# How do segmentation and least privilege limit lateral movement?

They shrink what an intruder can reach from the first device they take over. Lateral movement means hopping from that device to others, usually with remote desktop, file shares or admin tools and with passwords gathered on the way. Segmentation puts firewalls or access rules between groups of systems, so a compromised office laptop cannot open a session to the database server or the backup system at all. Least privilege makes sure that the accounts found on that laptop cannot log in to servers either, because ordinary users are not local administrators everywhere and admin accounts are not used for e-mail. Allow-listing which hosts may use admin protocols closes the gap further. None of this is perfect, which is why it pairs with detection. NetSenX flags new host-to-host sessions over admin protocols that do not match a host's normal as lateral movement, on every plan, and from the Pro plan correlates them across hosts into one story.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/how-does-segmentation-limit-lateral-movement

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Where do I start segmenting a flat office network?](https://netsenx.com/en/faq/where-to-start-segmenting-a-flat-office-network)
- [How do I segment IT and OT with VLANs and access lists?](https://netsenx.com/en/faq/how-to-segment-it-and-ot-with-vlans-and-acls)
- [What is microsegmentation, and do small companies need it?](https://netsenx.com/en/faq/what-is-microsegmentation)
- [Is a VLAN a security boundary?](https://netsenx.com/en/faq/is-a-vlan-a-security-boundary)
- [How do I check that guest Wi-Fi cannot reach our internal network?](https://netsenx.com/en/faq/how-to-check-guest-wifi-cannot-reach-the-internal-network)