An attacker has penetrated a network and is using lateral movement. Which defense will be effective?

Patching public-facing servers addresses initial access vectors but does nothing to impede an attacker who has already gained internal access and is moving laterally.

Alert thresholds on internet-bound traffic miss internal east-west lateral movement, which does not necessarily traverse the perimeter.

Attackers performing lateral movement frequently dump local credential hashes (e.g., via pass-the-hash or credential dumping) and reuse them on other hosts that share the same local admin password. Assigning unique passwords to every local administrator and service account - enforceable via Microsoft LAPS - eliminates the ability to pivot using a single compromised credential across the entire network.

Dual-homing hosts expands the attack surface by giving internally compromised hosts direct network paths to external resources, worsening rather than limiting lateral movement.