{"id":34330,"date":"2026-05-29T21:09:47","date_gmt":"2026-05-29T21:09:47","guid":{"rendered":"https:\/\/www.adminbyrequest.com\/en\/?p=34330"},"modified":"2026-06-02T21:28:49","modified_gmt":"2026-06-02T21:28:49","slug":"beating-the-29-minute-clock-controls-that-slow-lateral-movement-down","status":"publish","type":"post","link":"https:\/\/www.adminbyrequest.com\/en\/blogs\/beating-the-29-minute-clock-controls-that-slow-lateral-movement-down","title":{"rendered":"Beating the 29-Minute Clock: Controls That Slow Lateral Movement Down"},"content":{"rendered":"\n

Breakout time is the window between when an attacker compromises their first endpoint and when they pivot to a second one. It’s a useful metric because the worst outcomes of an intrusion (network-wide ransomware, mass data theft, full domain compromise) all depend on lateral movement to get there.<\/p>\n\n\n\n

CrowdStrike’s 2026 Global Threat Report<\/a> showed that the average eCrime breakout time dropped to 29 minutes in 2025, a 65% increase in speed from the year before. The fastest case on record was 27 seconds. For context, in 2018 the same metric sat at over four and a half hours<\/a>.<\/p>\n\n\n\n

When that window shrinks below an hour, manual response stops being viable. You can’t page someone, get them in front of a screen, and contain an active intrusion in 29 minutes. The controls have to be in place before the attacker arrives. Here are the ones that make the biggest difference.<\/p>\n\n\n\n

1. Remove Standing Admin Rights<\/h2>\n\n\n\n

If a user has permanent local admin, so does any malware they accidentally run, and so does any attacker who phishes their credentials. Permanent privileges are the single biggest accelerator of lateral movement, because they hand attackers everything they need to install tools, disable security software, and pivot to the next machine.<\/p>\n\n\n\n

Just-in-time privilege elevation<\/a> changes that math. Users get elevation only for the specific application they need, only for the time they need it, and only after the request is logged. If an attacker compromises that user’s session outside of an active elevation, they get the same restricted access the user normally has.<\/p>\n\n\n\n

Done well, this isn’t a productivity tradeoff. Admin By Request’s EPM solution<\/a> handles the elevation workflow without forcing users to wait around or call the helpdesk every time they need to install a printer driver.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

2. Segment the Network<\/h2>\n\n\n\n

In a flat network, every machine can reach every other machine, and lateral movement is mostly a matter of running a few commands. Segmentation removes that assumption by enforcing boundaries between what should and shouldn’t be talking to each other.<\/p>\n\n\n\n

The most useful boundaries are usually between user workstations and server infrastructure, because there’s rarely a legitimate reason for a laptop to be opening direct connections to domain controllers, file servers, or backup systems. Identity infrastructure and other critical assets are worth isolating further still. Host-based firewalls add another layer on the endpoint itself, blocking peer-to-peer SMB and RDP between workstations where legitimate users almost never need it.<\/p>\n\n\n\n

Segmentation doesn’t stop attackers, but it forces them to work harder and noisier to move. Every additional hop is another chance for detection to fire before they reach anything valuable.<\/p>\n\n\n\n

3. Restrict the Tools Attackers Use to Move<\/h2>\n\n\n\n

Even with admin rights removed and network segments in place, attackers can still move laterally using legitimate Windows components if those components are wide open. PowerShell Remoting, WMI, PsExec, SMB shares, and similar built-in tools are how most “living-off-the-land” attacks actually pivot between machines. They don’t need to drop malware when the operating system already provides everything required.<\/p>\n\n\n\n

The point isn’t to disable these tools entirely (some of them are genuinely useful for legitimate administration) but to make sure they aren’t usable from arbitrary user contexts. Restricting which accounts can initiate remote PowerShell sessions, disabling SMBv1 outright, and limiting WMI execution to specific admin tiers all narrow the available pathways. Application control adds another layer by blocking the binaries attackers commonly abuse for lateral movement, things like PsExec or remote execution utilities that have no business running on a regular user’s workstation.<\/p>\n\n\n\n

Admin By Request’s EPM solution covers part of this through application blocklisting and pre-approval rules, which let you define exactly which applications can elevate and which can’t, regardless of who’s trying to run them.<\/p>\n\n\n\n

4. Eliminate Persistent Remote Access<\/h2>\n\n\n\n

Always-on VPN tunnels and 24\/7 jump servers are reusable pathways. Once a user is authenticated, the connection sits open, and any compromise of that endpoint gives the attacker the same network access the legitimate user has. This matters for lateral movement because attackers frequently use existing remote access tools to pivot rather than installing their own.<\/p>\n\n\n\n

The third-party angle makes this worse. The 2026 Verizon DBIR<\/a> found that breaches involving a third party now account for 48% of all breaches, up 60% year over year. Vendor and contractor access is one of the most common ways attackers get a foothold that bypasses your perimeter controls entirely.<\/p>\n\n\n\n

Just-in-time remote access works differently. Connections are established only when a session is approved, scoped to specific resources, and torn down automatically when the work is done. There’s no standing tunnel to ride into your network. Our Secure Remote Access solution<\/a> does this through the browser, with no persistent agents on the endpoint and no inbound firewall rules to expose.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

5. Watch for Behavioral Signs of Lateral Movement<\/h2>\n\n\n\n

Detection still matters, but signature-based alerts won’t catch most modern attacks. CrowdStrike’s report found that 82% of detections in 2025 were malware-free<\/a>, meaning attackers used stolen credentials and legitimate tools already on the endpoint.<\/p>\n\n\n\n

What does fire alerts is behavior. Worth watching closely:<\/p>\n\n\n\n