What if the best way to prepare for the next cyberattack is to stop obsessing over every new tool and study the moves attackers still need to make?
In this episode of The Business of Cybersecurity, I welcome back Raghu Nandakumara, VP of Industry Strategy at Illumio, for a practical conversation about attacker tactics, lateral movement, zero trust, microsegmentation, and cyberattack containment.
Security news often emphasizes the latest exploit, malware strain, or AI capability. Raghu argues that the underlying structure of an attack remains much more predictable. Whether the intruder is a nation-state actor, a less experienced criminal, or an autonomous system, it still needs to enter a target environment, find a route through it, and reach an objective such as stealing data or taking systems offline.
That distinction between tactics and techniques matters because defenders cannot anticipate every future method. They can, however, make each stage of an intrusion harder. Raghu compares the sequence he describes in a recent frontier-model security incident with the Target breach from over a decade earlier. The technology and procedures differed, but both involved access, credentials, lateral movement, and a final objective.
We also discuss the difficulty created by the volume of security telemetry. More alerts do not automatically produce better decisions. Raghu explains why data needs context about applications, identities, connections, and vulnerabilities before an analyst or AI system can connect events and identify the risks that deserve attention.
For Raghu, zero trust reduces the implicit access attackers rely on after entering a network. Microsegmentation can limit how far they move, force them to take additional actions, and create signals that improve the chance of detection. This reframes containment as a control designed before an incident rather than a response improvised after one.
The conversation also challenges the idea that initial access proves prevention has failed. Preventing every attack is unrealistic, but leaders can measure whether controls contained the blast radius, protected business operations, and stopped the intruder from reaching valuable systems. Raghu describes prevention, detection, and containment as a three-legged stool, because relying on only two leaves the defense far less stable.
Finally, we consider tool sprawl and testing. Raghu uses the Swiss cheese model to explain why identity, endpoint, network, cloud, and incident-response teams must understand how their controls overlap. Mapping those controls against MITRE ATT&CK or the Lockheed Martin Cyber Kill Chain can reveal an open path through the organization. He also argues that red-team exercises should resemble real attacks rather than rehearsals announced inside a comfortable change window.
Would your security controls interrupt an attacker under real conditions, or have they mainly proved themselves when everyone knew the test was coming? Listen to the conversation and share your thoughts with me.