation | A compromise in one zone reaching every other zone |
| Separate admin accounts | A phished everyday login carrying domain admin rights |
| Credential hygiene | One stolen password unlocking dozens of systems |
| Behavioural monitoring | An attacker moving undetected because nothing looked unusual |
None of these are exotic or expensive in the way a new security product often is. They are largely a matter of architecture and discipline. That is also why they get skipped. There is no vendor pitching “properly separate your admin accounts” the way there is for the latest detection platform.
Where testing fits into this picture
A policy document describing your segmentation strategy is not proof that the segmentation works. An internal network penetration test starts from where an attacker would actually land: a single compromised account. It then tries to move exactly the way a real attacker would. It turns “we believe our controls would hold” into an actual answer.
That is a different question from what an external penetration test covers. External testing is about what is reachable from the internet in the first place. A business that only ever tests its perimeter has never checked something important. Does the assumption behind NCSC’s guidance actually hold true for them? Our guide on judging a provider’s penetration testing methodology covers what a tester should actually be doing here, beyond a basic scan.
What good practice looks like in reality
Businesses that handle this well do not treat it as a one-off project. Separating admin accounts is a baseline for them, not an aspiration. Critical systems get segmented deliberately, rather than left on a flat network because segmentation is inconvenient. They build a genuine picture of normal activity, so an unusual login to a domain controller at 3am actually gets noticed. And they test the whole thing periodically, because a control that worked last year may not hold against how the network looks today.
A quiet case, not a dramatic one
Most lateral movement stories are undramatic. An employee clicks a link. Their laptop is compromised. Nothing looks wrong yet.
The attacker waits, then looks around. A cached credential works elsewhere. A shared admin password opens another door. Step by step, one ordinary laptop becomes a path to the domain controller.
No alarms fire, because nothing on that path was malware. It was just an attacker using what was already there, one small step at a time.
The uncomfortable honeypot option
NCSC’s guidance also mentions a less common tactic worth knowing about: production honeypots. These are decoy systems, dressed up to look valuable, with no legitimate business purpose. Nobody should ever touch one during normal work. Any interaction at all is automatically suspicious and worth investigating immediately.
Honeypots are not for every organisation. They require genuine expertise to deploy safely, plus a careful risk assessment before rollout. A poorly configured decoy can become a genuine weakness rather than a defence. But for a business with a mature security function, they offer something rare. An early, low-noise signal that someone unauthorised is already moving through the network, well before that movement reaches anything that matters.
Frequently asked questions
Isn’t a strong firewall enough?
No. A perimeter firewall does very little once an attacker is already inside. It was never designed to control traffic between internal systems, which is exactly where lateral movement happens.
Why do attackers prefer legitimate tools over malware?
Because legitimate tools do not trigger the same alarms. Malware gets flagged by antivirus. A stolen credential used through RDP looks like an employee logging in remotely, which is much harder to catch.
Is this only a large enterprise problem?
No. Smaller businesses often have flatter networks with less segmentation, which can make lateral movement easier, not harder, once an attacker gets a foothold.
How do we know if our internal controls would actually work?
Test them under realistic conditions. A scoped internal penetration test simulates exactly this kind of movement, rather than leaving it as an assumption in a policy document.
Does this apply to cloud environments too?
Yes, the logic transfers directly even though the mechanics differ. An over-permissioned service account or a leaked API key can move an attacker between cloud resources. It works much like a stolen credential moving them between servers on a traditional network. The strong-perimeter myth applies here too: a locked-down cloud account with a single overly generous role attached is still one compromise away from a much bigger problem.
What is the fastest way to reduce this risk?
Separate admin accounts from everyday accounts. It is one of the simpler changes available and closes one of the most commonly abused paths attackers use to spread.
If your controls have never actually been tested against real lateral movement, Aardwolf Security’s internal testing is built to answer that question directly. Get in touch to talk it through, or see our full penetration testing services.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
