Failure pattern · 9 documented incidents

Insufficient segmentation lets a foothold spread

One compromised account, vendor or network segment reaches management planes, backups and everything else.

See it happen

Watch how this failure unfolds, then switch to the same situation with the safeguard in place. Click any step to replay it.

Scroll the diagram sideways to see every system.

12 / 12 s

One foothold, total compromise, backups included.

What goes wrong:

  1. An attacker phishes a contractor’s VPN login.
  2. The network is flat, so that one login reaches everything.
  3. From the management plane it reaches the data and the backups.
  4. One foothold, total compromise, backups included.

With the safeguard:

  1. An attacker phishes a contractor’s VPN login.
  2. The contractor can reach only the one system they support.
  3. Management and backups are isolated, with separate credentials.
  4. The breach stays contained to one system.

What it is

One compromised account, vendor or laptop can reach almost everything: management tools, databases and even the backups. A single foothold becomes a company-wide breach.

How it happens

  • The internal network is flat, with few boundaries between systems
  • Vendors and contractors get broad network access
  • Backups and admin tools are reachable with everyday credentials

What it causes

  • A small intrusion spreading to every system
  • Backups encrypted or deleted along with production
  • Weeks of recovery instead of one isolated system

Warning signs

  • Accounts reaching systems unrelated to their role
  • Vendor access that isn’t limited to what they support
  • Admin interfaces reachable from the general network

How to prevent it

Segment management planes, vendors and backups. Separate admin identities and management planes from ordinary accounts, restrict vendor access to what they need, and keep offline or immutable backups with rehearsed recovery.

  • Networks are segmented, so each account and vendor can reach only what it needs
  • Management tools and backups sit in separate zones with separate credentials
  • At least one backup copy is immutable or offline, out of reach of an attacker with admin rights

Key ideas:Network segmentationBlast radius

Check your system against the full launch checklist

Real incidents with this pattern

Documented incidents first. Each links to its public source.

Open in the database
34 security advisories and illustrative scenarios with this pattern

In the standards

CollectSEA's mapping; not an official determination by the standards bodies.