A report from Zero Networks analyzing 54 trillion activities across 312 enterprise environments reveals that over 80% of enterprise servers are reachable from anywhere inside the network. Key findings: 87% accept inbound RDP or SSH from broad internal sources, 78% are reachable via SMB or WinRM, 43% of internal authentication still uses legacy NTLM, and 12% of organizations maintain direct user-to-server admin pathways. Security experts confirm these findings match real-world red team and penetration test observations, noting attackers rarely need zero-days once inside — they simply use built-in admin tools. Recommended countermeasures include micro-segmentation, retiring legacy protocols like NTLM, identity-driven least privilege, and stricter separation of privileged access.
