Modern cyberattacks often involve more than compromising a single endpoint. After gaining initial access, attackers may move between workstations, servers, applications, and cloud workloads to obtain additional privileges and reach valuable assets. This activity is known as lateral movement. While north-south traffic monitoring focuses on communications entering or leaving an environment,...