Assumed-Breach Exercises Exposing Flat Internal Network Permissions

Assumed-breach exercises test what happens after an attacker gets inside. Their value is not in demonstrating exotic attacks, but in exposing how ordinary internal trust turns one compromised identity into control over much of an organization. Broad network access, standing privileges, and weak containment can do the attacker’s work without a novel exploit in sight.

Why assumed-breach differs from other offensive security tests

A traditional penetration test looks for as many weaknesses as it can in the time it has. An assumed-breach exercise instead follows one valid foothold as far as internal trust permits. Red teaming tests the full attack chain, but much of its time goes into reconnaissance and initial access. Assumed-breach skips that work to test what happens next.

Starting inside separates the strength of the perimeter from the organization’s ability to contain a compromise. The exercise asks how much becomes accessible from a single compromised identity before something stops the movement. A successful perimeter defense cannot obscure an internal path that remains wide open, and a successful intrusion does not automatically imply that every system behind it must fall. The useful finding is the distance between those two outcomes.

The structural condition exercises expose: internal trust treated as internal safety

The foothold often encounters an environment built for connectivity first. In a flat network, internal firewalls, access control lists, and segmentation rules do not constrain east-west movement between systems. The environment works as it was designed to work. An attacker benefits from the same connectivity that makes administration practical.

Zero Networks’ 2026 Lateral Movement Exposure Report uses trillions of activities across hundreds of enterprise environments to show the gap between saying a breach is assumed and enforcing limits on trust. The report found that most monitored servers accepted inbound RDP or SSH from many internal sources, while more than three-quarters were reachable over SMB or WinRM. These are administrative protocols. Their broad reachability becomes dangerous when there are no contextual controls governing who can connect, when, and to which target.

Administrators need ways to manage systems, while legacy dependencies can make disabling a legacy authentication protocol operationally disruptive. Yet preserving a necessary function does not make every use of it safe. The structural failure is treating an internal location as sufficient grounds for access, even while the security strategy says to assume an attacker is already there.

What overprivileged service accounts and machine identities add to the flat-network problem

Reachability determines where a connection can go, but identity determines what it can do on arrival. Service accounts often keep access to far more systems than they need for a single task. Standing privilege removes an entire step for the attacker. A compromised account may not need further privilege escalation because the permissions are already attached to it.

Testers extracted the local mscache of a service account from a dormant VM and cracked its password offline. The account had local admin rights across multiple servers and a non-expiring password. The SOC did not respond as the team enumerated the domain, escalated privileges, and moved laterally. An account left available for administration became a route through the environment.

The scale extends well beyond human account management. Cloud Security Alliance’s March 2026 research note cites estimates that AI agents alone are generating non-human identities at a ratio of roughly 82 to 1 against human accounts in enterprise environments [1][2]. The immediate issue, however, is the combination of privilege and reach. Least privilege limits what a credential can do on a flat network, while segmentation restricts where a powerful credential can travel. Broad credentials on flat networks lose both restraints.

How AD CS misconfigurations and cleartext credentials turn enumeration into domain compromise

CISA Advisory AA26-237A, “A Tale of Two SOCs,” published August 25, 2026, describes concurrent red team assessments at a Government Services and Facilities Sector organization and a Water and Wastewater Systems Sector utility. The teams reached full domain compromise and got into sensitive business systems and cloud resources in both environments. The route depended on configuration and exposed credentials. Publicly available tools including BloodHound, AzureHound, ROADrecon, and Rubeus supported the work.

The compromise chain moved from discovering trust relationships to exercising them. For privilege escalation, the teams used a default Machine Account Quota and a certificate services template that was misconfigured. Cleartext credentials then let the teams into sensitive business systems. Separately, long-lived static AWS IAM access keys kept in configuration files let the teams into another system, bringing the total to three. Those keys did not expire because credential expiration or rotation had not been configured.

Both environments also had service accounts with unreviewed permissions and SCCM reachable as an ordinary server without Tier 0 protection. These conditions explain the available paths, but not identical defensive outcomes. Organization A failed to detect or contain the activity. Organization B quickly spotted the first attempts at compromise, isolated the affected systems, and forced the team into an assume-breach model.

Why detection fails even when alerts fire

Organization A did not lack warning signals. CISA reported that its SOC received medium- and low-severity EDR alerts related to the red team’s activity but did not respond. Thousands of false-positive alerts from normal business operations obscured those signals, with many assigned higher severity. The detector had done part of its job. The process around it did not turn that signal into containment.

A separate Claranet purple team exercise exposed the opposite problem, with critical activity outside the monitoring perimeter altogether. A domain controller and the AD sync server were not onboarded with the client’s EDR tool, so logs from those systems were not collected and monitored. Testers targeted the Azure AD environment and the on-premises AD sync server, extracting credentials and sensitive data without being blocked or detected. The systems in those blind spots had far more authority than most. Missing visibility there was more consequential than a simple gap in endpoint coverage.

Together, these cases show why the presence of an EDR product or a SOC cannot establish that lateral movement will be contained. One environment generated alerts that went unanswered, while the other lacked monitoring on critical systems. Detection therefore depends on people, process, and technology working together. A functioning alarm is not the same thing as a response.

When lateral movement becomes a business continuity failure, not a security incident

The business consequence follows from which systems become reachable. An initial foothold becomes an operational crisis when the attacker reaches systems whose disruption stops the organization from functioning. Zero Networks’ report draws that distinction between intrusion and the consequences of lateral movement, including downtime, ransomware propagation, data exposure, failed recovery, and customer impact. Access to backup infrastructure, for example, threatens the ability to recover as well as the systems already compromised.

Speed makes this harder to manage as an ordinary incident. On a flat network without internal barriers, the interval between initial access and domain-wide control can be measured in minutes. The decision window shrinks as the potential disruption expands. Containment is therefore part of business continuity before operations stop.

Regulatory and insurance pressures reflect that connection. PCI-DSS 4.0 recommends segmentation for payment-card environments but does not require it. Without segmentation, the assessment must cover the whole connected network. Cyber insurers are more often treating flat internal networks that lack blast-radius controls as a risk when they underwrite policies. Both pressures attach practical consequences to the same architectural choice that an assumed-breach exercise tests.

AI agents inherit the flat-network problem and accelerate it

AI agents extend this trust problem. CSA’s research note describes how an agent holding OAuth tokens for email, file storage, and ticketing can traverse those systems through its delegated permissions. A traditional attacker must find, exploit, and authenticate against each target in turn. The agent may already have the necessary access. Its movement can be architecturally indistinguishable from legitimate operation.

Agent infrastructure also allows one compromise to expose several trust domains at once. A compromised Model Context Protocol, or MCP, server can expose OAuth tokens for email, file storage, calendar, and messaging simultaneously. CSA found that only a minority of organizations can reliably trace agent actions to a human sponsor across all environments, and fewer can consistently enforce runtime access controls. The old weakness gains a faster operator.

Anthropic’s November 2025 disclosure of the Chinese state-sponsored GTG-1002 campaign illustrates the operational stakes of automation. The campaign executed multi-stage intrusions against approximately 30 global organizations with minimal human operator intervention, using Claude Code and MCP for reconnaissance, exploitation, credential harvesting, lateral movement, and data exfiltration. That example does not make every enterprise agent an attacker. As agents spread across engineering, product, finance, and sales, that example shows why teams need to check what those agents can access. Zero Networks’ report asks directly, “Can this AI agent be governed with the same seriousness as a human admin?

Why microsegmentation is the right answer and why most organizations cannot finish deploying it

Microsegmentation addresses the network condition directly by removing unnecessary paths between workloads. Each path removed leaves the attacker with fewer places to go. The strategic case is straightforward, but deployment is not. Legacy applications rely on connections that teams may not fully understand, and restricting those connections can disrupt the work that relies on them.

A March 2026 technical preprint on TechRxiv identifies microsegmentation as the recurring stall point in large-scale Zero Trust Architecture deployments. The difficulty is enforcing workload-level controls across heterogeneous, legacy-heavy environments rather than persuading organizations that internal boundaries are useful. For organizations with hundreds of sites or thousands of unmanaged endpoints, deployment can take years.

Monitor-only deployment provides visibility, but it does not enforce boundaries or constrain lateral movement. A map is not a fence. CISA’s Organization B demonstrated the value of rapid detection and isolation without perfect microsegmentation. Its response supports a more practical conclusion, that controls on the highest-value paths can provide substantial containment before the entire environment is segmented.

What organizations can act on after an assumed-breach exercise surfaces these findings

The practical response begins with visibility and enforcement that make access decisions legible. Teams need to see which paths and identities are in use, tell permitted activity from policy violations, and put restrictions into force as well as watch what happens. The exercise provides the basis for sequencing those controls. Its most useful output is a demonstrated route from limited access to disproportionate authority.

Protocol reachability is the first lever to constrain. Per-session authorization for RDP, SMB, WinRM, and SSH can replace persistent reachability on the highest-risk east-west paths without waiting for complete microsegmentation. Service account privilege review comes next. Rotating credentials, enforcing expiration, and scoping permissions to the task address the non-expiring passwords and broad local-admin rights repeatedly observed in exercises.

Control-plane protection then concentrates those restrictions where compromise has the greatest consequences. Domain controllers, AD sync servers, backup infrastructure, and SCCM should be treated as Tier 0 and isolated from user-network reachability. Detection on these systems also needs tuning and a process that acts on significant alerts. Organization B shows the value of coupling signals with isolation and a willingness to intervene.

Agent identities require the same discipline, including discovery, monitoring of approved traffic, detection of policy violations, enforced limits, and audit logs of every action. CSA’s research frames each agent as a distinct identity principal subject to least privilege, with explicit trust boundaries and tool-invocation authorization. These controls extend containment to identities operating at machine speed. Zero Networks’ foreword puts containment first and makes no promise that every compromise can be prevented. One laptop stays one laptop, one workload stays one workload, and one agent stays one agent.