# What does "assume breach" mean in practice?

It means planning as if an attacker is already inside, instead of relying only on keeping them out. The reason is practical: phishing, stolen passwords and supplier access mean the perimeter will be crossed sooner or later, so the questions become how far an intruder gets and how quickly you notice. In practice: limit what each account and host can reach, separate admin accounts from everyday ones, keep logs and network records long enough to investigate, keep offline backups, watch for movement inside the network, and rehearse what you will do when an alert comes, including who decides to disconnect a machine. Detection inside the network is part of this: NetSenX watches host-to-host traffic for scanning, lateral movement and beaconing, on every plan, so the steps an intruder takes after getting in become visible.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/what-does-assume-breach-mean

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Can network access control (NAC) replace network monitoring?](https://netsenx.com/en/faq/can-network-access-control-replace-monitoring)
- [Does a VPN contradict zero trust?](https://netsenx.com/en/faq/does-a-vpn-contradict-zero-trust)
- [What is zero-trust network access (ZTNA)?](https://netsenx.com/en/faq/what-is-zero-trust-network-access-ztna)
- [Is a firewall still needed if we have zero trust or SASE?](https://netsenx.com/en/faq/is-a-firewall-still-needed-with-zero-trust-or-sase)
- [How do segmentation and least privilege limit lateral movement?](https://netsenx.com/en/faq/how-does-segmentation-limit-lateral-movement)