Lateral movement is a postexploitation activity during which a threat actor tries to compromise adjacent IT systems. After gaining initial access to an asset or network, the attacker begins to authenticate or exploit vulnerabilities in digitally connected assets to execute commands or gain visibility into additional resources. The goal is typically to escalate privileges, access sensitive data, or deploy additional malware to further the threat actor’s nefarious mission.