Prevention fails. Not always, but often enough that planning around it is no longer optional. A phishing email lands, a credential leaks, a vendor gets compromised, and an attacker is inside with legitimate access.
What happens next decides whether it stays one machine or becomes the whole company.
Serious ransomware usually does not stop at the first machine it lands on. It moves from system to system, stealing credentials and reaching for anything else it can use, until it can hold the whole company at once.
The damage comes from the spread, not the entry. Limit the spread, and you limit the blast.
How attackers actually spread
Once inside, an attacker rarely needs new exploits. They abuse the same trust legitimate systems rely on every day. On a flat network, they move over SMB, RDP, and remote-management tools like WMI and PowerShell.
They dump cached credentials and reuse them, through techniques like Pass-the-Hash, to log in to the next machine as if they belonged there. And they go after Active Directory, the system that holds logins and permissions, to harvest credentials and climb toward control of the whole domain.
The more implicit trust a network carries, the further one compromised machine or identity reaches. Containment means removing that free movement before an attacker uses it.
Limit the blast radius
The core move is to make lateral movement harder, slower, and smaller, and it shows up in three places. Network segmentation cuts down on where a compromised machine can go: Illumio won in Zero Trust Security for mapping which systems actually need to talk to each other and closing off the rest.
Identity-based segmentation limits what a given user, device, or workload can reach, deciding access by who or what is connecting rather than where a machine sits: that is Elisity's approach, which also earned it recognition in OT security.
Default-deny execution limits what code can run in the first place: ThreatLocker won in Ransomware Protection for a model where software does not run unless it is explicitly allowed. Cut the path, narrow the identity, stop the execution.
Contain the access, too
Containment is not only a network problem. It is also an access problem: if one identity is stolen, what can it reach, from where, and under what conditions? That is the job of secure access platforms, and the goal in each case is the same, to shrink what a single session can touch.
Versa Networks ties access, networking, and security policy into one set of rules instead of running them as three. Island Technology delivers that access through the browser itself. Skyhigh Security controls how users and data move between cloud and on-premises systems.
The category labels differ; what they shrink is the same, how far a stolen session can reach.
Recovery is where containment gets tested
Some attacks get through anyway. Backups matter, but restoring corrupted data, or a broken identity layer, just hands the attacker a second round. Index Engines won in Ransomware Recovery for spotting the corruption ransomware leaves behind, so a company can roll back to a known-clean point instead of reinfecting itself.
Cayosoft won for fast recovery of Active Directory itself. When attackers break that, everything that depends on it stays down until it is rebuilt.
What to do now
- Map and cut the paths an attacker would use to move between machines. Work out which systems actually need to talk, and block SMB, RDP, and remote-management traffic between machines that have no reason to reach each other.
- Move to default-deny execution. Stop unknown or unsigned code from running, especially on servers and high-value endpoints, and restrict built-in tools that attackers abuse, like PowerShell and wmic, for users who do not need them.
- Cut standing privilege. Remove permanent admin rights where you can, grant elevated access only when it is needed rather than leaving it on, and watch service accounts and machine identities for misuse.
- Treat Active Directory as tier-0, your single most critical system. Limit who can query sensitive directory data, watch for credential-theft patterns like Kerberoasting and DCSync, and manage domain controllers only from isolated admin machines.
- Test recovery, including identity. Do not assume backups will work. Keep them isolated and immutable, so they cannot be altered, and rehearse restoring both data and Active Directory from a known-clean state.
The shift for defenders is one of assumption: stop designing only to keep attackers out, and start designing for the day one gets in, so a foothold stays a foothold instead of the whole company.
The real test is not whether every attack can be stopped at the edge. It cannot. It is whether one stolen password, one phished user, or one compromised vendor can still turn into a company-wide event.
Part of The Stars Briefing, our editorial series on the trends behind the 2026 Cybersecurity Stars Awards, a program The Hacker News runs. This piece analyzes where the field is moving and uses the winners as examples. It is not a product review. The complete list of 2026 winners is live at awards.thehackernews.com/winners/2026.