Zero Networks 2026 Lateral Movement Exposure Report: 10 risks, 312 environments

In two minutes

• The report analyzes 54 trillion activities across 312 enterprise environments over one month and finds most run with very broad internal trust (executive summary, p. 5; p. 31).
• 87% of monitored servers accepted internal RDP or SSH traffic, 78.7% were reachable over SMB or WinRM, and 43.2% of internal authentication still used NTLM (p. 10; p. 20).
• A single compromised host can reach a median of 85% of internal systems on the first hop and effectively 100% on the second (p. 12).
• It sets out ten risks (LM1 to LM10), each with what it means, why it matters, attack scenarios, benchmark data and a "what good looks like" list (p. 9).
• Several risks (LM6, LM8, LM10) are backed by qualitative observations only, such as inconsistent control-plane segmentation and immature containment readiness (pp. 21, 24, 26).
• AI-Driven Lateral Movement is a watch item, not a benchmarked risk: AI as attacker (parallel recon and movement) and AI agents as targets with broad standing access (pp. 27-28).
• It argues containment, not prevention, should be the defining metric, and suggests boards track time to contain a compromised identity and the share of AI agents under the same segmentation and audit as humans (p. 29).

Key numbers

• 54 trillion activities, 312 environments: size of the telemetry set, observed over one month (p. 31).
• 27 seconds: fastest recorded breakout time in 2025 (cited from CrowdStrike) (p. 5; p. 26).
• 87%: monitored servers that accepted internal RDP or SSH traffic (p. 10).
• 78.7%: monitored servers reachable over SMB or WinRM (p. 10).
• 43.2%: observed internal authentication traffic still using NTLM (p. 20).
• 12.2%: organizations with observed direct user-to-server administrative pathways (p. 13; p. 25).
• 85% first hop, ~100% second hop: median share of internal systems a single compromised host can reach (p. 12).
• 241 days: average time to identify and contain a breach (cited from IBM) (p. 26).

What to do with it

• Ask the report's first question of your own network: what can one compromised laptop reach today, and measure that internal blast radius each quarter (p. 29).
• Close admin protocols by default and open them on demand with MFA, per-session approval and just-in-time access, as LM1 describes (p. 11).
• Isolate critical assets from user endpoints and tier access between endpoints and servers, as LM2 and LM9 recommend (pp. 14, 25).
• Plan to retire NTLM and other legacy authentication, and put MFA on privileged internal access (p. 20).
• Bring service accounts under least-privilege scopes, rotation, usage monitoring and source-binding (p. 18).
• Inventory AI agents, treat them as first-class identities under the same segmentation and audit as humans, and build isolation playbooks and an identity kill-switch (pp. 26, 29).

Read the full document if

• you need benchmark figures on internal reachability, admin protocol exposure and NTLM use to size your own exposure.
• you are building a board case for internal segmentation or containment spending.
• you want a checklist-style framework of ten lateral movement risks with target controls.
• you are assessing how AI agents change east-west risk.

What it relies on

The core data is Zero Networks telemetry: about 54 trillion activities across 312 environments of varying sizes (OT and IT, in finance, retail, insurance, manufacturing and others), observed for one month (pp. 5, 31). Metrics cover internal authentication, admin protocol exposure and east-west traffic across client and server assets. The report does not give a statistical method or a breakdown by size or sector. Many other figures come from cited third parties, including CrowdStrike, IBM, Microsoft, Palo Alto Networks and Unit 42, in footnotes. The foreword is by Dr. Chase Cunningham. Zero Networks sells segmentation and containment tooling of the kind the report recommends, and it references its own open source RPC Firewall (p. 11).

Our read

Useful as a source of reachability and protocol-exposure benchmarks, and as a control checklist for east-west containment. Several risks rest on qualitative observations, and the AI section is a watch item without benchmarks. Check the third-party figures against their cited sources before using them in a board paper.