Preventing attackers from entering a network remains important, but no security programme should assume every initial attack will fail.

An employee may open a malicious attachment. A vulnerable server could provide the first foothold. Stolen credentials might give an attacker legitimate access to an account. Once that happens, the more important question becomes: what can they reach next?

Lateral movement testing examines that stage of an attack. Instead of stopping after proving that one system can be compromised, testers investigate whether controlled access could lead towards additional devices, privileged accounts, databases, cloud resources, domain controllers, backup systems, or critical applications.

MITRE ATT&CK describes lateral movement as the stage in which adversaries move through an environment towards additional systems and resources. Its documented techniques include remote services such as RDP, SMB, SSH, VNC, Windows Remote Management, and cloud services.

Initial Access Is Often Only the Beginning

Consider an attacker who compromises an ordinary employee laptop.

At first, the device may contain little valuable information. However, the logged-in user might have access to internal file shares, applications, cloud services, and a VPN. Administrative sessions, authentication tokens, or reusable credentials could also be present.

From there, reconnaissance begins.

A poorly segmented network may expose internal servers. Reused administrator credentials might open access to other workstations. One server could then reveal a service account with stronger privileges, creating a route towards Active Directory or systems containing sensitive information.

The initial endpoint is therefore not always the main prize. Its value may lie in what it allows an attacker to reach.

Five Things Attackers Look for After Gaining a Foothold

Attackers rarely move through a network using one technique alone. Instead, lateral movement often combines discovery, credential abuse, remote services, privilege escalation, and trusted relationships.

These five areas deserve particular attention during testing.

1.    Credentials That Work Somewhere Else

Credentials are among the most valuable resources an attacker can obtain.

A compromised workstation may expose passwords, hashes, authentication tokens, service-account credentials, browser sessions, scripts containing secrets, or privileged credentials left behind during previous administration.

Password reuse makes the situation worse.

MITRE ATT&CK specifically notes that reuse of local-account passwords can allow the same credentials to be abused across multiple machines for privilege escalation and lateral movement. It recommends unique local administrator passwords and tighter management of privileged local accounts.

During lateral movement testing, assessors may therefore determine whether credentials available on an authorised test system also work elsewhere.

If they do, the finding is larger than “password reuse”. It may indicate poor administrative separation, excessive privileges, or weak credential-management practices across the environment.

2.    Remote Services That Allow Easy Movement

Organisations legitimately depend on remote services every day.

Administrators use RDP. Linux teams rely on SSH. Windows environments may use SMB and WinRM. Support teams use remote-management software, while cloud administrators work through browser consoles and command-line tools.

Unfortunately, attackers can use the same mechanisms.

MITRE ATT&CK classifies RDP, SMB/Windows Admin Shares, SSH, VNC, WinRM, and cloud services under its Remote Services technique. If an attacker possesses valid credentials and the service is reachable, those legitimate access mechanisms can support movement between systems.

For example, a compromised account combined with unnecessarily broad RDP access may allow an attacker to move directly from one host to another without exploiting another software vulnerability.

Testing can reveal whether remote-management services are exposed more widely than business requirements justify.

3.    Paths Towards More Privileged Accounts

An attacker who starts with ordinary user access rarely wants to remain an ordinary user.

The next target may be a local administrator, server administrator, cloud administrator, backup administrator, domain administrator, or another privileged identity capable of reaching higher-value systems.

Small privilege weaknesses can combine quickly.

For instance, helpdesk staff might have local administrator rights across employee devices. Later, a server administrator signs into one of those machines for troubleshooting. If the workstation is already compromised, the attacker may gain an opportunity to capture or abuse more privileged credentials.

Eventually, that chain can lead towards identity infrastructure.

This is why Active Directory and identity VAPT becomes highly relevant in environments where central identity services control access to large parts of the business.

CISA also recommends separating administrator accounts from everyday user accounts and regularly reviewing Active Directory permissions for excessive privilege.

4.    Network Segments That Do Not Actually Contain an Attack

Segmentation should restrict how far a compromised system can communicate.

An employee workstation may legitimately need access to email, selected applications, printers, and file services. It usually does not need unrestricted connectivity to backup administration, domain controllers, database management services, or production infrastructure.

Nevertheless, broad firewall rules and flat networks can create exactly that exposure.

The NCSC recommends separating systems and information that do not need to communicate. Its lateral movement guidance explains that segmentation can increase the difficulty of reaching critical targets after an attacker gains an initial foothold.

CISA similarly recommends logical or physical segmentation to contain intrusions and prevent or restrict adversary lateral movement.

A network diagram may show several security zones. Lateral movement testing determines whether those boundaries actually stop communication that should not be possible.

5.    Trusted Paths Between Internal Systems and the Cloud

Lateral movement no longer ends at the internal network boundary.

Many organisations synchronise or federate internal identities with Microsoft 365, Azure, AWS, Google Cloud, and other SaaS or cloud environments.

Consequently, compromising the right account may create a route from an internal system into cloud resources.

MITRE ATT&CK documents this explicitly. Its Cloud Services lateral movement technique describes adversaries using valid accounts synchronised or federated with on-premises identities to access cloud-hosted resources or management functions. Documented examples include compromised high-privilege on-premises accounts being used to move into cloud environments.

Modern testing should therefore consider hybrid identity relationships rather than treating internal infrastructure and cloud services as completely separate attack surfaces.

What Should Lateral Movement Testing Actually Prove?

A useful assessment should not move between systems simply to increase the number of compromised hosts.

Each step should answer a security question.

Security question

What testing may reveal
Could one workstation reach other workstations? Excessive peer-to-peer connectivity or shared administration
Do credentials obtained on one system work elsewhere? Password reuse, credential exposure, or broad permissions
Are ordinary users able to reach server-management services? Weak access controls or network restrictions
Does one administrator account control too many systems? Excessive privilege or poor administrative separation
How easily could an employee endpoint reach critical infrastructure? Ineffective segmentation
Could internal identities provide privileged cloud access? Hybrid identity or federation exposure
Are backup or security systems reachable from compromised hosts? Weak protection of recovery and defensive infrastructure
Would suspicious movement trigger useful security alerts? Detection and monitoring gaps

This approach makes findings more meaningful.

Instead of reporting only that “SMB connectivity was possible”, testers can explain the consequence: a compromised employee workstation provided a practical route towards a server containing sensitive information.

Attack Chains Matter More Than Isolated Findings

Individual vulnerabilities can appear manageable when viewed separately.

Combined together, they may create a serious attack path.

Imagine that a tester begins with access equivalent to a compromised employee workstation. Internal discovery reveals several reachable systems. A reused local administrator credential provides access to another workstation.

From there, evidence of a more privileged administrative session becomes available.

Those new permissions provide access to a management server, while an additional trust relationship creates a route towards systems controlled through Active Directory.

No individual weakness necessarily explains the full risk.

Together, they connect an ordinary endpoint to critical infrastructure.

CISA demonstrated the value of analysing these paths during a red-team assessment. Its team moved laterally between systems and sites, including through SCCM infrastructure and domain controllers, while varying techniques to reduce the likelihood of detection. The assessment identified weaknesses involving privilege separation, network design, and monitoring.

For this reason, internal network VAPT should evaluate how weaknesses combine rather than treating every internal finding as an unrelated technical problem.

Segmentation Should Contain an Attack, Not Just Organise the Network

VLANs and separate IP ranges can make a network look segmented.

However, different subnets do not automatically create meaningful security boundaries.

If firewall policies allow broad traffic between zones, the attacker may still move freely. Likewise, shared administrator credentials or unrestricted management services can connect systems that appear separated on a network diagram.

Effective segmentation should follow business requirements.

Finance users might require access to financial applications, while backup administrators may need a separate management path. Production servers should not automatically accept administrative connections from employee workstations.

CISA recommends network segmentation specifically because it can contain intrusions and restrict lateral movement. Its ransomware guidance also advises separating administrator and user accounts, controlling local administration, auditing Active Directory privileges, and limiting unnecessary remote access.

Lateral movement testing therefore validates the actual boundary rather than merely confirming that network zones exist.

Legitimate Administrative Tools Can Hide Malicious Movement

Attackers do not always need custom malware to move through a network.

Normal administration tools may already provide everything they need.

RDP, SMB, PowerShell, remote-management platforms, SSH, and cloud-management tools all have legitimate business purposes. As a result, malicious activity using those tools can resemble ordinary IT administration.

Context becomes essential.

One administrator opening an RDP session from an authorised management workstation may be routine. The same account connecting rapidly to multiple systems from an employee laptop outside normal working hours should attract much greater attention.

Real-world ransomware activity demonstrates the problem.

A joint cybersecurity advisory on LockBit documented affiliates using remote-desktop software to support lateral movement and targeting SMB shares as part of their movement across networks.

Separately, CISA has documented government-sponsored actors using RDP to move laterally between multiple hosts and recommends controls including MFA, disabling unnecessary RDP, firewall restrictions between network zones, and monitoring suspicious RDP login patterns.

Therefore, a lateral movement assessment can test detection as well as prevention.

If testers use agreed techniques that security controls should recognise, defenders can determine whether endpoint, identity, and network monitoring produces useful alerts.

How Far Should Lateral Movement Testing Go?

The testing boundary should be agreed before the assessment starts.

As privileges increase, so does the potential operational impact. Domain controllers, production databases, hypervisors, backup infrastructure, security platforms, and operational technology may require stricter limitations.

Rules of engagement should define:

  • Which systems can be accessed
  • Which credentials may be used
  • Whether privilege escalation is permitted
  • Whether production environments can be accessed
  • Which techniques are prohibited
  • When testing must stop after proving a risk
  • Who should be contacted if a critical issue appears

Full exploitation is not always necessary.

If an assessor demonstrates that a compromised account has administrative control over a critical server, that evidence may already establish the risk. Deploying additional payloads could add little security value while increasing operational exposure.

Good VAPT proves the attack path using the minimum level of intrusion required.

How Should Businesses Break a Lateral Movement Path?

Fixing only the first compromised system may leave the wider attack path intact.

If a workstation compromise can eventually reach a domain controller, several controls may need improvement.

Possible remediation includes:

  • Removing reused local administrator credentials
  • Restricting unnecessary RDP, SMB, WinRM, and SSH connectivity
  • Tightening firewall rules between network segments
  • Separating privileged and everyday user identities
  • Reducing excessive Active Directory permissions
  • Protecting administrator workstations
  • Limiting service-account privileges
  • Improving credential protection
  • Increasing monitoring for abnormal administrative access

MITRE recommends limiting unnecessary access to remote services and sensitive systems, while CISA recommends segmentation, least privilege, administrator-account separation, and controls on local administration.

Rather than fixing every weakness independently, security teams should identify where one architectural or identity change can break several attack paths at once.

For example, preventing ordinary workstations from initiating administrative connections towards critical servers can remove many possible routes in one change.

Retesting should then confirm that the original path can no longer be completed.

Final Thoughts

Initial compromise should not automatically become organisation-wide compromise. Lateral movement testing helps businesses determine whether one stolen account or compromised endpoint remains contained or provides a route towards privileged identities, critical infrastructure, cloud environments, sensitive information, and recovery systems.

Aegixis VAPT Services can assess these post-compromise attack paths through controlled internal security testing. By testing segmentation, credential exposure, privileged access, remote services, hybrid identities, and detection controls, Aegixis can help organisations identify and break the paths that allow a small security incident to escalate into a much larger breach.