Lateral Movement

Lateral movement↗ refers to the techniques an attacker uses to move through a network after gaining an initial foothold, hopping from the first compromised device to other systems in search of valuable data or higher-privileged access.

This stage often happens quietly over days or weeks as the attacker maps the network and escalates access. Network segmentation↗ and monitoring for unusual internal traffic are key defenses, since they limit how far an attacker can spread from a single compromised machine.