Stop Lateral Movement, Start Your Weekend: A Defender’s Mind Meld

Summary

Security spending keeps rising, yet breaches, breach costs, and analyst burnout keep climbing, because most defenses focus on detecting attacks rather than preventing attackers from spreading. In this Black Hat webinar, Zero Networks co-founder and CTO Amir Frankel and VP of Customers Nicholas DiCola explain why lateral movement is how attackers win, from a 51-second breakout record to an Akira ransomware attack that bypassed EDR through an unsecured webcam, and why automated microsegmentation changes the equation. Closing privileged ports by default, opening them only through just-in-time MFA, and automating rule creation lets organizations segment their environments in months rather than years, with less than one full-time employee.

Key takeaways

• Cybersecurity spending reached about $215 billion, up 43% since 2021, while reported breaches and the average breach cost of about $4.8 million keep rising.
• Detection alone isn’t working: breaches take about 194 days to identify, roughly one in five ransomware attacks exfiltrates data within an hour, and the fastest recorded lateral movement took 51 seconds.
• Attackers bypass EDR by moving laterally through unprotected devices, as in an Akira ransomware attack that pivoted through an unsecured webcam.
• Microsegmentation would have stopped that attack chain by closing the network ports the attacker needed, containing them on the first host.
• Most IT professionals say microsegmentation is a must, yet few organizations have done it, because legacy tools were complex, manual, and costly.
• Automation changes that: Zero Networks builds rules for assets and identities, keeps privileged ports closed until MFA, and works across on-premises, cloud, OT, and Kubernetes environments using native controls.
• Customers typically segment their entire network in under 90 days with less than one FTE, and closed ports also blunt ransomware and zero-day exposure while patches are tested.

This webinar was recorded in July 2025, ahead of Black Hat USA 2025.

Why are security teams overwhelmed?

[0:07] Terry Sweeney, Contributing Editor, Black Hat (Moderator): Hello, and welcome to today’s webinar, “Stop Lateral Movement and Start Your Weekend: Shifting Power to Defenders,” sponsored by Zero Networks and broadcast by Black Hat. I’m Terry Sweeney, contributing editor to Black Hat, and I’ll be your moderator. Our session today addresses the overload from too many tools, a cascade of alerts, and attackers who seem to work 24/7. Today’s speakers will walk us through the current state of affairs for SOC personnel and security analysts, and offer guidance on automation that can buy back some breathing room, and maybe even a weekend or two, thanks to networks that can manage themselves a bit more. I’m happy to welcome Amir Frankel, co-founder and CTO of Zero Networks, along with his colleague Nicholas DiCola, VP of Customers and security Jedi at Zero Networks. Gentlemen, welcome, and thanks for doing this today.

[2:05] Amir Frankel, Co-Founder and CTO, Zero Networks: Thanks, and hi, everybody. We’re really glad you could join us. We’re here to talk about how to stop lateral movement and start your weekend. It’s time to shift power to the defenders. Our session will be interactive, with polls along the way and Q&A at the end. I’m the co-founder and CTO of Zero Networks, and I have more than 20 years of experience in deep tech. I’m a big believer that simple is always the right answer, and that you should never compromise on quality or take shortcuts. Nick, over to you.

[2:48] Nicholas DiCola, VP of Customers, Zero Networks: Thanks, Amir. Good to meet you all. I’m Nicholas DiCola, the security Jedi here at Zero Networks. I’ve been in IT and security for more than 25 years. I’m very customer-obsessed and focused on solving hard problems with customers, and I’ve written numerous books and earned numerous certifications.

[3:06] Nicholas DiCola: Let’s dive in. If we step back and look at the last few years, what has happened to networks? Modern networks have outgrown the flat infrastructures of the past. I remember when we used to walk in, plug a new computer into a network switch, and that was it. Now we have Kubernetes, containers, cloud, hybrid architectures, and identity sprawl across applications, along with OT and IoT assets. So many things are interconnected in so many ways that they’ve outgrown the networks of the past.

[3:44] Nicholas DiCola: Our first poll asked how much your network has grown in the last three years. Most respondents said somewhere between 0% and 25%. That’s significant growth. If you have 100 assets and grow 25%, that’s another 25. But if you have 10,000 assets and grow 25%, that’s 2,500 more assets: cloud resources, on-premises assets, OT assets, and more.

[5:05] Nicholas DiCola: So modern networks are growing, and our security investments haven’t curbed cyberattacks. Cybersecurity spending reached $215 billion, up 43% since 2021. Meanwhile, there were almost 9,500 reported data breaches, and those are only the ones that were reported, an increase of 660% since 2021. And the average cost per breach is $4.8 million, up 15% since 2021. We’re spending more on cybersecurity, yet breaches are going up and the cost of each breach is going up. That math doesn’t add up. When you spend money on cybersecurity, you hope breaches and their costs will go down, because you have more capabilities and tools to stop and contain attackers.

[6:08] Nicholas DiCola: Our next poll asked how long it would take you to contain an attack. If an attacker got into your environment today, how fast could you respond and contain them with your existing tool set? Amir and I both believe it typically takes a long time. Most respondents said half a day, with quite a few right behind them saying a full day or longer. It’s very hard to contain an attacker once they’re in the environment and stop them from spreading laterally.

Why isn’t detection enough to stop attackers?

[7:30] Amir Frankel: Even though corporate networks and modern cyberattacks call for proactive strategies, network security is stuck in a cycle of reactive defense: you contain the breach after it happens, using other tools. Right now, 83% of organizations use EDR, endpoint security that detects what has already happened. We collectively focused on detection and forgot prevention, and it isn’t working. We need another way.

[8:05] Amir Frankel: I’ll share some more bad news before we get to the good news. It took 194 days on average to identify a breach in 2024. That’s a very long time between an attacker getting into your network and you knowing about it. What’s even worse: in about 20% of ransomware attacks, attackers start exfiltrating data within one hour, which is far less than the half day most of you said you’d need. And even worse than that, 51 seconds is the new record, measured by CrowdStrike this year, for an attacker to move laterally inside an organization. Looking at the last seven years, nothing has changed: the time it takes to identify a breach and the time it takes to contain one are pretty much the same, at around 194 days to identify and around 70 days to contain.

[9:21] Nicholas DiCola: I think we have a good audience here, Amir, because most said they could contain an attack in half a day, and the industry average is in the 60-day range.

[9:29] Amir Frankel: I’m sure our audience is the best, but we also want to help you get even faster than half a day. Let’s look at the burden security teams carry today. From what we hear in the field, 83% of security teams say they’re overwhelmed by alert volume, false positives, and lack of context. Eighty-five percent say they spend significant time on manual labor to deal with all these alerts. And 84% find themselves investigating the same incident several times, sometimes over months. You finish investigating an incident, look at your colleague, and find out you both just investigated the same thing. It’s a huge burden.

[10:18] Amir Frankel: Our next poll asked how much of your time each week is spent firefighting: dealing with alerts and everything that comes in just to make sure everything is okay, even without a real attack in your organization. Most of the audience chose 25% to 50%. Those are not good answers, because that’s time you could spend on better things in your organization or in your own life.

How are attackers bypassing EDR?

[12:01] Nicholas DiCola: Unfortunately, I get to continue the bad news: sophisticated attacks are now commoditized. Supply chain attacks are up 400% since 2021. Tools that only nation-state actors had access to in the past are now commoditized, so, quote unquote, script kiddies can use them. And because so many organizations have moved to EDR as their main detection and response capability, attackers have started using EDR killers: ways to bypass, get around, or kill the EDR, because that’s what most companies use to protect the environment.

[12:55] Nicholas DiCola: Take a real-world example, reported by Bleeping Computer: a ransomware gang encrypted a network from a web camera to bypass EDR. In a typical attack path, the attackers gained initial access and escalated privileges, then moved laterally to a server. They tried to do something there, and the EDR actually quarantined the file, so the EDR worked and blocked the attack. So the attackers pivoted. They found an unsecured web camera, moved laterally to it, and from the camera went back to the server they wanted, bypassing the EDR because they came in a different way that the EDR didn’t detect. Then they encrypted that server, and they did this on many machines across the environment. Ultimately, it’s lateral movement that lets attackers spread very fast and makes containing them so hard.

[14:02] Nicholas DiCola: So think back to everything we’ve discussed: securing sprawling, complex networks; firefighting and chasing alerts; managing traditional security tools; and warding off relentless attacks built on commoditized tools. What you end up with is an unwieldy burden of effort for security teams. I think all of us have felt like we’re carrying a big bag of rocks on our backs that keeps getting heavier while we try to protect the environment and contain attackers. It never ends. Now I’ll turn it back to Amir to share some good news.

Does microsegmentation work in practice?

[14:48] Amir Frankel: Thanks, Nick. It’s time to rebalance cybersecurity power and transfer the burden of effort to the attackers, not you, the security teams. The good news is that there’s a solution: microsegmentation can really work. Here’s an example from one of our customers, B. Riley Financial. Before microsegmentation, they were worried about what would happen if an attacker reached their business, because the impact would be very high, and their pen tests kept failing; they kept seeing red. I’m sure some of you see a lot of red in your pen test reports. Once they had microsegmentation, they got a green pen test and eliminated the fear of lateral movement. As Aaron Goodwin, their CISO, told us: “We were able to stop those activities from occurring.”

[15:50] Amir Frankel: I assume you all know MITRE, the organization that researches how attacks happen and how to stop them. In 2024, a threat actor exploited MITRE’s VPN, used session hijacking to bypass MFA, and then moved laterally inside the organization using a compromised administrator account. MITRE followed best practices, vendor instructions, and government guidance, but still didn’t detect the lateral movement. As Charles Clancy of MITRE said, what you really need to stop lateral movement is robust multi-factor authentication and microsegmentation.

[16:38] Amir Frankel: This is the MITRE ATT&CK framework, covering every step from infiltration until the organization is, let’s say, toast. All the steps in the middle are stopped by microsegmentation. Once you have microsegmentation in place, they can’t happen. One of our customers prepared this mapping while evaluating the solution, and that was their conclusion. Nick, tell us how microsegmentation would have stopped the attack we discussed.

[17:13] Nicholas DiCola: If we go back to the Akira attack chain, the attacker started with an initial compromise, moved laterally to a server, and couldn’t get past the EDR. With microsegmentation, you close all the network ports that were available to that attacker, so they can’t move laterally to that server. The same goes for the IoT web camera: they can’t move laterally to it, and they can’t use it to reach other assets, because you’ve closed every network port that isn’t needed and removed those vulnerable paths. Ultimately, the attacker can’t succeed. They can’t land ransomware on the server they wanted or move to other servers in the environment. You’ve stopped the attack and contained them on the first host. I like to ask people: if an attacker got into your environment and couldn’t move laterally, staying stuck on the first host, what would they do? They would leave and go to another organization where they can move laterally, because spreading throughout the network is their ultimate goal.

Why haven’t more organizations adopted microsegmentation?

[18:30] Amir Frankel: What we know from the field is that 96% of IT professionals believe microsegmentation is a must, and MITRE thinks it’s a must too. Yet only 5% are microsegmenting today. Why is nobody doing it? Where does this dissonance come from? Legacy microsegmentation solutions are notorious for being complex and requiring a lot of manual labor. People believe that once they implement it, they’ll have problems with scalability and lose agility, because, as we saw, networks keep changing. It costs a lot of money, and a single human error can have a big effect on the environment. And Gartner says most network segmentation projects fail, and that most take longer than the average tenure of a CISO. We all know how people feel about starting projects they won’t be around to finish.

[19:43] Amir Frankel: Our next poll asked about your greatest concerns with implementing microsegmentation. It was a multiple-choice question, and one audience member commented, “It’s all of them.”

[20:20] Nicholas DiCola: Working with many customers, I’ve heard all of these in some way, shape, or form.

[21:12] Amir Frankel: The results show that people believe it’s very, very complex to implement, and I understand that. With legacy solutions, it can disrupt the environment. There are many good reasons here.

How does automation make microsegmentation possible?

[21:23] Amir Frankel: But finally, it’s time for some good news: microsegmentation is finally possible, with automation. The Zero Networks platform automatically tags and groups assets. We build the network rules and policies for you, for both assets and identities, tailored to each asset and each group of assets in the network. Another thing we strongly believe is that privileged ports must stay closed by default and open only when someone needs them, with automated just-in-time access using MFA at the network layer. That means the network is closed and opens only when you need it, and only after you prove who you are. And we offer a comprehensive solution that works on premises, in the cloud, for OT, and for Kubernetes, all together.

[22:23] Amir Frankel: Even better news: it costs a fraction of what you’re used to paying for traditional segmentation, which required both hardware and software and a lot of money. With legacy microsegmentation, the biggest issues are cost and manual labor; you need so many people to work on it. With Zero Networks, it’s a fraction of the cost, because it’s software-based and we do most, or actually all, of the work for you. The defender’s era starts now.

How long does a microsegmentation project take?

[23:58] Terry Sweeney: Thanks, guys. That was a really comprehensive overview of the challenges of alerts and of defending networks, not to mention a really effective case for microsegmentation. We have some time for Q&A. I’m curious: how long, and how many people, does it typically take to complete the average microsegmentation project?

[24:55] Nicholas DiCola: Most people don’t believe this when I say it, but less than one FTE and a few months. Many customers are now able to microsegment their entire network in less than 90 days, and the only reason it takes 90 days is that they do assets in batches, which is fine. You don’t have to do them all at once. The trick is that the automation builds the rules for you. You don’t have to sit there manually analyzing all the data and building a rule for this and a rule for that. The automation does it all. A customer recently told me it feels like a purchase, not a project, which is a great thing to hear about microsegmentation.

Does microsegmentation work differently by industry?

[25:47] Terry Sweeney: An audience member who works in education asks whether there are focused profiles for protecting students. More broadly, how well does microsegmentation lend itself to specific industry verticals?

[26:11] Nicholas DiCola: With the automation, the vertical isn’t really relevant. It learns what’s in your environment, so it’s specific to you, whether you’re in education or financial services, based on what you have running. It isn’t about profiles for protecting certain types of people. It’s about learning what’s actually used in the environment and turning off everything else, so the attacker can’t move through the environment.

Can strong microsegmentation reduce the need for other security tools?

[26:52] Terry Sweeney: Another audience member asks: if you have good, strong microsegmentation, would you relax some of your endpoint security configurations? Can you do some trading and balancing there?

[27:09] Amir Frankel: When you have good microsegmentation in your network, you can choose to reduce some internal firewalls, because each computer is now protected, and that’s much easier to configure and manage. One of our customers was evaluating a new EDR and emailed us, “I’m going to turn you off for a week,” because with Zero Networks in place, they couldn’t see any difference between the EDRs they were testing: nothing happened. Another customer asked his team which they would choose if they could keep only one, their EDR or Zero Networks. They unanimously chose Zero Networks. And because the Zero Networks platform is broad, you get more than microsegmentation: we connect it with identity, so you know who is accessing which asset. That can help you reduce some other tools.

Is Zero Networks’ automation based on AI?

[28:26] Terry Sweeney: This conversation wouldn’t be complete if we didn’t mention AI. AI is linked with so much automation, which is the bottom line of what we’re talking about today. Is the automation you’re describing backed by artificial intelligence?

[28:56] Amir Frankel: We believe AI is really good for many things, but when it comes to your network, you have to be deterministic. You can’t have AI hallucinating and closing something on your network that hurts your production environment, or opening too much because it didn’t understand something. We do use AI to analyze data and help us understand what we should build in the future. But everything we build is based on knowledge of many, many applications, many statistical factors, and multiple safeguards that ensure your network is secured while your production keeps working all the time. And combining this with MFA reduces the need to open privileged ports. So you can be confident that we use AI to help you access data, without it affecting how the segmentation works.

How is the microsegmentation platform itself protected?

[29:58] Terry Sweeney: Nicholas, an audience member asks about the security of the microsegmentation tool itself. How is it protected from compromise, so it doesn’t become a powerful attack vector in the network?

[30:20] Nicholas DiCola: Great question. One of the first things we do is segment what we call the segment server, which is what lets us agentlessly control all of the assets in the environment. If you microsegment everything and an attacker gets in and can’t move laterally, they can’t use other devices to pivot. The same goes for the segment server: attackers can’t move laterally to it, so they can’t use it to take over everything else, because it’s the first thing we segment. We looked closely at the architecture to make sure it isn’t a powerful attack vector for an attacker in the environment.

How is microsegmentation implemented, and how is new access granted?

[31:12] Terry Sweeney: Nicholas, another one for you. An audience member asks: what is the mechanism for implementing microsegmentation? Is it an agent on the endpoint, or on the switch? And what’s the process for granting a particular endpoint access to a new service?

[31:30] Nicholas DiCola: There are a couple of things to answer there. Zero Networks uses native controls, so the answer isn’t as simple as “an agent on the endpoint,” because there are multiple controls. For an OT asset, that could be switch port ACLs. For an IT asset, it could be the host-based firewall. For a Kubernetes cluster, it’s the CNI. We use the native controls for each type of asset or platform so we can implement segmentation without affecting performance. That’s the most important thing: microsegmentation shouldn’t affect performance.

[32:07] Nicholas DiCola: As for granting access, that’s really up to you. It can go through change control in your environment, depending on your security requirements and how you handle changes. It can also be automated. We have day-two automation that can detect, for example, a new application trying to connect, maybe because a developer deployed something new and didn’t tell you. We can stage a rule and ask you to review and approve it, so you can allow the new application on the network. So it can be handled manually or with automation.

[32:47] Amir Frankel: I’ll add a little to that. We have multiple ways to deploy, including agentless and agent-based options tailored to each kind of operating system. We also give you a lot of visibility along the way: not only which computer is talking to which computer, but which user and which process is talking to which user and process. And with the agentless option, you won’t see us in the environment at all, with almost zero performance impact.

Can microsegmentation help during a zero-day attack?

[33:29] Terry Sweeney: An audience member asks whether microsegmentation can help during a zero-day attack. Amir, what are your thoughts?

[33:39] Amir Frankel: Yes, in many, many ways. Many years ago, early in Zero Networks’ history, I wrote a blog post about how to stop chasing CVEs. When you close all the ports in your network, you don’t need to worry about a new zero-day, because nobody can reach the vulnerable service. Even if you learn there’s a new problem in Windows, nothing has changed for you. And even if something has to be open, we open it only to a few machines inside the network, so you’re still protected. Even when a vulnerability appears, you have time to patch when you’re ready, and in many cases you can say, “I know how I’m protected. The port isn’t open. I don’t want to interrupt the business.” Microsegmentation really changes the scenario for defending an environment. It shifts the power back to defenders.

[34:45] Terry Sweeney: That brings us to an official close for questions and for today’s session. I want to thank Amir Frankel and Nicholas DiCola. Black Hat appreciates your time and expertise on making more strategic use of microsegmentation and automation. Thanks as well to our sponsor, Zero Networks, and to everyone in the audience. Within the next 24 hours, you’ll receive a follow-up email with a link to today’s presentation on demand, which you’re welcome to share with colleagues. On behalf of our guests, Zero Networks, and the Black Hat team, I’m Terry Sweeney. Thanks again for joining us.