Lateral movement
The stage where an attacker moves from the machine they first landed on toward the systems they actually want.
The first system compromised is rarely the target. It is a reception workstation or a marketing laptop, and from there the attacker hunts for cached credentials, mapped drives, and accounts with wider rights, hopping machine to machine until they reach a domain controller, the file server, or the backup console.
Flat networks and shared local administrator passwords make this trivially easy. Segmentation, unique local admin credentials, and tiered administrative accounts turn a single compromised laptop into a contained problem instead of a company-wide one.
Where this comes up
Lateral movement sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.