How would you assess your estate's exposure to lateral movement, in a way that produces actionable findings?

What the interviewer is testing

Whether you can turn a broad security concern into a concrete exercise, rather than citing a maturity framework.

The exercise

Pick a service and ask what an attacker with full control of it can reach. Specifically:

What credentials are in its memory and environment? Database passwords, API keys, tokens for downstream services, cloud credentials from the instance metadata endpoint.

What can its cloud role do? Read every bucket, assume other roles, modify infrastructure? Roles accumulate permissions and are almost never reduced.

What internal services will accept its identity, and with what authority? If internal APIs authenticate the service rather than the user, the answer is usually "everything, for every user".

What is reachable on the network? If the network is flat, the answer is everything, and being on the network is itself an authorisation.

What data can it read? Not what it should read — what the credentials it holds permit.

Do this for an internet-facing service, a CI runner, and a low-priority internal tool. The last two are usually the most alarming, because they have production credentials and far less scrutiny.

Why this beats a maturity assessment

It produces a specific list of over-broad permissions and reachable paths, each of which is a ticket. A maturity score produces a number.

The controls the findings will point to

Default-deny network policy, so reachability is explicitly granted. Authenticated and authorised service-to-service calls carrying user context. Narrowly scoped workload identities with no standing privilege beyond function. Separate credentials per environment, so non-production compromise does not reach production. Egress filtering, which is what turns a compromise into a contained one.

What a strong answer adds

Running it against CI runners specifically. They execute untrusted third-party code by design, often hold deployment credentials, and are among the highest-value targets in any engineering estate — and they are rarely included in threat modelling.

Common weak answers

Commissioning a penetration test as the whole answer, which finds entry points rather than blast radius. Citing zero trust as a principle without the exercise.