This roundup features six Zero Networks customers, spanning private credit, investment banking, wealth management, and beyond, who closed network security gaps without the operational complexity and outage risks that had stalled prior attempts.  

We’ll walk through how these firms leveraged automated, identity-driven microsegmentation to secure legacy systems, enforce granular controls without breaking critical connections, mitigate recurring pen test and audit findings, and build architectures designed to contain vulnerabilities that can't yet be patched.  

Legacy Complexity in Enterprise Networks: Closing Security Gaps  

Inherited infrastructure is the norm in financial services and enterprise orgs. Assets accumulate across years of mergers and vendor decisions, often maintained by separate teams with no unified network visibility. This leaves security teams to face a forced trade-off: accept protection gaps, or risk operational disruptions by enforcing granular controls.  

Real-World Examples  

Antares Capital is one of the largest direct lenders in the US and is responsible for $60B+ in middle-market lending. Their team recognized lateral movement as a portfolio risk as much as a security risk. But disparate legacy assets made it difficult to get a complete view of the network, so the team struggled to determine which ports were actually necessary for business operations.  

Similarly, La Trobe Financial’s environment had been evolving since the 1980s, leaving the security team to untangle decades of legacy complexity. As one of Australia’s leading and most trusted alternative asset managers – and responsible for securing over $20B in assets – La Trobe understood the urgent need to close legacy enterprise security gaps, but many systems were so deeply embedded in critical operations that replacing them would require years of effort and millions of dollars.  

Other microsegmentation products work if you’re in a cloud native environment – if everything is modern, shiny, and new – down here in the real world, we have to deal with some pretty horrible old school protocols that don’t play nice.

- Aaron Steinke, Head of Infrastructure, La Trobe Financial  

The Solution: Full Network Visibility and Agentless Integration  

Antares Capital and La Trobe Financial solved their enterprise legacy complexity challenges with Zero’s deterministic automation engine and agentless approach:  

• Automated discovery of all network assets and identities – including legacy systems – uncovered traffic patterns and dependencies across previously siloed environments.  
• Deterministic, human-on-the-loop automation fuels policy creation and enforcement, enabling precise rules that scale protection to legacy systems without risking disruption. 
• Agentless architecture deploys in minutes by leveraging native, host-based firewalls, enabling a seamless fit with legacy systems – without introducing latency.  

By integrating with existing infrastructure and unlocking end-to-end network visibility, Zero Networks removed the legacy barriers that stand in the way of comprehensive microsegmentation for many financial and enterprise institutions.  

As a result, Antares reached full segmentation in under three months, freeing 10+ hours a week across cloud and networking teams; La Trobe reached a security posture its team described as historically "out of reach," without a multi-year, multi-million-dollar modernization project.  

Implementing Microsegmentation without Disrupting Critical Operations 

Even when legacy complexity is not the primary barrier to a more robust network security posture, financial services organizations often hesitate to implement granular network segmentation for fear that it will break something – will enforcement disrupt the trading systems, client workflows, or applications the business depends on? Overly complex tools and unsustainable manual burdens can break critical connections outright or leave gaps and inconsistencies that risk continuity over time.  

Real-World Examples  

Baron Funds oversees ~$49B in client assets, making continuity and access integrity extremely critical. After other microsegmentation solutions broke the network, the organization was hesitant to move forward, but pen testing reinforced the need for more granular segmentation.  

Evercore faced the same underlying concern. A leading global independent investment bank, Evercore needed to shut down lateral movement across a complex, high-value enterprise environment without adding operational friction or deploying intrusive agents. But traditional approaches – manual access controls, privileged group clean-up, and firewall-based segmentation – required an extraordinary amount of effort that made inconsistencies inevitable and still left exploitable pathways open.  

The Solution: Deterministic Automation and Living-off-the-Land Defense  

Baron Funds and Evercore confidently embraced microsegmentation by removing the manual effort, guesswork, and operational complexity of legacy solutions with Zero Networks:  

• Policies are built from observed traffic and network behavior over a defined learning period, rather than manually assembled rule sets that require guesswork and introduce human error at scale.  
• Deterministic, human-on-the-loop automation eliminates unsustainable manual effort without removing human judgement entirely from the equation.  
• Orchestration of the native controls that already exist in today’s environments enable a non-disruptive, “living-off-the-land” defense. 

[Zero Networks] actually uses technology that we already have – it’s technology that we’ve already had on the network for 20 years. For as long as we’ve had firewalls, we could have done this. We just couldn’t manage the firewall at scale. You couldn’t manage the firewall intelligently. We had every piece of the solution there – what we did not have was the brains.    

- Henry Mayorga, CISO, Baron Funds 

By accurately automating rules based on learned network realities and enforcing them via native controls, Zero Networks gave both organizations the confidence to enforce granular segmentation without betting business continuity on an untested rule set or an unsustainable manual process. As a result, Baron Funds reached full segmentation in 30 days with zero disruptions to network traffic; Evercore locked down lateral movement across the entire enterprise from a single platform, managed by a single part-time administrator. 

As a Banking IT Manager pointed out in a Gartner Peer Insights review, the value of these results compounds at scale:  

Pen Tests, Audits, and Cyber Compliance Requirements: Prioritizing and Validating Controls 

Penetration tests and compliance requirements are some of the most common forcing functions for microsegmentation initiatives – especially in highly regulated industries like financial services. But pen tests and audits don’t only expose gaps to help security leaders prioritize strategies, they also validate the impact of controls.  

Real-World Examples  

Auditors had repeatedly flagged a specific gap with La Trobe Financial: the absence of MFA on high-risk protocols like RDP and SSH. But prior attempts to implement MFA on admin protocols and legacy systems had introduced latency, bugs, or errors severe enough to make the fix impractical. 

ACT Commodities – a leading global provider of market-based sustainability solutions – uncovered the scale of exposure across its Azure Cloud environment the same way. Pen testers could access the environment and exfiltrate data within just five minutes, but reimplementing firewalls, adjusting configurations, and completing the other tasks necessary to protect servers proved too difficult. 

Like many financial services organizations, diversified holding company B. Riley Financial saw the same security gaps surface in pen test results year after year but faced an impossible tradeoff: address persistent findings and disrupt key operations or live with known risks to maintain business as usual. 

There were a lot of years of doing penetration testing and coming up with similar results. There was always a critical. There was always a high. There were always multiples. And we just couldn’t stop those from reoccurring; no matter what we did, those same things would just show up again – we thought we had it fixed and then we’d find out a year later that we still had that issue.”

- Aaron Goodwin, CISO, B. Riley Financial  

The Solution: Closing Gaps by Default with Containment Architecture 

La Trobe, ACT Commodities, and B. Riley all closed exploitable pathways before a pen test or audit could find them, rather than remediating findings one at a time after the fact – if at all. With Zero Networks, these financial services orgs implemented comprehensive microsegmentation and built containment into the network architecture via capabilities like:  

• Network-layer MFA that extends authentication to high-risk protocols like RDP and SSH without touching the underlying legacy systems or introducing new points of failure. 
• Least-privilege access enforced by default, closing the specific pathways that attackers – and therefore, pen testers – rely on, rather than depending on manual review to catch every gap. 
• Continuous, automated policy enforcement generates audit-ready evidence as a byproduct of normal operation. 

By closing gaps structurally rather than chasing them one finding at a time, security teams turn audits and pen tests from a source of stress to a validation exercise. For example, after implementing Zero Networks, La Trobe closed the exact MFA gap auditors had consistently flagged without breaking legacy systems; ACT Commodities' five-minute breach window closed entirely, with later pen tests revealing unwanted lateral movement was completely blocked and contained; and B. Riley finally received a penetration test report with no high alerts, closing out a cycle of findings that had persisted for years. 

We had six findings in our penetration test, and every one of them would have been prevented or mitigated with Zero Networks. There’s not one other product we have that could have come close... Zero Networks is a cornerstone piece of security technology.

Chris Turek, Former CIO, Evercore 

Containing Vulnerabilities Before Patching: Preemptive Security in the Frontier AI Era 

Security teams have long faced an uphill battle keeping up with day-to-day vulnerability management. The issue has compounded in this age of frontier AI, where models like Mythos and Daybreak can find, analyze, and generate exploits for vulnerabilities at a speed and scale no human team can match.  

For example, Mythos found over 10,000 previously unknown vulnerabilities in seven weeks, including bugs that had evaded automated detection for decades. The window between disclosure and exploitation has collapsed. Even if vendors release mountains of patches to mitigate this influx of discovered vulnerabilities, organizations face an impossible tradeoff: patch immediately and manage updates that contain thousands of fixes at a time, or wait and prioritize while accepting risk exposure.  

Instead, financial institutions need a way to protect uptime before patches exist, or while validating that patches won’t cause unintended operational disruptions.  

Real-World Examples 

B. Riley Financial faced versions of the vulnerability exposure problem multiple times. In one case, a Microsoft Outlook vulnerability involving outbound SMB traffic left the firm exposed with no patch available from the vendor. Waiting for a fix meant leaving the exposure open. 

The Solution: Structural Containment as a Buffer Against Unpatched Risk 

With Zero Networks, B. Riley deployed a targeted rule blocking outbound SMB traffic from Outlook to the internet, closing the specific path the vulnerability relied on.  

And critically, this is just one example of how a cyber resilient network architecture designed for containment protects financial institutions against vulnerabilities without patching. More broadly, automated, identity-driven microsegmentation buys security teams time to patch safely by:  

• Closing unnecessary access paths by default, limiting what any unpatched vulnerability can reach, regardless of how it was discovered – or how quickly. 
• Constraining privileged access to explicitly authorized identities, so admin protocols aren’t lateral movement highways.  
• Scaling protection across the entire network, including OT and legacy systems that can’t always be patched on short notice – or at all.  

Having microsegmentation in place has really given us a precautionary protection layer so we can delay applying some of these patches. This gives us plenty of time to test, make sure everything’s working, and then apply it, but still have that protection layer in place. 

- Aaron Goodwin, CISO, B. Riley Financial    

Cyber Resilience for Financial Services: Build a Self-Defending Architecture with Zero Networks  

Legacy complexity, operational disruption risk, compliance pressure, and accelerating vulnerabilities are distinct challenges almost every financial institution faces, but they can all be solved with a single platform.  

By delivering automated discovery across legacy and modern assets alike, a deterministic policy engine that builds and enforces rules from real traffic and identity behavior, agentless integration with existing infrastructure, and network-layer MFA for privileged access, Zero Networks enables financial services orgs to build a self-defending network architecture that proactively blocks attacks without disrupting the business.  

See how Zero Networks makes cyber resilience practical for financial institutions – request a demo. 

But scaling least privilege enforcement across sprawling, multi-business-unit enterprise networks with tens of thousands of assets takes more effort and resources than most teams can spare. As a result, 99% of identities still hold excessive permissions.  

Rather than relying on manual processes to generate and enforce least privilege access policies, security teams can leverage deterministic automation for adaptive, accurate policies – without the manual overhead. We’ll walk through how least privilege policy automation works and share tips for unlocking Zero Trust outcomes faster.  

Key Takeaways  

• Which tools or solutions help enforce the principle of least privilege? Identity-aware microsegmentation and just-in-time MFA – powered by an automated policy engine that continuously learns network behavior – are the core mechanisms. Together, they restrict every connection to the access that’s operationally necessary for only as long as it’s necessary.  
• What tools help automatically generate least-privilege policies based on observed network traffic? Solutions powered by deterministic automation engines that continuously monitor network activity, build a behavioral baseline from observed connections, and generate policy directly from that baseline. For example, Zero Networks learns all network connections over a 30-day period before leveraging those insights to build deterministic, highly accurate firewall rules and policies that adapt dynamically across networks spanning multiple data centers, cloud regions, and business units. This keeps least privilege enforcement accurate and simple even for the largest, most complex orgs. 
• How can security teams automatically learn and map network connections to create access policies? Real-time monitoring that captures which identities and assets communicate, over what protocols, and how frequently can be used as the direct input for policy generation rather than relying on assumed or documented access requirements. 
• Do AI-generated least privilege policies rely on determinism? No. AI-generated policies are typically probabilistic, based on statistical inference. Deterministic automation generates and enforces policies directly from observed behavior using fixed logic and producing a traceable, precise rule rather than a likely guess. 

Automating Least Privilege Access to Accelerate Zero Trust  

Zero Trust security is based on the philosophy “never trust, always verify.” Enforcing least privilege by default is a non-negotiable tenet of Zero Trust – while Zero Trust defines the philosophy, least privilege enforces the mechanics.  

Modern Zero Trust architectures apply least privilege across human identities, machine-to-machine communications, APIs, AI agents, and service accounts. Network segmentation, identity segmentation, and just-in-time multi-factor authentication (MFA) are the solutions that make this comprehensive coverage possible – but it’s only achievable at scale when automated.  

AI agents introduce a new challenge – unlike a static service account, an agent’s access needs can shift from task to task. OWASP’s Agentic Applications Top 10 Project addresses this directly through its Least Agency principle, which calls for constraining an agent’s autonomy, tool access, and decision-making authority to limit the blast radius of prompt injection or compromised agents. 

Manual Policy Creation Challenges: Static Rules, Security Gaps, and Scale  

Manual policy management has a structural ceiling. Rules are typically written from assumptions about what a role or service account should need, and those assumptions rarely stand up to network realities. So, when least privilege policies are a primarily manual effort, a few common challenges emerge:  

• Static rules go stale almost immediately   
• Security gaps or operational breakage as assumed access requirements produce either overly permissive rules that leave too much room for lateral movement, or overly restrictive ones that break legitimate traffic 
• A scale problem headcount can't fix  

As Gartner points out in its report, Reimagining Network Microsegmentation: Beyond the IP – Identity, Context, and Agentless Innovation, continued reliance on static rules leaves organizations especially vulnerable to AI-driven attacks.  

Vendors clinging to manual policies face rapid obsolescence, as these methods are completely incapable of securing dynamic hybrid networks against lateral movement.

- Gartner  

Deterministic Automation vs. Probabilistic Models  

As manual policy management becomes untenable, many cybersecurity tools have rushed to fill the gap with AI capabilities. But AI-generated least-privilege policies aren't the same as ones built through deterministic automation.  

Probabilistic AI models produce outputs based on statistical likelihood; deterministic automation engines rely entirely on learned realities. 

A rule that's 99% accurate is still wrong enough to break applications or leave security gaps open, which is why AI adoption for security policies is often hindered by what Gartner calls “enforcement anxiety” – the fear that probabilistic algorithms will disrupt business operations. For enterprises that want to automate least privilege policy creation and enforcement at scale but can’t risk operational continuity, deterministic engines offer the best of both worlds.

How Deterministic Least Privilege Policy Generation Works  

Automating least privilege access means translating raw network activity insights to enforceable rules – in practice, that process occurs in four stages.  

1. Observing Real Traffic to Build a Behavioral Baseline 

Before any policy can be written, a comprehensive picture of what's actually happening on the network must be established: which assets and identities communicate, over which ports and protocols, how frequently, and in what direction. This learning period requires continuous observation to build a knowledge base of existing network communication patterns, including logon activity, account behavior, and asset access patterns tied to specific identities – even across networks with hundreds of thousands of connections and complex identity hierarchies.

2. Translating Observed Behavior into Enforceable Rules 

Once a behavioral baseline exists, an automation engine can use it to generate precise policies scoped to what's been observed as necessary for each asset and identity. This is the step that makes the approach deterministic rather than probabilistic – the policy isn't inferred from a model's best guess about likely access needs; it's derived directly from what was actually observed. That distinction is what allows the resulting rules to walk a fine line: tight enough to constitute genuine least privilege and precise enough to ensure legitimate traffic remains unaffected. 

3. Optional Simulation and Review Before Enforcement 

Even when policies are built from real behavior, most enterprises want an added layer of certainty that enforcement won’t break anything. Before any rule goes live, a human on the loop should have the option to simulate its impact – testing the policy against real traffic in a sandbox environment for visibility into what it would allow and block before it affects production.  

4. Keeping Policy Aligned as Behavior Changes 

Generating an accurate least privilege policy once is only half the problem. Modern enterprise networks evolve constantly – new assets appear, old ones get decommissioned, and applications shift how they communicate. Or, new business units get acquired, old ones get divested, and applications shift how they communicate – enterprises need dynamic policy coverage. Automated lifecycle management keeps policies current in dynamic environments: access paths that go unused get closed, new patterns are incorporated, and rule sprawl is structurally prevented rather than periodically cleaned up after the fact. Always-current network visibility fuels the deterministic automation engine, enabling an adaptive least privilege posture.  

Automating Least Privilege Enforcement to Strengthen Business Resilience  

By scaling least privilege across the full enterprise with automation, security teams drastically change the math on what happens when something goes wrong. Because access is continuously scoped to observed network behavior and aligned to business need rather than defaulting to what was granted once and forgotten, breaches are automatically constrained – regardless of how they start. That translates directly into the resilience outcomes security leaders need to show the business: 

• Smaller blast radius by default: access never exceeds what's necessary, significantly reducing the threat of stolen credentials  
• Fewer standing, unused permissions: the exact accumulation attackers rely on to escalate privileges while evading detection gets closed continuously  
• Faster containment: lateral movements pathways that were never open in the first place don't need to be shut down mid-incident 
• Enforcement that doesn’t drift: policies adapt as the network changes, enabling demonstrable compliance and uptime protection  

Deterministic Policy Automation: Real-World Example 

Mediterranean Shipping Company (MSC) operates one of the largest-scale and complex logistics networks in the world, moving 21% of global shipping across a massive footprint of ports, vessels, and facilities spanning dozens of countries. Uptime is nonnegotiable and instability is unacceptable; still, the organization needed a way to strengthen internal defenses.  

Manual segmentation was slow to scale, requiring countless hours of log analysis and manual rule maintenance for only partial coverage. Limited visibility into internal traffic patterns further complicated policy creation.   

MSC offloaded the manual effort of discovery, learning, and policy management to Zero’s deterministic automation engine, successfully segmenting roughly 95% of its servers.  

What once took more than a year of manual work and endless log analysis is now fully automated. We’ve segmented about 95% of our environment, gained complete visibility into network activity, and dramatically strengthened our defenses.

- Sergio Fedelini, SVP, IT Infrastructure, MSC

Build a Self-Defending Network Architecture with Zero Networks  

Zero provides immediate visibility into every identity and asset on the network, monitors and learns all network connections, then automatically generates and enforces identity-aligned least privilege policies to prevent lateral movement by default. Our comprehensive solution operationalizes the principle of least privilege across every axis of network traffic: 

• Automated microsegmentation isolates every asset within its own secure perimeter, closing unnecessary communication paths without disrupting operations.  
• Identity segmentation enforces granular access rules for users, devices, and applications, ensuring every connection is explicitly authorized.   
• Just-in-time network-layer MFA adds adaptive authentication at the moment of privileged access, turning static permissions into temporary access.   
• Deterministic, highly accurate automation learns all network behavior to create and enforce least privilege policies at scale.  

Learn how you can automatically generate least privilege policies that dynamically adapt as your network evolves – request a demo.   

As models like Mythos, Daybreak, and other tools attackers weaponize for AI-driven exploits compress the window between initial compromise and business disruption even further, time is no longer on the defender’s side. Security teams can no longer afford to plan for prevention; they must engineer for the impact of a breach.  

A business impact analysis (BIA) is a vital step in gaining consequence clarity and tailoring cyber resilience strategies to business and board-level priorities. But all too often, a BIA documents critical systems, the disruptions that would materially impact the organization, and how long the business can tolerate downtime without detailing current exposure or producing cyber resilience priorities.  

We’ll walk through a business impact analysis template that translates documented business priorities into actionable cyber resilience enforcement steps, giving CISOs the necessary insights to protect uptime where it matters most.  

How to Conduct a Business Impact Analysis for Cyber Resilience: 3-Step Framework 

A BIA built to produce resilient architecture, not just documentation, moves through three steps: critical asset identification and business exposure quantification, attack path analysis and containment metrics, and investment prioritization. Each step is designed to hand off concrete inputs to the next, ultimately delivering a set of specific intervention priorities tied to specific exposure reductions.  

Step 1: Identify Critical Assets and Quantify Business Exposure 

The first step in resilience-focused business impact analysis is to identify which systems and assets are critical to the strategic success and day-to-day operations of the company. This means evaluating assets across five dimensions of business exposure:  

1. Regulatory Classification: If an asset contains data that is restricted by regulations, then a compromise could incur fines, time-consuming reporting, and disclosure requirements. 
2. Revenue Exposure: If an asset is critical to delivering goods and services or measuring consumption of goods and services, any downtime or breach would disrupt revenue streams and could even force the organization to pay penalties or credits to impacted customers. 
3. Financial Sensitivity: If an asset has the ability to issue or redirect payments, compromise could impact the organization’s operational cash flow. 
4. Customer Notification Requirements: If customer notification processes – often tied to revenue exposure and regulatory classification – are required due to a cyber incident, they can impact ongoing customer conversations and sales cycles.  
5. Reputational Sensitivity: If assets containing data or conducting functions that are core to the organization’s communications or value proposal are impacted by a breach, it could cause reputational harm. 

Identifying business-critical systems requires collaboration across multiple stakeholders – CISOs need to gather information from CROs, CIOs, COOs, and business unit leaders to fully grasp the organization’s overall risk exposure and the disruptions that would materially impact uptime, revenue, or customer commitments, ensuring the assessment reflects real-world operational priorities.  

Following this step, CISOs should have a preliminary list of critical assets, enough information to justify why it’s critical, and a baseline estimation of the business impact if a compromise occurred.  

Step 2: Analyze Attack Paths Against Containment Metrics  

With an inventory of critical assets and an understanding of how downtime would impact the business, CISOs can tackle the question that most urgently affects business continuity: how exposed are critical systems today?  

This is where many BIAs miss out on delivering practical value – they document priorities on paper without establishing whether critical systems are actually protected or where they’re vulnerable.  

An attack path analysis evaluates the level of effort it would take an attacker to move from a common ingress point to a business-critical asset. No analysis can comprehensively map every breach scenario, so CISOs should focus on categories that reflect the current threat landscape, like:  

• Compromised user 
• Compromised cloud identity 
• Technical perimeter entry 
• Trusted vendor/third-party access 

For each threat category and critical system, security teams should identify the nearest ingress point and map a plausible attack path relative to three containment dimensions: path distance, privilege requirements, and data-layer controls.  

The result, run across every combination of scenario and critical asset, is a documented map of exposure tied to likely attack tactics rather than a general sense of risk. This breakdown of exposure across all critical assets bubbles up to two enterprise-level risk insights:  

• Asset-level worst case path: The compromise scenario that presents the shortest, least obstructed route for an attacker to reach a business-critical system.  
• Enterprise-level highest cost path: The single scenario-to-asset combination with the weakest containment and the highest business exposure – the easiest attack with the greatest business impact.  

These insights deliver a baseline for measuring cyber resilience improvements over time, and a natural starting point for prioritizing enforcement and investment.  

Step 3: Prioritize Security Strategies and Investments for Reducing Business Risk Exposure  

With critical assets identified and their exposure mapped against likely attack scenarios, CISOs have what they need to answer the question that turns documentation into a cyber resilience roadmap: what actions will reduce the most risk – and fastest? 

As a general principle, interventions that reduce blast radius structurally, by eliminating an attacker's ability to reach a critical asset in the first place, are more durable than interventions that depend on detecting and responding to an attack already in progress. With that in mind, security teams should focus on strengthening the same dimensions of threat containment used to analyze exposure:  

• Increase path distance or completely remove pathways to critical assets: Granular network segmentation, additional authentication boundaries, and inspection points placed along the worst-case attack path can eliminate entire compromise scenarios rather than simply slowing them down.  
• Reduce privilege exposure: Eliminating persistent privileged access, reducing service account scope, enforcing just-in-time reauthentication, and introducing additional authentication requirements for critical assets can reduce privilege exposure, making it harder for attackers to successfully reach critical assets.  
• Enforce data layer controls: Implementing identity-based access controls and encryption at rest limits the potential damage if attackers do manage to reach critical systems, helping to ensure that a compromise won’t escalate to downtime.  

For each recommended intervention, CISOs should document the expected impact in terms the business understands: which worst-case path do these strategies break or lengthen, which critical assets do they better protect, and how do they reduce business exposure? This creates a direct line from investment to risk reduction, making budgetary conversations concrete and clearly tying security outcomes to business continuity.  

Build a Cyber Resilient Architecture with Zero Networks   

Zero Networks closes the gap between business priorities and real-world enforcement with automated, identity-based microsegmentation. Zero provides immediate visibility into every identity and asset on the network, then automatically enforces adaptive, identity-aligned policies that prevent lateral movement to critical assets to safeguard business resilience.  

The average Zero customer achieves 90%+ segmentation within 90 days, achieving comprehensive protection that measurably reduces risk exposure without disrupting regular operations.  

Find out how Zero Networks can help you build a cyber resilient architecture with measurable business value – request a demo.    

In other words, organizations understand the value of microsegmentation, but there’s a gap between intent and execution. The question is: how can enterprises deploy microsegmentation at scale, in real-world environments, without multi-year projects or partial coverage that leaves gaps for attackers to exploit?  

Gartner answered just that in its report, Reimagining Network Microsegmentation: Beyond the IP – Identity, Context, and Agentless Innovation. The research identifies three critical insights that should shape how security teams evaluate modern microsegmentation solutions – we’ll break down what they are and what they mean for the evolving landscape of zero trust microsegmentation.  

Key Takeaways  

• What does Gartner's research say about innovative microsegmentation in 2026? In Reimagining Network Microsegmentation: Beyond the IP – Identity, Context, and Agentless Innovation, Gartner identifies three critical insights shaping the future of network microsegmentation: the shift from IP-based rules to identity-first enforcement, the need for autonomous policy governance that moves beyond manual management, and the requirement for agentless, multimodal enforcement architectures that can deliver comprehensive coverage across heterogeneous enterprise environments. 
• Who are the leading enterprise microsegmentation vendors in 2026? Gartner's Reimagining Network Microsegmentation report names a range of sample vendors actively shaping the market, including Zero Networks, Palo Alto Networks, Akamai, Aqua Security, Broadcom, Cisco, ColorTokens, Elisity, Fortinet, Illumio, and Zscaler. Zero Networks is also recognized in the 2026 Gartner Peer Insights Voice of the Customer report with a perfect 5-star rating and a 100% willingness-to-recommend score. Likewise, Zero Networks earned a Platinum rating in EMA’s PRISM Report; we at Zero are proud to receive the analyst validation and customer trust that defines leading microsementation solutions. 
• What does identity-first microsegmentation mean in practice? Policies are bound to verified user, machine, or AI identities rather than network addresses, and enforced dynamically as those identities move across environments. This includes non-human identities like service accounts and AI agents, which already significantly outnumber human identities and are frequently over-privileged and under-monitored. 
• What is the most effective zero trust microsegmentation approach for stopping lateral movement? Gartner's research points to a combination of identity-first controls, automated policy governance, and agentless enforcement across the full environment. Together, these eliminate the coverage gaps and static policies that attackers rely on to move laterally, regardless of how initial access was gained. 
• What should security leaders look for when evaluating microsegmentation vendors? Three capabilities aligned to Gartner's critical insights: whether identity governs reachability at the network layer, whether policy automation is accurate, scalable, and auditable with human-on-the-loop controls, and whether the platform can reach the full environment – including legacy, IoT/OT, and cloud – without requiring agents on every asset. 

Identity-First Microsegmentation: Replacing IP-Based Rules  

For decades, network segmentation meant drawing boundaries around IP addresses, VLANs, and ACLs. The logic was sound for static, on-premises environments: define what can talk to what, and enforce it at the network layer. But the environments these tools were built for no longer exist – according to Gartner, that’s why it’s time to pivot from IP-centric rules to unified identity fabric.  

“The shift from network-centric to identity-first segmentation is a response to the evolution of traditional perimeters to hybrid architectures, the rise of dynamic, cloud-native environments, and the adoption of NHI. Static controls like IP addresses, VLANs, and ACLs are now ineffective, for ephemeral workloads and serverless architectures make manual rule management unmanageable and leave organizations vulnerable to lateral movement attacks.”  

Gartner, Reimagining Network Microsegmentation: Beyond the IP – Identity, Context, and Agentless Innovation  

IP-centric policy governs a location, not an identity – when a workload moves, a cloud instance spins up, or an AI agent is provisioned into your environment, a static rule doesn't follow it. The policy appears intact, but the coverage is full of gaps; for security leaders, that creates a false sense of protection. 

Dynamic Security Enforcement for Human Users, Machine Identities, and AI Agents

The proliferation of non-human identities (NHI) like service accounts and AI agents adds urgency to the identity-first segmentation shift.  

Machine and service identities already outnumber human identities 109:1 – a trend expected to accelerate as organizations anticipate 85% growth in AI agents over the next year. But NHI are notoriously over-privileged and under-monitored: just 2.6% of workload identity permissions are actually used, and 51% of workload identities are completely inactive; meanwhile, nearly two-thirds of organizations do not have AI governance policies.  

The takeaway? Enterprises need microsegmentation solutions that anchor controls to the actual human user, non-human identity, or workload rather than their network location.  

“Relying on static, IP-based microsegmentation guarantees catastrophic vulnerability to AI-driven attacks. Vendors clinging to manual policies face rapid obsolescence, as these methods are completely incapable of securing dynamic hybrid networks against lateral movement.” 

Gartner, Reimagining Network Microsegmentation: Beyond the IP – Identity, Context, and Agentless Innovation  

Context-Aware Identity Governance and Complete Visibility  

Identity-first microsegmentation ensures policies can be dynamically enforced based on the real-time identity of users and NHI as they move across environments. At the core of this shift is what Gartner calls the Unified Identity Graph – a single, comprehensive view of network identities and context that enables real-time, granular policy enforcement.  

When it comes to evaluating microsegmentation vendors, this means security leaders should look for:  

• Real-time network mapping that delivers comprehensive visibility into all identities, assets, and network behavior  
• Policy-based access control (PBAC) that autonomously enforces identity-based, context aware policies across hybrid and multi-cloud infrastructures 
• Product architecture that natively supports identity-based segmentation, so identity governs reachability at the network layer  

Autonomous Governance, Agentic AI, and the End of Manual Segmentation Policy Management 

Just as modern, dynamic environments have rendered IP-centric rules insufficient, they’ve made manual microsegmentation strategies impossible to scale in today’s rapidly changing, distributed infrastructures, leaving a gap between what's configured and what's actually happening on the network.  

To avoid policy drift and hidden risk exposure, Gartner suggests modern microsegmentation should autonomously map application dependencies, generate policies, and enforce rules in real time. The goal is continuous, adaptive governance that keeps protection aligned to network realities.  

Agentic AI: Opportunities and Risks  

Automated policy creation and enforcement is what Gartner recommends, but how can enterprises get there? The report identifies agentic AI as an enabler of autonomous governance – but with a trust gap standing in the way.  

Agentic AI adoption for security policies is often hindered by “enforcement anxiety,” as teams fear that algorithms may disrupt legitimate business operations. What’s more, the deployment of agentic AI brings its own security risks as agents become targets for adversarial attacks.  

Gartner's prescription for closing this trust gap is explainability and human oversight: policy simulation, transparent reasoning, and human-in-the-loop safeguards that allow teams to review and validate automated rules before they go live.  

Deterministic, Human-on-the-Loop Automation  

Security teams that can’t afford to risk operational disruption by replacing human judgement with AI can still operationalize Gartner’s insights by leveraging deterministic, human-on-the-loop automation, which operates on defined logic rather than probabilistic guesswork while keeping security teams in control of outcomes. 

Microsegmentation powered by deterministic automation delivers the adaptive, dynamic protection modern enterprises need by generating precise enforcement based on learned network behavior. For example, Zero Networks’ automation engine learns allowed network behaviors in order to create dynamic rules for identities and assets. As Chris Boehm, Zero Networks Field CTO, points out, this type of deterministic automation hinges on learning: 

In other words, deterministic automation relies on learned realities rather than educated guesses, which are central to probabilistic approaches. Keeping a human on the loop to optionally review, approve, or fine-tune policies in a sandbox environment is a key safeguard for peace of mind while still shrinking manual effort and enabling protection to scale alongside modern environments.  

Whatever mechanism security teams choose to get there, the ultimate goal remains the same: microsegmentation that shifts away from manual policies and embraces automation, enabling defenses that effectively counter AI-driven attacks. When evaluating microsegmentation tools on this capability, CISOs and cyber leaders should ask questions like:  

• Does the platform generate policies based on observed network behavior? Can your team see how a policy was derived? 
• Can teams simulate and validate policies before enforcement goes live, and test against real traffic to catch potential disruptions before they impact operations? 
• Does the platform continuously adapt as environments change, or does staying accurate require manual intervention? 
• How does the platform handle policy drift? Does it detect and remediate unauthorized changes automatically? 

Agentless Enforcement: How Microsegmentation Scales Across Enterprise Environments 

Autonomous, real-time policy governance only works if the underlying enforcement architecture can actually reach the full environment – without introducing performance overhead that makes it impractical. 

That's the core of Gartner's third critical insight: agent-based platforms struggle with performance and scalability across hybrid, cloud, and containerized environments, making granular policy management too complex. The recommended path forward? Multimodal, agentless enforcement that extends comprehensive coverage without the operational burden agents introduce. 

Agent-Based vs. Agentless Microsegmentation  

Agent-based platforms require software on every managed endpoint. In heterogeneous enterprise environments, that creates a structural problem: performance overhead on every host, version management across a diverse fleet, and coverage gaps on the assets that can't run agents at all – legacy systems, IoT and OT devices, unmanaged endpoints, and cloud workloads. These are precisely the assets attackers move through. 

Agentless microsegmentation solves this by extending enforcement through existing OS and network infrastructure rather than requiring software on every endpoint. Coverage reaches the full environment, including assets that could never host an agent, without the performance tax or the operational burden of managing agents at enterprise scale. 

From a solution evaluation perspective, this insight signals that security teams should ask vendors questions like:  

• Does the platform require agents on every endpoint, or does it enforce policy through existing infrastructure? 
• What happens to coverage on legacy systems, IoT/OT, or cloud workloads where agents can't be deployed? 
• Does the deployment model scale as the environment grows, or does agent management become a ceiling on coverage over time? 

Automated, Identity-Driven Microsegmentation for Modern Enterprises: Strengthen Cyber Resilience with Zero Networks   

Modern enterprises are moving away from reactive security to proactive containment – an evolution Gartner describes as the “shift from preventative-only security to cyber resilience.” For security leaders embracing microsegmentation as part of this shift, Gartner’s report paints a clear picture of what innovative solutions must look like: identity-first, automated with human oversight, and agentless.  

Zero Networks is named in the report as a sample vendor, recognized for automated, identity-driven microsegmentation that delivers on all three critical insights:  

• Identity-based policies govern access at the network layer, tied to user, machine, or AI identity, and automatically updated as environments change. 
• A deterministic automation engine maps observed network behavior, generates least-privilege policies, and keeps teams in control through human-on-the-loop simulation and staged rollout before enforcement. 
• Zero deploys agentlessly, orchestrating native OS enforcement mechanisms across IT, OT, IoT, and cloud – no proprietary agents, no rearchitecting, and no coverage gaps on the assets that matter most. 

The average Zero customer segments 90%+ of their environment within 90 days – 91% faster than legacy approaches, at 87% lower cost. Request a demo to see how.  

We’ll break down the top 10 risks behind unauthorized lateral movement in enterprise networks, exploring what each one means, why it matters for cyber resilience, and how to strengthen your posture. 

Key Takeaways  

• How do attackers move laterally inside a network? The same protocols and trust relationships that keep business operations running – RDP, SMB, SSH, WinRM, RPC, cloud APIs, and orchestration platforms – are the pathways adversaries use to move laterally and turn a single compromised identity, workload, or laptop into a companywide outage. For example, 87% of servers accept internal RDP or SSH traffic, 78.7% are reachable over SMB or WinRM, and a single compromised host can reach 85% of internal systems in the first hop. 
• Why does breach prevention alone fail to protect business continuity? Attackers move faster than defenders can respond. The fastest recorded breakout time in 2025 was 27 seconds, yet the average time to identify and contain a breach is 241 days. That 771,200:1 ratio means that by the time most organizations detect a compromise, the attacker has already moved. Breach prevention addresses the perimeter without limiting how far an attacker travels once inside. Containment structurally limits what a compromised asset can reach. 
• How is AI changing the lateral movement threat landscape? With AI-driven lateral movement (AILM), adversaries use AI to accelerate the attack chain or weaponize overprivileged AI agents’ legitimate connections to pivot between systems. Roughly 80% of organizations have deployed AI agents, and two-thirds have no governance policies for them. These agents hold broad standing access across email, databases, cloud APIs, and code repositories. An attacker who compromises or manipulates an agent inherits its legitimate permissions; the agent's privilege becomes the attack path. 
• How can enterprises block lateral movement inside their network without disrupting operations? The key is a closed-by-default architecture where administrative protocols are opened on demand rather than broadly exposed, access is governed by identity context and per-session authorization rather than standing permissions, and segmentation enforces least-privilege connectivity at the network layer. Just-in-time access and automated policy enforcement mean controls adapt to operational need rather than blocking legitimate connections.  

The Risks That Enable Lateral Movement: Real-World Exposure and Benchmark Data  

Lateral movement is the process attackers use to move from an initially compromised asset to additional systems, accounts, data stores, or control-plane infrastructure. In other words, lateral movement is how attackers convert a single compromise into enterprise-wide impact.  

“Initial access is a security problem. Lateral movement is when it becomes a business continuity problem. Before lateral movement, you may have an intrusion. After lateral movement, you have downtime, ransomware propagation, data exposure, failed recovery, customer impact, and executives explaining why one compromised endpoint could reach systems it never should have touched.” 

Dr. Chase Cunningham 

These 10 risks represent the structural exposures responsible for lateral movement in enterprise environments.  

1. Broad Internal Admin Protocol Exposure 

Protocols like RDP, SMB, SSH, WinRM, and WMI are widely reachable across the internal environment. These protocols are foundational to Windows, Active Directory, and IT operations, making them critical for business continuity – and opening up lateral movement highways.  

Over 70% of enterprise threat activity flows through SMB, RDP, WinRM, and RPC, meaning attackers rely on the same trusted pathways the business depends on to function. The scope of the problem is undeniable: 87% of monitored servers accept internal RDP or SSH traffic, and 78.7% are reachable over SMB or WinRM. 

What to Do About It: Dynamically Close Admin Protocols  

To mitigate exposure across protocols like RDP, SMB, SSH, WinRM, and WMI, admin protocols should be closed by default – only opened on demand with per-session authorization and MFA. Just-in-time access enforcement minimizes risk without disrupting critical workflows. Layer-7 inspection on east-west traffic, including RPC, SMB, LDAP, and DNS, ensures malicious activity is distinguished from routine administration.  

2. Excessive Internal Reachability  

Enterprise networks were built for access and connectivity, not containment. The result is that internal systems can communicate too broadly by default, giving attackers an expansive internal attack surface the moment they gain a foothold. 

A single compromised host can reach 85% of internal systems on the first hop and effectively 100% on the second. A frequently neglected dimension is egress: most organizations block unsolicited inbound traffic but treat outbound traffic as inherently trustworthy, giving attackers a clear channel for command-and-control communication and data exfiltration over protocols like HTTPS and DNS. 

The problem compounds in modern environments. Cloud platforms, Kubernetes clusters, AI agents, and hybrid infrastructure create dynamic communication patterns that frequently bypass static segmentation models, multiplying possible attack paths as environments grow. 

What to Do About It: Enforce Least-Privilege Connectivity 

Critical systems should be isolated by default, with administrative access tightly scoped and time-bound, and every communication path explicitly justified. User, server, cloud, Kubernetes, and agentic environments should be segmented by design, with critical assets explicitly isolated from user endpoints and egress filtering applied alongside inbound controls.  

3. Excessive Privileged Access 

Admin credentials can typically authenticate broadly across the environment with standing permissions that far exceed daily operational need. In fact, 99% of users, roles, and services hold excessive standing permissions, often unused for 60 days or more, and over 80% of attacks leverage stolen credentials at some stage. 

Without proper identity segmentation – the practice of restricting access based on identity context and limiting the scope of what each identity can authenticate to – an attacker can take one compromised identity and leapfrog between systems.  

What to Do About It: Apply Granular Identity-Based Access Controls  

Just-in-time admin access, tiered administration, and per-system authorization limit what each identity can reach – not just where it can enter. Identity-context-aware east-west policies ensure a compromised credential operates within tightly scoped boundaries rather than across the entire environment it technically can authenticate to. 

4. Overprivileged Service Accounts  

Service accounts – non-human identities used by applications, services, and automation – are frequently overprivileged and are systematically under-monitored. Machine and service identities now outnumber human identities 109:1, yet only 2.6% of workload identity permissions are actually used, and 51% of workload identities are completely inactive.  

In on-premises environments, service accounts often carry static passwords that never expire and are sometimes shared across multiple services. In cloud environments, a single overprivileged role can silently enable complete environment takeover without any additional exploits required. 

What to Do About It: Apply Least Privilege to Every Machine Identity 

Service accounts should be scoped to the minimum permissions their function requires, with regular credential rotation, usage monitoring, and source-binding so credentials only function from sanctioned workloads. This limits what a stolen service account credential can do, even if it is valid. 

5. Legacy Authentication Paths 

Outdated authentication mechanisms create exploitable trust paths that modern controls cannot reach. NTLM is the canonical example: 43.2% of observed internal authentication traffic in enterprise environments still uses it, and its design means an attacker who obtains a hashed credential from one machine can authenticate directly to another without recovering the plaintext password.  

Older email protocols like POP3 and IMAP bypass MFA entirely while Cleartext protocols expose credentials to anyone with network visibility. According to Microsoft, more than 99% of password-spray attacks use legacy authentication protocols that bypass MFA – disabling legacy authentication in Entra ID alone reduces account compromise risk by 67%. 

What to Do About It: Retire Legacy Protocols and Enforce Modern Authentication 

Modern authentication standards like OAuth 2.1 and OIDC should replace legacy protocols across the environment, with MFA enforced on privileged internal access alongside perimeter authentication. Every legacy protocol left active is an authentication path that bypasses modern controls, leaving enterprises vulnerable to unauthorized lateral movement. 

6. Exposed Control Plane Infrastructure 

Active Directory, IAM platforms, backup systems, virtualization hypervisors, Kubernetes API servers, CI/CD controllers, and cloud management consoles are the operational brains of modern environments – and they’re often broadly reachable as segmentation of control-plane infrastructure remains inconsistent across enterprise environments. 

When critical management systems are reachable from broad internal segments, a single compromised component gives attackers direct access to large portions of the enterprise. The stakes extend beyond access: if attackers reach backup infrastructure or orchestration systems, recovery operations themselves may fail. 

What to Do About It: Isolate the Control Plane 

Control-plane systems should sit in dedicated management zones with restricted admin paths and MFA-gated access. Continuous monitoring of access to Active Directory, IAM, hypervisors, backup infrastructure, and CI/CD systems provides early warning of targeting before recovery options are compromised. 

7. Internal Vulnerability Pivoting  

Even organizations that diligently patch internet-facing systems frequently overlook internal ones – and attackers exploit that gap directly. Sensitive internal protocols remain broadly reachable across both server and client populations; unpatched or misconfigured internal services mean an attacker with a foothold can scan for a vulnerable service and exploit it without needing credentials or social engineering. 

Meanwhile, AI-powered vulnerability research is changing the economics of exploitation. Models like Anthropic's Mythos have demonstrated the ability to identify exploitable weaknesses and develop attack paths with limited human involvement, compressing the window between patch release and exploitation beyond what most patch cycles can accommodate. 

What to Do About It: Segment Vulnerable Assets 

Internal patch SLAs should apply to server and client populations, not just internet-facing systems. Where patching is delayed, granular segmentation around vulnerable assets limits their exploitability. Attack-path prioritization should account for internal reachability and legacy protocol restriction, not CVSS score alone. 

8. Lack of East-West Visibility 

Security teams cannot contain what they cannot see. Most organizations have reasonable perimeter logging, but logging and auditing of access between internal workloads, services, and accounts is inconsistent, meaning adversaries can exploit access and expand reach without triggering an alert.  

Many organizations lack identity-attributed east-west authentication visibility, and full authenticated traffic logging between workloads remains inconsistent. Without it, misconfigurations go unidentified, dwell time extends, and security teams cannot reconstruct attack paths when incidents occur. 

What to Do About It: Identity-Attributed Traffic Logs 

East-west visibility requires identity-attributed traffic logs tied to specific identities rather than IP addresses or ports, combined with alerting on unusual internal movement and real-time path analytics – giving security teams the tools to act before lateral movement reaches critical systems.

9. Single Endpoint to Critical Asset Reachability  

One user endpoint can be leveraged to reach high-value assets directly. While the risk of excessive internal reachability describes broad system-to-system communication, this one explores a dangerous special case: how often a routine workstation sits one hop away from crown-jewel infrastructure like domain controllers, backup systems, ERP platforms, and cloud management consoles. 

Attacks start wherever adversaries can gain access – that’s rarely on critical systems. Business impact grows when that initial foothold has a direct, unbroken path to the systems that matter most: 12.2% of organizations demonstrate direct user-to-server administrative pathways, sensitive administrative services remain broadly reachable from internal environments, and endpoint-to-server administrative connectivity is common across enterprise networks.  

What to Do About It: Close Direct User-to-Critical-Asset Pathways  

Multi-stage access controls between user and server tiers, segmentation by sensitivity tier, and critical assets explicitly isolated from user endpoints ensure a compromised endpoint cannot directly reach crown jewels.  

10. Poor Containment Readiness  

Attackers often move freely for months before enterprises detect the breach. While attackers begin moving laterally in as little as 27 seconds, it takes an average of 241 days to identify and contain a breach – that’s a breakout-to-containment ratio of 771,200:1.  

What’s worse, many organizations lack the ability to rapidly revoke risky access paths without disrupting operations as containment readiness remains operationally immature across enterprise environments.  

What to Do About It: Build Containment into the Network Architecture 

Fast isolation playbooks, identity kill-switch capability, and controlled segmentation response modes that can quarantine a compromised host without halting surrounding operations are the foundations of containment readiness. When these capabilities are built into the network architecture, organizations remove the tradeoff between stopping the spread of a breach and keeping the business running. 

How to Assess Your Lateral Movement Posture 

The ten risks uncovered in the 2026 Lateral Movement Exposure Report map to a single underlying question: how far can an attacker travel once inside your environment? To find the answer, security leaders should assess their readiness across six dimensions:  

• Identity Security: Can you deploy least privilege across humans, machines and agents? 
• Network Segmentation: Can systems communicate only where required? 
• Administrative Controls: Are admin pathways tightly restricted? 
• Control Plane Protection: Are critical management systems isolated? 
• Detection & Response: Can suspicious movement be detected and contained quickly? 
• Operational Resilience: Can the network continue operating to support the business even during an active attack? 

The ultimate goal of lateral movement posture management is to minimize the blast radius of any attack and safeguard business continuity. Knowing what your network looks like to an attacker is a critical first step in strengthening cyber resilience and architecting for containment.  

Proactively Stop Lateral Movement with Zero Networks  

Zero Networks’ layered approach to lateral movement prevention closes long-standing security gaps and addresses emerging risks without creating operational complexity: automated, identity-driven microsegmentation closes the protocol exposure, reachability gaps, and privilege sprawl that enable lateral movement in modern environments, while deterministic, human-on-the-loop automation streamlines policy creation and enforcement without risking disruption.  

For a firsthand look at how Zero Networks makes threat containment an architectural feature, request a demo.  

In a recent webinar, Mythos and Daybreak: What Boards Are Asking and What to Actually Do About It, Zero Networks Field CTOs Chris Boehm and Albert Estevez explored why containment – not speed – is the only reliable advantage for defenders in the AI era. When lateral movement is blocked by default, it doesn't matter how fast an attacker finds a vulnerability or how quickly your team can patch. The breach is contained before it can spread into a crisis. 

We’ll unpack key insights from the session and walk through best practices for protecting your network against AI.  

Mythos and Daybreak: What They Are and Why They Matter for Security Teams  

Anthropic’s Mythos and OpenAI’s Daybreak are frontier AI models capable of finding, analyzing, and generating exploits for vulnerabilities at a speed and scale no human team can match. 

For example, Mythos found over 10,000 previously unknown vulnerabilities in seven weeks, including bugs that had evaded automated detection for decades. In a UK AI Security Institute evaluation, it successfully took over a simulated corporate network in 3 out of 10 attempts using only legitimate access paths.  

“In controlled evaluations where Mythos Preview was explicitly directed and given network access to do so, we observed that it could execute multi-stage attacks on vulnerable networks and discover and exploit vulnerabilities autonomously – tasks that would take human professionals days of work.”  

AI Security Institute  

Daybreak delivers a similar class of capabilities; while OpenAI’s model is also capable of delivering candidate patches, it’s still not possible to deploy every critical patch quickly enough to prevent exploitation.  

Chris Boehm: These are two frontier models that are so cutting edge, they're keeping them contained behind a wall. And one of the prime examples Anthropic brought up was finding 300+ vulnerabilities on Firefox in a very short period of time. The concern is: how do I stay on top of patch management and operations when this is happening? 

Frontier AI models didn't invent new attack techniques; lateral movement, credential abuse, and privilege escalation are well-known tactics. What has changed is the speed at which those techniques can now be applied against vulnerabilities that already exist in the environment – and the scale at which a capable attacker can identify them.  

Gartner noted after Mythos launched that "CIOs must tell their boards they will have to recalibrate their risk appetite for vulnerabilities because faster patch cycles won't be enough." Boards heard that message before most security teams had formed a response to it, leaving CISOs to face an evolving set of questions. 

AI Security Questions: What Are Boards Asking CISOs?  

As models like Mythos and Daybreak continue to dominate headlines, board-level questions for security leaders are increasingly focused on AI-era business resilience. 

Albert Estevez: The most common question I get when I visit customers is: as a company, how do we stop this type of attack inside our network? How will Mythos impact our infrastructure? And then there's the unbudgeted board mandate – go secure us against Mythos. 

Chris Boehm: If AI can find vulnerabilities in our environment at warp speed, how do we protect ourselves? And can you prove our investment is actually reducing the risk? Those are the questions security teams don't always have a crisp answer for. 

Security leaders that come back to the board with a patch acceleration plan are going to have a harder conversation than those who can explain why speed is no longer the variable that matters. 

Why Patching Faster Won’t Solve AI Threats  

According to the 2026 Verizon Data Breach Investigations Report, only 26% of critical vulnerabilities were fully remediated by organizations in 2025, and the median time for full resolution increased by nearly two weeks year-over-year.  

In other words, even before AI-enabled vulnerability discovery and exploitation burst onto the threat landscape, security teams have been struggling to keep up with patching. Frontier models have made traditional patching workflows an untenable solution.  

Albert Estevez: We cannot patch Mythos or Daybreak away. Discovery is infinite now. We can find thousands or even millions of new vulnerabilities every day. And the patching time we have is finite – it's impossible to digest all those patches, validate that a new patch isn't generating a business impact, and move fast enough. Even with prioritization, it will always be late. Because the time AI needs to generate an exploit will always be faster than the time you need to prioritize, test, and apply the patch. 

So, organizations now face an impossible tradeoff: patch immediately and manage updates that contain thousands of fixes at a time, or wait and prioritize while accepting risk exposure. In either case, operational continuity is at risk.  

OT and legacy systems can't always be patched on short notice without planning significant change windows that risk production impact. But leaving vulnerabilities uncovered is just as risky. Attackers can begin moving laterally in as little as 27 seconds, yet the mean time to identify a breach via vulnerability exploitation is 180 days. As AI accelerates exploit generation, that gap will only grow wider.  

Chris Boehm: Even if you have 90% detection, 90% analyst accuracy, 24/7 coverage, and fast response times – when you multiply all those numbers together, you still have a compounding failure rate. We're not blocking, we're not preventing. We're allowing attacks to go through even though we have most of what's necessary. The standard stack isn't enough anymore. 

There is no version of “respond faster” that gives defenders a reliable advantage over AI-enabled attackers. Instead, security teams need an architecture designed for containment to make speed irrelevant. 

Real-Time Threat Containment: Proactive Network Security   

Lateral movement is how attackers escalate a minor foothold into a business-disrupting breach – whether they get in via vulnerability exploitation, credential abuse, or any other initial access vector. The key to making an attacker’s speed irrelevant is building lateral movement prevention into the network architecture.  

Albert Estevez: We need to make the speed of detection and remediation totally irrelevant. How? By building an infrastructure that prevents lateral movement by design. If everything is locked down, it doesn't matter how fast you discover new vulnerabilities or how fast you need to patch them – your system will not allow any new connection that isn't already allowed. Stop running. Contain first. 

With this approach, attacker's speed advantage doesn't translate into business impact because there's nowhere to move in the first place. In a network where lateral movement is blocked by default and privileged ports are closed to all but explicitly authorized identities, a single compromised asset gives attackers very little access.  

Chris Boehm: If you actually contain and isolate appropriately, a hundred vulnerabilities discovered today wouldn't matter. You can go through your standard patch channels, do your testing and validation on your timeline, not theirs. You don't have to be in fear of a thousand patches dropping tomorrow. 

This same principle applies to the second distinct AI challenge organizations are navigating alongside attack acceleration: vulnerabilities created by AI already running inside the network. Employees are using unsanctioned tools, agents are operating with permissions nobody explicitly scoped, and every new connection represents a path attackers can exploit if it isn't governed. 

Albert Estevez: Shadow AI expands the attack surface. You need to govern those tools. Don't let users start using AI tools you haven't provided – you can't stop the adoption, but you can control what's sanctioned and what reaches what. Every agent needs an identity, scoped access, and defined communication paths. If you allow your AI agent to write to your database, the first question you should be asking is why. 

How to Measure AI Security: Metrics That Matter for Resilience  

Security teams have spent years reporting on alert volume, mean time to detect, and mean time to respond. In the context of AI-accelerated attacks, Estevez and Boehm argue those metrics are measuring the wrong thing. 

Albert Estevez: A year ago, customers were all talking about mean time to detect, mean time to respond. I would say ‘okay, mean time to be hacked. What is that time?’ Changing the mindset to contain first means asking: can my business keep running while I'm receiving an attack? The CEO and CIO don't care how long it took to identify something if they're already in the news. 

The metrics that map to board-level concerns include blast radius, mean time to contain, lateral movement scope, and uptime during cyber incidents.  

Chris Boehm: What if you don't have to respond because it's already been contained and isolated? That's what we're measuring now – mean time to containment, blast radius reduction, lateral movement scope, and whether I can prove my uptime stays intact during an incident. That's the shift from 'we saw a lot of alerts' to 'here's proof our architecture is working.' 

Zero Networks' Breach Map makes this visible in a way that resonates at the board level. A CISO can click on any user or device and see what that identity has access to with and without Zero Networks applied. A user with broad privileges might have access to dozens of workloads in an uncontrolled environment. With comprehensive microsegmentation, that scope narrows to only what they actively need and use, often by 90% or more. 

Chris Boehm: The beautiful paradox of microsegmentation is that when it's working well, you don't even notice it. So, we created a way for customers to actually see what it's doing – what their blast radius looks like with and without containment in place. Customers were asking: can you prove the difference of what you're doing? That's the answer. 

Building a Containment Architecture: Best Practices for Protecting Networks Against AI 

To minimize risk exposure in the AI era, security teams should focus on three key priorities: dynamically closing privileged ports, implementing identity-aware microsegmentation, and governing AI agents with identity-based policies.  

Over 70% of enterprise risk activity flows through admin protocols like RDP, SMB, WinRM, and RPC. By closing those lateral movement pathways with network-layer MFA, security teams ensure that administrators with an explicit business need can still get access – but only after identity verification, and only for a limited time.  

Albert Estevez: Imagine that in no time – one single click – you close access to those ports that don't need to be open 24/7. Now the vulnerabilities associated with those ports are blocked. Nobody can access them, exploit them, or bring credentials and try to use them, because those ports are closed behind a policy on the local server. You cannot exploit what is closed. 

Identity-based segmentation delivers the architectural controls to prevent unauthorized lateral movement. By leveraging deterministic, human-on-the-loop automation to create policies based on observed network behavior, organizations ensure granular segmentation won’t disrupt legitimate traffic, but it will break the attack chain.  

Albert Estevez: After you are segmented, an application can only communicate with these specific assets through these specific ports. There are no other endpoints available. You cannot scan the infrastructure to find vulnerabilities because everything is closed. Contained by default – you cannot discover or communicate with other parts of the network unless a policy explicitly allows it. 

Governing AI agents with the same identity-based, least-privilege controls that apply to human users ensures they can only reach what they explicitly need to reach, through the ports they're permitted to use. If an agent deviates from its approved communication baseline, the connection is blocked, drastically shrinking the agentic attack surface.  

These strategies give security leaders a clear, provable answer to questions about Mythos, Daybreak, and any other frontier AI models that may come next. In a network architected for containment, it doesn’t matter how many vulnerabilities are discovered – attackers still have nowhere to go.  

Network Security for the AI Era: Strengthening Cyber Resilience with Zero Networks  

Mythos and Daybreak have set a new capability baseline. The organizations that remain resilient in this evolving threat landscape will be the ones that respond with something more durable than an accelerated patching plan: lateral movement is blocked by default, and we can show exactly how far any attacker could go. 

Zero Networks’ automated, identity-based microsegmentation stops lateral movement and contains any attack – human or AI – to keep the business running. With Zero, security teams get complete AI visibility, deterministic control, and built-in containment to neutralize the risk of machine-speed vulnerability discovery and exploitation.  

To see how Zero Networks gives defenders the advantage in an era defined by Mythos and Daybreak, request a demo.  

If you prevent lateral movement structurally, breaches are automatically contained by the network architecture, ensuring critical operations continue running through cyber incidents. We’ll explore some of the most common lateral movement techniques and offer tips to block attack paths in real time.   

What Are Lateral Movement Techniques? 

Lateral movement techniques are the methods cyber attackers use to move through a network after gaining initial access. These tactics help them:  

• Deploy persistence mechanisms to maintain access  
• Escalate privileges 
• Discover new systems and credentials  
• Reach high-value targets (like domain controllers or sensitive databases)   

Lateral movement is so pervasive that the MITRE ATT&CK framework classifies it as one of the core tactics used in modern cyberattacks. While a hacker may gain access to the network from phishing or compromised credentials, lateral movement techniques are how an initial breach cascades into an enterprise-wide crisis.

Common Lateral Movement Techniques 

Though cyber threats are constantly evolving, many common lateral movement techniques fall into broad categories like:  

• Session hijacking: Attackers take control of existing sessions with remote services  
• Remote services: Using valid accounts, attackers log into services that accept remote connections and perform actions as the logged-on user 
• Alternate authentication: Attackers bypass normal controls through the use of materials like password hashes, access tokens, and Kerberos tickets  

Other lateral movement techniques fall outside of these groups but can prove equally destructive. And in fact, attackers rarely rely on a single technique; instead, they often string tactics together to stay undetected and maintain momentum.  

Living off the Land (LotL) 

Instead of deploying external tools, attackers use built-in utilities like PowerShell, PsExec, or Windows Management Instrumentation (WMI) to move laterally with LotL attacks. Because these tools are part of the operating system, their use blends in with regular network traffic, making this tactic especially challenging to detect.

In fact, in a Red Team Assessment Report, CISA concluded that heavy EDR reliance creates insufficient protection to stop all living-off-the-land attacks. With malware-free attacks now comprising 82% of cyber incidents, proactively blocking lateral movement rather than relying on alerts is more important than ever.  

AI-Driven Lateral Movement (AILM) 

AI-driven lateral movement or AI lateral movement (AILM) is a tactic where adversaries use AI to accelerate the attack chain – achieving impossibly fast breakout times as a result – or weaponize overprivileged AI agents’ legitimate connections to pivot between systems.   

In other words, AILM encompasses two distinct vectors: AI-accelerated lateral movement, where attackers use AI to expedite established lateral movement techniques, and agent-induced lateral movement, where attackers exploit AI agents’ legitimate connections as a new attack surface.  

Compromised Credentials 

Simple or reused passwords make it easy for hackers to guess, brute-force, or reuse credentials across multiple systems; 80% of attacks leverage stolen credentials at some stage. Once they access one asset, attackers often use those same credentials to pivot to others.   

Compromised credentials are particularly risky in this era of excessive privileged access and machine identity sprawl. Ninety-nine percent of users, roles, and services hold excessive standing permissions, often unused for 60+ days. Meanwhile, machine and service identities – which are notoriously over-permissioned and under-monitored – outnumber human identities 109:1, a trend that’s only accelerating amid a massive influx of AI agents in enterprise environments.  

Pass-the-Hash (PtH) Attacks and Pass-the-Ticket (PtT) Attacks  

In a PtH attack, adversaries use a hashed version of a password to authenticate without decrypting it. This technique is especially effective in environments that use NTLM; according to Zero Networks’ Lateral Movement Exposure Report, 43% of internal authentication still relies on NTLM.

PtT attacks use stolen Kerberos tickets to impersonate users and access systems without needing passwords, enabling access to sensitive internal services. In a Golden Ticket attack, the ticket granting ticket (TGT) is stolen, allowing attackers to impersonate any user; Silver Ticket attacks steal service tickets, which enable more limited authentication. 

Internal Spear Phishing  

After gaining access to an account, attackers send convincing phishing emails from within the organization to carry out this lateral movement technique. This tactic is more likely to succeed due to the internal sender and known context. 

Kerberoasting 

This technique involves requesting service tickets for accounts with access to a particular service and attempting to crack them offline. Service accounts with weak passwords are frequent targets, especially when they hold administrative privileges. Kerberoasting is stealthier than a PtT attack since it doesn’t generate unusual network activity.  

Credential Dumping  

Credential dumping extracts usernames, password hashes, or plaintext credentials from memory, local files, or the registry. The credentials are then used in other lateral movement techniques, such as PtH attacks, PtT attacks, or RDP login attempts. 

Remote Desktop Protocol (RDP) and Windows Remote Management (WinRM) 

Two examples of remote services exploitation, RDP and WinRM attacks use stolen credentials to remotely access systems and perform actions as the logged-on user. Zero Networks’ 2026 Lateral Movement Exposure Report found that 87% of monitored servers accept internal RDP or SSH traffic; without strong controls like MFA, this movement can remain undetected for long periods.  

Server Message Block (SMB)  

Another technique involving remote services, this method allows attackers to interact with a remote network share by logging in with stolen credentials. Over 75% of servers are reachable over SMB and WinRM, and since the SMB protocol is primarily used to access files, printers, and serial ports, it’s an easy way for attackers to move laterally through a network. In fact, more than 70% of enterprise threat activity flows through just four privileged management protocols: SMB, WinRM, RDP, and RPC. 

SSH Hijacking 

Attackers can hijack active SSH sessions to gain the same access held by the original user and remotely execute commands on a system. Because it leverages a legitimate user’s existing SSH session to move laterally, this technique often allows adversaries to go undetected.  

Lateral Movement Protection: Why Detection-only Strategies Fall Short  

Many organizations rely on tools like endpoint detection and response (EDR) systems or security information and event management (SIEM) platforms to detect lateral movement. While detection is important, it’s an incomplete strategy for preventing unauthorized lateral movement and protecting business continuity.   

Once attackers are inside a network and moving laterally, the window to contain them narrows quickly – detection often takes too long to prevent damage. Attackers can begin moving laterally in as little as 27 seconds, and with so many lateral movement techniques involving native tools or valid accounts, malicious behavior can be hard to distinguish from legitimate activity. Because of this, there’s a massive gap between machine-speed lateral movement and the 241 days it typically takes to identify and contain a breach.  

Instead of relying solely on detection, organizations must also find ways to prevent lateral movement entirely, proactively strengthening cyber resilience so security teams can shift to containing threats rather than chasing them.  

How to Block Lateral Movement Techniques in Real Time  

Patching entry points won’t effectively prevent lateral movement; to block attackers’ favorite techniques, organizations have to eliminate the internal pathways attackers rely on. The most effective strategies combine network segmentation, identity controls, and real-time access enforcement. 

Key approaches to eliminate lateral movement span:  

• Microsegmentation: Enforce least-privilege access to limit communication between systems to what’s explicitly allowed, isolating every asset to leave hackers stranded.   
• Multi-factor authentication: Apply MFA to privileged ports and services inside the network, making lateral movement techniques that rely on stolen credentials ineffective.  
• Identity-based access controls: Grant access based on verified identity and purpose, not just IP address or location. 
• Automate policy management: Leverage automation-enabled solutions to dynamically generate rules based on observed behavior and continually update policies as the environment evolves.   

Even if attackers manage to breach the network, measures like these cut off their pathways and ensure cyber incidents stay isolated. 

Stop Lateral Movement Before It Starts with Zero Networks  

Zero Networks turns lateral movement pathways into dead ends with automated, identity-based microsegmentation. By orchestrating native firewalls to secure every asset, applying just-in-time MFA at the network layer, and automatically enforcing adaptive policies that evolve alongside your network, Zero ends privilege escalation and maintains dynamic granular controls.   

Protect your network from today’s most common lateral movement techniques while future-proofing your security strategy against new threats – request a demo to learn how.  

Cybersecurity teams know that preventing lateral movement is key to stopping minor cyber incidents before they escalate into enterprise-wide disruption, but applying controls robust enough to effectively halt attackers has historically been considered too complex and disruptive.    

To clarify the destructive network security risks lateral movement poses – and how to prevent them entirely – we’ll explore the underlying vulnerabilities that enable lateral movement, how attackers exploit them, the growing threat of AI-driven lateral movement (AILM), and practical strategies to proactively lock down lateral movement.  

What Is Lateral Movement? Definition, Causes, and Examples

Lateral movement in cybersecurity is the tactic attackers use to move “sideways” (East-West) across the network after gaining initial access, often in search of sensitive data and assets. In other words, lateral movement is how attackers turn a small foothold with minimal access into a widespread security breach impacting business-critical systems. In fact, lateral movement is so pervasive that the MITRE ATT&CK framework classifies it as one of the core tactics used in modern cyberattacks.  

From Compromise to Privilege Escalations: What Causes Lateral Movement?

Lateral movement starts with an initial compromise; today, the most common initial access vectors are vulnerability exploitation, phishing, and credential abuse. With that first foothold, attackers can move laterally through the network when controls aren’t sufficient to stop privilege escalation.  

According to Zero Networks’ analysis of 5.4 trillion activities across 312 enterprise environments, the top 10 risks that enable lateral movement are:  

1. Broad Internal Admin Protocol Exposure 
2. Excessive Internal Reachability 
3. Excessive Privileged Access 
4. Overprivileged Service Accounts 
5. Legacy Authentication Paths 
6. Exposed Control Plane Infrastructure 
7. Internal Vulnerability Pivoting 
8. Lack of East-West Visibility 
9. Single Endpoint to Critical Asset Reachability 
10. Poor Containment Readiness 

These risks represent the structural exposures most responsible for converting a single compromise into enterprise-wide impact. 

Lateral Movement Examples: Notable Incidents

High-profile breaches often use lateral movement to expand blast radius and access critical assets; notable examples include:

• MITRE/Ivanti breach: In January 2024, MITRE’s network was compromised through two zero-day vulnerabilities in Ivanti VPN solutions. The attackers moved laterally through the network by leveraging a compromised admin account, establishing persistent access and harvesting credentials. This breach highlighted the importance of prevention in network security strategies, rather than overreliance on detection and response.
• Change Healthcare ransomware attack: Shortly after the MITRE/Ivanti breach, Change Healthcare was targeted by the ALPHV/Blackcat ransomware group, resulting in the exfiltration of 4TB of data. The attackers infiltrated the network by exploiting compromised credentials; after that, they deployed ransomware and demanded a hefty ransom.
• AT&T breach: In 2024, AT&T confirmed that a threat actor had gained unauthorized access to internal systems by using stolen credentials associated with a third-party vendor. Once inside, the attacker moved laterally to access and exfiltrate customer data, including passcodes and Social Security numbers. The breach underscored a critical gap: MFA was not in place for the compromised entry point. With network-layer MFA and strict privilege enforcement, the attacker’s access could have been blocked before any data was exposed.

What Types of Cyberattacks Use Lateral Movement?

Many attacks rely on lateral movement to maximize their scope and achieve a specific goal. Some attack types that commonly involve lateral movement are:

• Ransomware: To demand the highest possible payout, ransomware aims to infect and encrypt as many systems as possible. Lateral movement enables ransomware to spread rapidly across the network, reaching critical assets and increasing pressure to pay.
• Data Exfiltration: Once inside the network, attackers move laterally to locate sensitive data like personal records, IP, or financial information before transferring it outside the network for ransom, sale, or public exposure.
• Botnet Infection: Lateral movement helps attackers quietly add devices to a robotic network (botnet), growing their control before launching larger-scale operations like distributed denial-of-service (DDoS) attacks.

Critically, lateral movement isn’t just a supporting tactic, it’s the key mechanism for turning small compromises into large-scale incidents.  

Why Does Lateral Movement (Still) Happen?

Lateral movement isn’t a new concept, yet it remains a tried-and-true technique in cyberattacks. Why? It essentially comes down to complexity – both of modern environments and the solutions designed to secure them.   

Still, security leaders working in sectors that mandate robust security postures can’t afford to leave lateral movement unchecked. As Aaron Steinke, Head of Infrastructure at La Trobe Financial put it, “We’re a financial institution, we are very paranoid, that’s the nature of working in finance. Getting control over lateral movement in our network is really essential, and it’s a hard thing to do.”   

Between hybrid system sprawl, vulnerable privileged accounts, and traditional segmentation solutions too complex to deploy at scale, lateral movement remains a pressing cybersecurity risk – one that’s only growing more urgent in the AI era.  

The Growing Threat of AI-Driven Lateral Movement (AILM) 

AI-driven lateral movement or AI lateral movement (AILM) is a tactic where adversaries use AI to accelerate the attack chain – achieving impossibly fast breakout times as a result – or weaponize overprivileged AI agents’ legitimate connections to pivot between systems.   

As AI adoption proliferates, innovation has outpaced security and rapidly expanded attack surfaces. As a result, 57% of organizations have already seen an uptick in security incidents linked to AI usage; nearly two-thirds of organizations don’t have the necessary policies to manage AI or detect shadow AI.   

In many cases, AILM isn’t functionally different than any other type of lateral movement – it’s just far faster. Attackers weaponize the same network vulnerabilities that have always existed, compounded by excessive permissions for AI agents, to expand breach impact faster than any human response cycle can match.  

Microsegmentation is the gold standard in locking down lateral movement, but traditional tools left it out of reach for many organizations.  

Legacy Microsegmentation Implementation Challenges

Unlike traditional network segmentation strategies – which involve dividing a large network into smaller subnetworks, or segments – microsegmentation is a much more granular and robust process that isolates all clients, workloads, applications, virtual machines, and operating systems into segments with individual security perimeters.

In other words, if an attacker manages to access a microsegmented network, they’ll find themselves immediately stranded. The only problem is: legacy microsegmentation solutions are typically so complex that many implementations stall or fail outright.

Nicholas DiCola, VP of Customers at Zero Networks summed up this problem: “Networks are too open, and accounts are too permissive. Once you’re inside the network, it’s very easy for an attacker to move laterally. How do we stop lateral movement? The root way to stop that is by microsegmenting the network – there were some companies out there that were doing that already, why were they not successful? What’s missing? It’s too hard, it takes too much time.”

These labor- and time-intensive implementations are why just 5% of organizations are microsegmenting their networks today, despite grasping the importance. Traditional microsegmentation solutions often require:

• Significant manual work: From manual asset tagging and grouping to policy creation and management.
• Long implementation times: As DiCola said, “Most CISOs move every three to five years on average – they start these projects that don’t even finish by the time the CISO leaves because it just takes a lot of human effort to manage.”
• Agent-based architecture: Since most traditional solutions require installing agents on endpoints, scaling, configuration, and maintenance is difficult.

Although microsegmentation is an accepted best practice for locking down lateral movement, the complexity of legacy solutions has long outweighed the potential benefits.

Privileged Account & Identity Threat Vulnerabilities

Once inside a network, attackers often seek to escalate privileges, exploiting admin and service account vulnerabilities, misconfigurations, or stolen credentials. Weak identity controls make it easier for attackers to:

• Leverage excessive logon permissions
• Use pass-the-ticket, golden ticket, Kerberoasting, and other attacks
• Move laterally across the network without raising alarms

Without strict identity and access controls, hackers don’t have to break in – they can log in. Since the process is generally manual, lengthy, and complex, governing access rights remains a challenge for organizations trying to lock down lateral movement.

How to Detect and Prevent Lateral Movement

Lateral movement happens fast – in this era of AI-accelerated attacks, cyber adversaries can begin moving laterally less than 30 seconds after gaining initial access. That means security teams must shift from reactive alerts to proactive control, prioritizing robust prevention strategies that contain threats before they escalate on top of the detection techniques most organizations already have in place.  

Detecting Lateral Movement

Attackers work hard to stay under the radar, blending in with legitimate traffic and using native tools to avoid triggering alerts. To catch them in time to prevent damage, organizations must deploy layered detection techniques capable of identifying subtle anomalies:  

• Real-Time Monitoring: Detection hinges on recognizing deviations from normal behavior. Always-current network visibility enables teams to recognize suspicious patterns that don’t match documented baselines. Ideally, a visibility tool should be integrated into a platform that also enables real-time enforcement, enabling security teams to quarantine threats in a click.  
• Behavioral Analytics: Machine learning models trained on user behavior can identify deviations like unusual login times, odd file access patterns, or abnormal administrative actions – all signs of potential lateral movement.  
• SIEM & Log Analysis: Security Information and Event Management (SIEM) platforms correlate logs and events across the network, detecting unusual patterns and surfacing potential lateral movement paths.   
• Network Traffic Analysis (NTA): NTA tools evaluate network flow and flag anomalies that could suggest unauthorized East-West traffic, leveraging algorithms to distinguish normal network behaviors from harmful activities.   
• Endpoint Detection and Response (EDR): EDR systems monitor endpoint and network events, helping teams investigate access attempts to high-value systems and track attack progression.  
• Deception Technology: Honeypots and decoy systems lure attackers into revealing their presence, offering early detection of lateral movement activity with minimal risk.  
• Log Management: Centralized log management and analysis solutions sift through access patterns to catch potential privilege escalations or stealthy jumps across systems.  

While lateral movement detection is an important component of a well-rounded cybersecurity strategy, relying too heavily on detection is risky – alerts often arrive too late, don’t fire at all, or don’t add meaningful value. In fact, just 30% of alerts translate to real risk reduction as many attackers move laterally in the shadows.  

Preventing Lateral Movement

Preventing lateral movement outright is the most effective way to stop an attack before it spreads. An ideal prevention strategy combines network controls, identity governance, and automation to seal off potential pathways and reduce the blast radius of a breach.  

Security teams can proactively block lateral movement by:   

• Embracing modern microsegmentation: As we’ve already established, microsegmentation is a powerful way to limit communication between assets unless explicitly allowed. By isolating systems into smaller, controlled network zones, organizations can ensure that even if one system is compromised, the attacker can't easily pivot to others.  Modern microsegmentation reduces the complexity of legacy approaches by integrating directly with existing infrastructure, orchestrating native firewall rules, and eliminating manual work from implementation and ongoing maintenance with robust automation.   
• Automatically enforcing dynamic policies: Static policies can’t keep up with today’s fluid IT environments. Instead, security teams should adopt automated policy creation and enforcement, where rules are generated based on observed behavior and continually updated as the environment evolves.   
• Enforcing least privilege access: User permissions should be tightly controlled using the principle of least privilege (PoLP). Each user, device, AI agent, or application should only have access to the resources required for their role or function. This minimizes opportunities for attackers to exploit over-privileged accounts during a lateral move.  
• Integrating MFA across the network: Beyond user logins, MFA can be applied to critical systems and privileged ports. This approach ensures that even if credentials are compromised, access isn’t granted without a second form of verification, dramatically reducing the attacker’s ability to move laterally.  
• Adopting a Zero Trust mindset: The zero trust model assumes that every device, user, and connection is untrusted until verified – a mindset aligned with this model requires that security accept breaches as inevitable. In practice, this means consistently verifying identity, limiting access, and segmenting network traffic to neutralize threats and stop lateral movement before it begins.  
• Building a layered defense: To truly prevent lateral movement, organizations must adopt 3D network security that not only safeguards against East-West movement, but that also minimizes attackers’ entry opportunities with robust North-South protection (barring entry from the outside world), and Up-Down protection that dynamically controls access to sensitive areas of the network based on identity.   

With strategies like these, security teams can finally control lateral movement before a breach becomes a disaster.   

Stop Lateral Movement in Real Time with Zero Networks

Zero Networks makes lateral movement a relic by delivering automated, identity-based microsegmentation that automatically contains threats to the point of initial access. Unlike the legacy solutions with complex, never-ending implementations, Zero Networks goes live in days – not years – and enforces least privilege access at scale.  

Here’s how Zero Networks locks down lateral movement in record time:

• With automated asset tagging, grouping, and policy creation and management, Zero generates deterministic, fine-grained rules – no complex configurations required.
• Our infrastructure-agnostic solution orchestrates native firewalls to secure every asset and integrate seamlessly into existing environments – without the manual complexity of traditional solutions
• Just-in-time MFA applied at the network layer keeps privileged ports closed until verified, shutting down credential abuse and privilege escalation
• With adaptive policy enforcement, Zero dynamically maintains granular controls that evolve alongside your network

Modern cyber attackers don’t stop at the perimeter – neither should your defenses. With Zero Networks, it’s easier than ever to build a proactive, layered defense that halts lateral movement and leaves hackers stranded – request a demo to learn more. 

As boards look for validation that security investments translate to uptime protection, security leaders need more than a Zero Trust strategy – they need a resilient architecture that enforces that strategy, and the outcomes to prove it.  

But most security programs are still reporting on detection-centric metrics like alert volume that measure activity rather than impact. To effectively measure cyber resilience and communicate the ROI of Zero Trust investments, security teams need outcome-oriented metrics tied to operational continuity.  

We’ll walk through the cyber resilience metrics that demonstrate Zero Trust maturity, share strategies for leveraging a business impact analysis (BIA) to assess resilience, and lay out best practices for tying security investment to business outcomes.  

Zero Trust and Cyber Resilience: How Do They Connect?  

Zero Trust and cyber resilience are built on the same foundational assumption: that compromise is inevitable. Where they differ is in emphasis – Zero Trust is a security philosophy that removes implicit trust, while cyber resilience is the business outcome that philosophy is meant to produce. 

In other words, a Zero Trust architecture is how security teams implement the “never trust, always verify” philosophy across key pillars; cyber resilience is the so what – the underlying objective to absorb any attack without disrupting the business.

How Zero Trust Drives Cyber Resilience Outcomes  

In a typical attack, adversaries gain a foothold, move laterally through the environment, and escalate privileges to reach high-value systems. Unrestricted lateral movement is what turns a minor cyber incident into a major operational disruption.  

Zero Trust eliminates the conditions that make attack progression possible by enforcing least privilege access across every identity and communication path, requiring explicit verification for every connection, and closing internal access by default. In other words, Zero Trust security strengthens cyber resilience by promoting proactive controls across every layer of network traffic. 

When lateral movement is structurally constrained, attackers have no way to expand their footprint – blast radius stays small and critical operations continue running.  

While properly implemented Zero Trust controls directly lead to cyber resilience, those outcomes are only provable when security leaders measure and report on the right metrics.   

4 Cyber Resilience Metrics Security Leaders Should Track  

Most security teams default to metrics that are easy to capture, like alert volume, detection coverage, or patch rates. But detection-centric metrics quantify security activity, not outcomes. 

To effectively measure cyber resilience, security leaders have to begin tracking metrics that signal minimized impact from breaches and downtime avoided – prioritize reporting on these four dimensions to translate the business value of security spending.  

1. Blast Radius: Reducing the Potential Damage of a Breach  

Blast radius refers to the total scope of potential damage resulting from a breach – it’s defined by the breadth of systems an attacker can reach, the volume of data they can access or encrypt, and the operational disruption they can trigger from a single foothold.  Most enterprise networks operate with uncontrolled blast radius – a single compromised system can enable access to 85% of the environment within one hop, which is why 86% of cyber incidents now cause operational downtime, reputational damage, or both.  

A mature Zero Trust architecture shrinks blast radius by design: microsegmentation isolates assets into secure zones and identity-based access controls enforce comprehensive least privilege, creating a closed-by-default network. By tracking how blast radius contracts over time, security leaders can clearly demonstrate that controls are effectively preventing a minor breach from cascading into an operational crisis. 

2. Lateral Movement Pathways: Containing Attackers by Default  

Most enterprise networks accumulate excessive internal access paths over time through legacy configurations, over-scoped permissions, and standing privilege that outlives its purpose. With every lateral movement pivot across one of these pathways, attackers capitalize on an uncontrolled blast radius.  

Tracking lateral movement pathways as a measure of cyber resilience requires actively quantifying how many internal communication routes exist that aren't operationally justified and deliberately reducing that number. Fewer pathways mean less room for attackers to operate, which directly translates to smaller blast radius and faster containment when incidents do occur. Reporting on the reduction in open lateral movement pathways over time demonstrates proactive cyber resilience via structural risk reduction before an incident occurs.  

3. Time-to-Containment: Stopping Attacks in Real Time  

Time-to-containment measures how quickly a breach is locked down after initial access. The faster an attack is contained, the less likely it is to have a significant operational impact. Many organizations still rely on manual detection and response workflows, and it shows: the mean time to contain (MTTC) a breach is 60 days – on top of the 181 days it takes to detect a breach in the first place.  

When internal access is closed by default and lateral movement pathways are governed by identity controls enforced at the network layer, containment doesn't wait for an analyst to act – it's a built-in property of the network itself. Tracking time-to-containment clearly demonstrates the shift from reactive coordination to architectural enforcement, validating that security investment is reducing operational exposure and not just improving detection scores. 

4. Uptime and Continuity During Cyber Incidents 

Operational uptime during a cyber incident is the most direct business-facing resilience measure – and the one that resonates most at the board level. When critical services continue running through a breach, the organization has demonstrated true cyber resilience under pressure.  

Tracking this metric starts with knowing what "critical" means in your environment: which services cannot tolerate disruption, what their maximum tolerable downtime is, and which systems and dependencies they rely on. Using a business impact analysis (BIA) to build that foundation, security leaders can tailor enforcement to identified business priorities and prove alignment by measuring uptime as a consistent post-incident benchmark. Over time, a strong uptime record during incidents is the most compelling evidence a security leader can bring to a board conversation about whether Zero Trust and cyber resilience investments are working. 

How to Conduct a Cyber Resilience Assessment 

Measuring cyber resilience requires a baseline. To establish it, security leaders need a structured assessment grounded in business priorities, not just technical exposure. CISOs can take a BIA from documentation to enforcement in three steps: identifying what matters most to the business, mapping exposure to those priorities, and building the controls to proactively close attack paths. 

Step 1: Identify Critical Assets and Quantify Business Exposure 

Before any technical measurement is possible, security leaders need organizational alignment on what actually matters. For each asset, the goal is to understand its criticality across five dimensions: 

Regulatory classification: Would a breach trigger reporting obligations, fines, or disclosure requirements? 

• Revenue exposure: Would downtime disrupt goods, services, or measurable revenue streams? 
• Financial sensitivity: Does the asset have the ability to issue or redirect payments? 
• Customer notification burden: Would a compromise require customer notification that could damage relationships?  
• Reputational sensitivity: Does the asset touch communications, brand, or the organization's core value proposition? 

With a prioritized critical asset inventory and a business exposure profile for each, security leaders establish the foundation for effectively assessing cyber resilience.  

Step 2: Map Attack Paths and Baseline Controls  

Once critical assets are identified, the security team's job is to map realistic paths from common ingress points, such as a compromised user, compromised cloud identity, technical perimeter entry, or trusted third-party access. For each path, the analysis documents three dimensions: 

• Path distance: How many network segments, authentication boundaries, or inspection points sit between the ingress point and the critical asset? Fewer barriers mean bigger blast radius.  
• Privilege requirements: How many escalation steps does an attacker need? Vulnerabilities like persistent privileged access, over-scoped service accounts, and cached credentials can collapse multiple escalation steps into one. 
• Data layer controls: If an attacker reaches the critical asset, what limits what they can do? For example, identity-based access controls can reduce the business consequences of a breach, even when an attacker gets inside the network.  

This analysis delivers clarity around the enterprise’s highest-cost path: the easiest attack against the costliest asset, which represents the most urgent starting point for investment. 

Step 3: Prioritize Structural Controls and Measure Progress 

With paths mapped and exposure quantified, security leaders can easily prioritize investments and report on their impact. Structural controls that increase path distance, such as network segmentation or just-in-time authentication boundaries are the highest-leverage interventions because they can eliminate entire compromise scenarios.  

Critically, each control should be tied back to the business priorities identified in Step 1: which attack path does it break, which critical asset does it better protect, and how does it reduce business exposure? That direct line from investment to risk reduction is what makes budgetary conversations concrete and cyber resilience metrics meaningful. 

As Zero Trust maturity advances, the Step 2 analysis should be re-run. When attack paths get longer (or disappear), escalation requirements increase, and blast radius contracts, CISOs gain the evidence they need to prove that a cyber resilient architecture has delivered meaningful business value.  

Build a Cyber Resilient Architecture with Zero Networks  

Zero Trust security maps directly to meaningful cyber resilience outcomes, but most teams struggle when it comes to implementation – 88% of CISOs report significant challenges operationalizing Zero Trust, and the gap between strategy and structural enforcement makes it difficult to prove the value of cyber resilience investments.  

Zero Networks closes that gap with automated, identity-based microsegmentation. Zero provides immediate visibility into every identity and asset on the network, then automatically enforces adaptive, identity-aligned policies that prevent lateral movement by default. The average Zero customer achieves 90%+ segmentation within 90 days, fast-tracking Zero Trust maturity to preserve uptime, protect revenue, and strengthen cyber resilience.  

Find out how Zero Networks can help you build a cyber resilient architecture with measurable business value – request a demo.   

As AI usage outpaces governance, nearly two-thirds of organizations don’t have the necessary policies to manage or detect shadow AI. The challenge for security leaders is twofold: uncovering unsanctioned AI usage in the first place, then implementing controls to effectively secure AI.  

We’ll provide a comprehensive overview of shadow AI, how it’s contributing to an evolving threat landscape, and what security leaders can do now to detect and govern AI across the environment.  

What Is Shadow AI?  

Shadow AI refers to the use of any AI tool or application without formal IT and security oversight or approval.  

Examples of shadow AI can include everything from unsanctioned generative AI platforms accessed on corporate devices and AI agents deployed by developers without security visibility to autonomous workflows embedded in third-party software and LLM integrations that live inside tools organizations already trust.  

Cyber pros aren’t strangers to the challenge of securing unseen and unsanctioned tech after years of contending with shadow IT, but the AI era has added urgency to this fundamentally familiar threat.  

AI Security Risks: Expanding Attack Surfaces, Lateral Movement, and Compliance Gaps 

Cyber risks related to AI vulnerabilities rank as organizations’ fastest growing concern, but most security teams don’t have the necessary capabilities to effectively control AI – traditional tools were designed for a different threat model. 

For example, application-layer controls see managed endpoints and known SaaS traffic routed through a proxy. They were built to govern what human users access through browsers and approved applications, not to see what AI agents access through APIs, what machine identities are doing across cloud workloads, or how AI capabilities embedded in sanctioned tools are behaving on the network. That enforcement blind spot is what makes shadow AI so risky, leaving security teams to manage:  

• Access path proliferation: Every unsanctioned AI tool creates new connections to corporate data, external APIs, and internal systems that are often undocumented, over-permissioned, and persistent. AI agents compound the problem as they accumulate permissions over time through policy drift, tool chaining, and expanding task scope, frequently without security team visibility.  
• Lateral movement exposure: Shadow AI tools and agents typically operate with implicit trust inside the network, contributing to a rapidly expanding AI attack surface. In environments where a single compromised host can reach 85% of internal systems in the first hop, over-privileged and under-monitored AI creates a new lateral movement highway adversaries can exploit without triggering alarms. 
• Cyber compliance gaps: Organizations subject to frameworks like NIS2, DORA, or CIS Benchmarks cannot demonstrate policy adherence for connections they don't know exist. In other words, shadow AI creates operational and regulatory exposure that only compounds over time as AI usage scales. 
• The collective result? Security incidents linked to AI usage are skyrocketing, with 57% of organizations already reporting an uptick – and the impact is quantifiable. The average cost of a data breach is $670,000 higher for organizations with high levels of shadow AI, and it takes 247 days to identify and contain a breach involving shadow AI.  

To effectively address AI security risks before they spiral into disruptive breaches, teams need both comprehensive visibility and network-layer control. 

How to Detect Shadow AI: Real-Time Network Visibility  

Most detection tools are calibrated to catch anomalies that shadow AI doesn’t produce. When an employee accessing an unsanctioned AI service looks like ordinary web traffic, organizations can’t rely on alerts and dashboards built for a different threat landscape to uncover shadow AI.  

Instead, security teams need continuous, live visibility into every asset and identity on the network, delivering the granular clarity to answer three key questions:  

1. Which SaaS AI destinations are users and devices reaching? If an organization has standardized on Copilot, nothing on the network should be reaching ChatGPT, Gemini, or other unapproved services. Real-time traffic visibility surfaces misalignment between AI policies and behavior, making enforcement possible the moment an unauthorized connection appears, not after a log review. 
2. Which AI agents are running and what are they connecting to? In many environments, AI agents are deployed by developers and business units without security team visibility, meaning there's no reliable inventory of what's running, what it's authenticating to, or what it can reach. Real-time visibility into asset-to-asset and identity-to-asset communication allows teams to identify and govern AI agents before they become a liability.  
3. Where does AI access exceed operational need? Even sanctioned AI can lead to hidden vulnerabilities – for example, an agent might be deployed for a narrow task but connecting to a CRM, a production database, and a set of external APIs. When the gap between operational need and real-world connectivity remains invisible, it can’t be mitigated. 

Visibility into every AI tool and agent across the environment is a critical starting point, but it must feed directly into control.  

Securing AI: 4-Step Framework for Visibility and Control 

Security teams understand the urgent need to detect shadow AI, but seeing the full scope of exposure is only valuable when that visibility drives enforcement. Rather than prioritizing shadow AI detection in a vacuum, leverage this four-step approach for translating real-time network visibility into enforceable controls that govern every AI tool, agent, and integration in the environment. 

1. Maintain a Real-Time Inventory of AI in Your Environment   

Start by implementing continuous network monitoring that maps every AI-related identity, tool, and connection in the environment through observed traffic rather than relying on declared inventories or deployment logs. This end-to-end visibility forces shadow AI into the spotlight, enabling security policies tailored to network realities rather than best guesses or point-in-time snapshots.  

2. Block Unsanctioned AI by Default  

Define an approved list of cloud AI services and automatically block any connection to a SaaS AI destination outside of that list. With network-layer enforcement, security teams can ensure policies are applied universally across users, devices, and workloads regardless of how they're connecting. 

3. Govern AI Agents with Least Privilege Policies 

Every AI agent running in your environment is a process with an identity – like any other identity, agents should only be able to reach what’s explicitly necessary. Apply identity-based access controls to every AI agent in the environment with permissions tightly scoped to operational need.  

4. Automate AI Security Policy Lifecycles  

As the network changes, security gaps can emerge if AI governance relies on manual upkeep. Automated policy lifecycle management – powered by a deterministic, human-on-the-loop engine – adapts controls as the environment evolves, enforcing access deterministically and continuously without creating long-term operational debt.  

Identify, Segment, and Contain AI with Zero Networks  

With Zero Networks, security teams can easily uncover shadow AI and gain true control over the AI running in their environments. Zero’s AI Segmentation capabilities deliver complete AI visibility, deterministic enforcement, and built-in control to transform AI from a risk into a governed, enforceable part of the environment:  

• SaaS AI Control governs which cloud AI services users and devices can access, automatically blocking every unapproved destination. 
• AI Agent Control applies the same identity-based least-privilege controls governing every user and device to every agent in the environment. 
• AI Lateral Movement Control eliminates the open network that compromised AI tools and agents would otherwise move through by enforcing granular least privilege access controls everywhere.  
• LLM Protection segments the model infrastructure at the network layer so only authorized systems can reach it. 

Learn how you can detect shadow AI and scale network-layer security policy enforcement to achieve true control with Zero Networks – request a demo.