Also known as: pivoting · east-west movement
Lateral movement is the process by which an attacker who has compromised one system moves through a network to reach additional systems, typically hunting for higher-value data or credentials.
The first machine an attacker lands on is rarely the one they want. Lateral movement is the work of getting from an arbitrary foothold — a contractor's laptop, an internet-facing web server — to the domain controller, database, or build system that holds actual value.
It commonly relies on harvested credentials, trust relationships between systems, and flat internal networks where any host can reach any other. This is why network segmentation and zero-trust architectures target lateral movement specifically: they do not prevent the initial breach, they contain its blast radius.
Privilege Escalation
Privilege escalation is the act of exploiting a flaw or misconfiguration to gain a higher level of access than originally granted, such as moving from an unprivileged user account to administrator or root.
Zero Trust
Zero trust is a security architecture that removes implicit trust based on network location, requiring every request to be authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the corporate network.
Dwell Time
Dwell time is the length of time an attacker remains undetected inside a compromised environment, measured from initial intrusion to detection.
Credential Stuffing
Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.
Defense in Depth
Defense in depth is a security strategy that layers multiple independent controls so that the failure or bypass of any single control does not result in compromise.