At a recent executive roundtable co-hosted by Cube Cyber and Illumio, security leaders examined a critical weakness exploited in nearly every modern breach: rapid lateral movement after initial compromise. Recent incidents highlight that even mature, well-tooled environments can be breached when identity gaps, flat network architectures, and unmanaged legacy systems enable attackers to escalate privileges and pivot across the environment.

The discussion broke down how post compromise activity unfolds in real world scenarios and explored practical controls that limit propagation, including Zero Trust Segmentation, tighter east west visibility, and containment aligned to critical asset pathways.

The takeaway was clear. Resilience is not about preventing every intrusion. It is about restricting lateral movement, reducing blast radius, and keeping core operations intact when a breach occurs.

The Modern Reality: Breach Inevitable, Spread Preventable 

The group began by confronting a sobering reality: breaches are no longer rare incidents, but an operational certainty. Modern attacks are designed for speed, scale, and automation, leaving security teams little time to react. Once an initial compromise occurs, lateral movement follows quickly, turning a single foothold into a full-scale incident. 

Examples such as the Ingram Micro breach illustrated this challenge vividly. Attackers exploited a VPN entry point, harvested credentials, scanned internal systems, and eventually exfiltrated data, and deployed ransomware. Each stage of that chain is familiar and preventable, but only when visibility and containment techniques have been built into designs, and not simply as afterthoughts. 

Lateral Movement: The Underrated Threat Vector 

Participants discussed how lateral movement has become a defining feature of modern cyberattacks. Techniques such as Remote Desktop Protocol (RDP) exploitation and Server Message Block (SMB) traversal continue to dominate post-compromise activity, leveraging so called “Living off the Land” techniques to avoid detection by traditional EDR solutions The problem isn’t simply that these techniques exist, it’s that many environments remain too flat, too open, and too trusting. 

Once an attacker breaches the perimeter, they often find minimal segmentation, limited firewall or flow logging, and partial visibility from traditional security tools like EDR or SIEM. The result is a porous environment where a single compromised system can become a launchpad for internal reconnaissance, credential harvesting, and lateral expansion. 

AI-driven malware has only amplified this problem. Campaigns such as Akira or Oyster demonstrate how quickly automation can scale a breach. The attackers’ ability to move through hybrid and multi-cloud environments outpaces the traditional incident response playbook. 

Resilient by Design: Breach Containment for the Modern Enterprise 

One of the strongest themes that emerged was the need to move beyond reactive detection. EDR and SIEM tools remain essential, but they are not enough to stop movement once the attacker is inside. Over-reliance on legacy macro-segmentation approaches also limits effectiveness against today’s threat environment. The conversation shifted toward containment by design, the idea that security architecture should assume compromise and be structured to contain it. 

Illumio’s breach containment model provided the framework for this discussion. By using strategic Zero Trust segmentation and intelligent labelling at a workload-level, organisations can ‘ringfence’ their critical assets, restrict unnecessary communication paths, and rapidly isolate threats without taking entire systems offline. Illumio’s platform and approach allows for rapid deployment of these containment strategies, allowing organisations to build resilience iteratively.  

This selective containment approach was seen as a critical evolution from the traditional “kill switch” response. Instead of shutting down entire networks, predefined incident response policies can be quickly deployed to quarantine only the affected systems, keeping business operations running while the threat is neutralised. 

The Role of Deep Visibility and IR Practice 

The executives agreed that resilience depends on one thing above all: understanding what normal looks like. Visibility across workloads, users, and traffic flows enables earlier detection and faster decisions. When teams know their environment intimately, abnormal behaviour stands out. 

But visibility alone isn’t enough, it must be paired with Incident Response (IR). The group emphasised that predefined incident response plans and tested containment procedures are the key to avoiding hesitation when a breach occurs. Preparedness transforms panic into process. 

Cube Cyber’s perspective reinforced this operational focus. The company’s incident readiness work with clients has shown that response speed and clarity depends on visibility, policy alignment, and the ability to act without fear of disrupting the business. 

Containment as Culture 

Perhaps the most forward-looking insight from the roundtable was that resilience is as much cultural as it is technical. Containment cannot sit as a one-off initiative or an emergency response protocol. It needs to be woven into everyday operations. That means refining access policies, integrating segmentation principles into new IT projects, and aligning security operations with broader business objectives so that containment becomes a default design choice rather than a reactive measure. 

Participants described this shift as moving from a defensive posture to a resilience mindset. The group noted that many organisations still rely heavily on compliance tick-boxes, assuming that meeting framework requirements equates to readiness. The discussion challenged that view. Compliance may be necessary, but it does not prepare an organisation for the speed and complexity of real-world lateral movement. A stronger focus on preparation for the inevitable and building a genuine containment culture emerged as a defining marker of resilience. 

Lessons to Take Forward 

The event closed with a series of practical takeaways that organisations can act on immediately using the Illumio platform: 

• Map your environment: Understand dependencies and communication paths across all assets using the Illumio Map. What is normal? 

• Manage your external attack surface: Leverage new tools like Illumio Insights to identify unprotected cloud-native assets, ensuring the organisation’s attack surface is understood. 

• Define and test containment policies: Build muscle memory for rapid isolation during incidents. 

• Adopt segmentation early: Limit exposure and control east-west movement before a breach. 

• Refine continuously: Use visibility tools and post-incident reviews to strengthen defenses. 

The message was clear. Resilience is not achieved through tools alone, but through disciplined design and ongoing operational readiness. Many organisations understand the value of segmentation, yet the execution often falls behind due to complexity, legacy constraints, or uncertainty about where to start. The roundtable reinforced that platforms like Illumio can help simplify this journey, providing the visibility and structure needed to make segmentation practical and achievable as part of a broader Zero Trust approach. 

Next Steps 

The roundtable concluded with a shared recognition that breach containment is now a core requirement for every organisation. Building resilience requires visibility, preparation, and the ability to contain threats while maintaining business continuity. 

For organisations operating across both on premises and cloud native environments, now is the time to assess how well your architecture supports containment by design. If you would like guidance on strengthening visibility and building rapid response capability, our team can help. 

Learn how Cube Cyber and Illumio support organisations in building stronger containment strategies: Contact Us

The defining moments of a cyber incident are not measured by how many alerts were generated or how advanced your detections were. They are defined by what happens next. Who escalates? How quickly? Is the right person on-call? Is the scope understood? Is the communication plan clear?

In critical situations, performance depends on more than just having the right tools. What truly determines the outcome is how clearly your team can act, how fast they can escalate, and how effectively they can contain the threat. When pressure hits, teams don’t rise to the level of their technology. They fall to the level of their incident response plan.

The gap isn’t in the tooling. It’s in the operational readiness. And in cybersecurity, that’s where most of the real risk lives.

Common Incident Response Failures and How to Fix Them

Even well-resourced organisations can struggle to respond effectively if response readiness is not treated as a core capability. Detection may function as intended, but it is only the starting point. What follows determines whether a situation is contained quickly or escalates into a business-critical crisis.

Common breakdown points include:

• Undefined ownership in the first 15 minutes. There is confusion around who takes the lead and how quickly decisions can be made.
  
• Ambiguous escalation pathways. If a key individual is unavailable, it is unclear who steps in, leading to delays.
  
• Fragmented visibility. Logs are siloed, alerts lack context, and investigations stall due to missing or inaccessible data.
  
• Over-reliance on specific individuals. One or two people become critical dependencies, increasing operational risk.
  
• Manual communications and reporting. Critical minutes are lost compiling stakeholder updates rather than executing the response.

These aren’t failures of technology. They’re the result of untested, underdeveloped incident response processes and a lack of operational readiness. In most environments, it’s the assumption that plans will hold under pressure that becomes the greatest vulnerability.

Response Isn’t a Product. It’s a Capability.

Building a capable response function requires more than drafting a plan. It involves embedding response into the day-to-day fabric of operations and maintaining it through regular validation.

Organisations with mature cybersecurity risk management approaches typically do the following:

• Conduct structured response simulations, not just tabletop exercises
  
• Define clear roles and thresholds for escalation
  
• Test tooling in real-world conditions, not only during onboarding
  
• Centralise telemetry and make it actionable in real time
  
• Run formal post-incident reviews and adapt based on findings
  

This is where most teams fall short. They invest in tooling but don’t embed the response muscle to match. The result is a disconnect; visibility without action, alerts without ownership.

Five Tactical Questions to Assess Cybersecurity Readiness

If you’re unsure where to begin, here are five questions we ask when assessing an organisation’s readiness:

1. If a ransomware alert were triggered right now, who would respond, and how quickly?
   
2. Are your logs centralised, accessible, and useful during a live investigation?
   
3. Can critical incidents be escalated after hours without confusion or delay?
   
4. Do you have a consistent method for documenting incidents as they unfold?
   
5. Have you recently reviewed a past incident to identify and resolve gaps in speed or clarity?

If any of these questions are difficult to answer confidently, it may be time to prioritise a response maturity review.

Why a Hybrid SOC is Essential to Modern MDR

Effective Managed Detection and Response (MDR) is about more than just identifying threats. It’s about responding quickly and decisively when incidents occur. A Hybrid SOC model plays a critical role in enabling that response.

By combining internal knowledge with external expertise, a hybrid approach empowers teams to act with greater speed, clarity, and confidence,  all while maintaining visibility and control.

This model doesn’t replace your internal capability. It strengthens it, extending your team with the right people, processes, and insights to ensure you’re ready when it matters most.

Test Your First 30 Minutes With Our Experts

When an incident strikes, you don’t need more alerts,  you need a trusted partner who knows how to respond. Cube Cyber delivers just that.

Cube Cyber serves as a trusted cybersecurity partner for organisations that want to strengthen their response capability without increasing internal complexity. Our co-managed Managed Detection and Response (MDR) service operates as an extension of your team, providing 24/7 visibility, expert-led triage, and real-time escalation from our Brisbane-based Security Operations Centre.

Book your MDR Readiness Assessment to identify hidden gaps and get expert, actionable recommendations tailored to your environment,  before the next breach puts your team to the test.

Many smaller enterprises do not even know where to start with preparing a cyber defence plan or what things are of most importance when creating one. In this post we will address the key components to establishing a good cyber incident response plan.

Risk Assessment

A risk assessment is one of the first things you should look at. You will not be able to say what cyber security measures you need until you know what risks are specific to your business. Whether you are updating an old cyber defence plan or starting from scratch, you should look at all the common cyber attacks especially those relevant to your business. The Australian gov website has good articles for assessing cyber risks.

The most common attacks are phishing and spear phishing attacks, malware, and ransomware, but you should also consider developing attacks such as deepfakes and vulnerabilities with 5G and artificial intelligence (AI).

For each type of cyber threat, you should assess how big a risk it is to your business and how each attack would affect the company. You should also look at each aspect of the busines, example sales, marketing, finance and prioritise which sectors are most vulnerable. Identify the staff members who have access to the most sensitive company information and re-evaluate whether every one of those people needs that access. Only trustworthy staff who absolutely need sensitive company information to do their jobs, should be allowed access to minimise the risk of any accidental (or intentional) breaches.

During the risk assessment, you should not only be assessing the cyber risks to your business but the vulnerabilities already in your company’s network or systems. Are there any holes in your cyber security? Are staff members working from unprotected personal devices? All these weak points can be an easy way for cyber criminals to gain access to your network.

You should determine the likelihood of each attack, how much such attack would impact the business and the threat level of attacks (low, medium, high).

Early Warnings

Your cyber defence plan should include early warnings on how to recognise a cyber-attack. Phishing attacks are the most common attack on businesses (up to 90% in fact), but these are the types of attack we can prevent. Human error is the most common reason behind a data breach. As phishing and spear phishing attacks are evolving to be more sophisticated, the easier it is for employees to become fooled.

However, if staff are professionally trained in the most common attacks, they may become better at spotting a suspicious email. Sometimes it is the smallest of things that will give a dodgy email away, such as a change in just one letter in an email address. If staff members are on the lookout for such details, they are far less likely to open a malicious site or download link. Education and ongoing training should be part of your cyber incident response plan and company culture.

Prevention Measures

First of all, you should be aware of every protection measure in the business and what it does. You need to know which applications are installed on which devices and so on. Keep an account of every piece of software you are using and every update.
Once you know what cyber risks are a threat to your business and the software you are already using, you can re-evaluate. Is it enough, or do you need further protection? Prevention measures should be analysed an implemented within the business.

Common preventative measures are:
– Multi-factor authentication (MFA)
– Firewalls
– Endpoint protection
– Virtual private networks (VPN)
– Email security
– Security monitoring
– Cloud security

Whether you have an in-house cyber security team or you are outsourcing to an expert firm, you will need to make sure the cyber protection systems are secure and up to date. Any system bugs need to be fixed and patch work should be implemented where necessary. Checks of all cyber systems should be tested regularly to ensure everything is running correctly. Proper monitoring of all cyber security measures should be carried out to ensure you are seeing potential threats in real time.

Incident Recovery

Your cyber defence plan should include how you intend to respond to a cyber incident. Communication is key, so there should be a team, or several staff members assigned to deal with an attack. Each person should be assigned a role of how to execute the plan, to avoid confusion and havoc.

If customer data has been breached, then you will probably need to consult data protection laws. For this reason, having a plan for public statements is a good idea. Having these statements written out in advance puts you in a much better, calmer and more controlled environment then quickly whipping up a panicked statement that is not as thought through.

The cyber defence plan should include how you intend to report the breach via event logs, including the time of the attack, how it was implemented and the communications between the team.

Conclusion

A major data breach can be devasting to any size business, but particularly for smaller enterprises. The idea of cyber attacks can be scary, but by having a plan in place will safeguard your data as much a possible and put you in a better position to be able to control the attack.

Creating a cyber defence plan is crucial in preventing cyber crime to your organisation and being organised if an attack does occur. If you would like more information on how an expert team like Cube Cyber can help you, then please check our website for more information.

We are a dedicated team of professionals who provide expert cyber advice to businesses of all sizes. We have many different solutions to prevent cyber attacks and would love to hear see we can help you and your team.