Lateral Movement
An attacker's progression from an initial foothold to more valuable systems, which is what turns a minor compromise into a breach.
Initial access is rarely the interesting part of a breach — a phishing hit, an exposed test instance, a vulnerable dependency. What determines the outcome is how far the attacker can travel from there, and that is a property of the architecture rather than of the perimeter.
Flat networks are the classic enabler: once inside, everything is reachable, and internal services that trust the network authenticate nobody. Shared credentials extend it, over-broad service accounts extend it further, and an identity provider or CI system with wide privileges collapses the whole estate into a single hop.
The controls that constrain it are the substance of zero trust. Network segmentation with default-deny, so reachability is explicitly granted. Authenticated and authorised service-to-service calls, so being on the network proves nothing. Narrowly scoped workload identities with no standing privilege beyond function. Separate credentials per environment, so non-production compromise does not reach production.
The exercise that reveals the truth faster than any document: pick a service and ask what an attacker with full control of it can reach. What credentials are in its memory and environment, which databases and internal APIs will accept its identity, what cloud permissions does its role carry. In most estates the honest answer is far more than anyone expected, and the answer is actionable in a way that a maturity score is not.