Free tools Windows power users keep installed
One-click scans. No signup required.
Attackers can move between on-premises systems, cloud services, identity providers and SaaS by reusing credentials or tokens, assuming roles, or abusing legitimate administration tools. A SOC is more likely to detect that chain when it correlates identity, device, network, workload and data activity across environments—not when it treats each login or alert in isolation.
What is a cross-environment pivot?
A pivot is an adversary’s use of access in one system, identity domain or environment to reach another. MITRE ATT&CK describes cloud accounts as cloud-only or connected to on-premises environments through synchronization or federation. That connection can create a route in either direction when an account is compromised or overprivileged; it does not mean that every hybrid identity is vulnerable or every cross-environment login is malicious. See MITRE ATT&CK’s Valid Accounts: Cloud Accounts (T1078.004).
As an Amazon Associate I earn from qualifying purchases.
In practice, the investigation is about a sequence: an initial foothold or credential compromise, use of an identity or token, a privilege change or role assumption, access to another resource, and then execution or data access. A valid authentication event establishes that a credential or session was accepted; it does not establish who controlled it or whether the resulting activity was authorized.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11MITRE describes lateral movement as techniques used to enter and control remote systems. Its linked Lateral Movement tactic page is specifically for ICS, so it should not be mistaken for a catalog of every enterprise technique. The cross-environment problem is broader: an attacker may cross an administrative or identity boundary without using a conventional endpoint-to-endpoint exploit.
#1 Best Overall
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
How can an attacker move from on-premises systems to cloud services—or back?
Reuse a connected identity
When identities are synchronized or federated, compromise of a shared or privileged account can expose resources in more than one environment. The route depends on the organization’s identity design and permissions. A cloud account with broad access may also reach storage, databases or other services if its roles and resource permissions allow it.
Abuse a token, role or service identity
Credentials are not the only means of access. An attacker may use an existing session token, assume a role, or exploit permissions granted to a service or workload identity. These events can look different from an interactive password login, so the SOC needs visibility into identity and authorization activity as well as authentication.
Turn legitimate administration into a bridge
Deployment systems and other administrative tools can reach both cloud services and hybrid-joined devices. MITRE notes that a highly privileged cloud identity may be used with SaaS deployment tooling to run commands on hybrid-joined devices. The tool’s legitimate purpose does not make every action benign: investigate who initiated it, from which session and device, against which targets, and whether the change fits the account’s normal role.
Recommended Free Tools
Rank #2
- SECURE UPGRADE PLUS PROGRAM (2-Yr, Advanced Edition): SonicWall upgrade path that bundles a new TZ280 appliance with the Advanced Protection Suite (APSS). REQUIREMENTS: for customers upgrading from an existing SonicWall firewall; a qualifying prior unit may be required at registration.
- SERVICE BUNDLE – ADVANCED PROTECTION SUITE (APSS): all Essential services plus Capture ATP cloud sandboxing with patented RTDMI, advanced DNS security, cloud Network Security Manager (NSM) management, reporting & analytics, and 24/7 support — SonicWall's recommended all-in security suite.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
These are possible paths, not proof that a particular organization is exposed. Misconfiguration, excessive privilege, reachable systems and weakly protected credentials affect whether a pivot succeeds.
Why can endpoint-only or network-only monitoring miss the chain?
A cloud service may expose important activity through identity-provider, audit or control-plane events rather than through a sensor installed on a host. SaaS and managed services can have still different logging surfaces. MITRE’s 11 Strategies of a World-Class Cybersecurity Operations Center notes the variety of cloud assets and telemetry, including identity integrations, cloud email and productivity services, SaaS, PaaS, and key or certificate storage.
A conventional endpoint alert may show a command on one device but not the cloud role that enabled it. A cloud audit event may show access to a resource but not the workstation, directory activity or administrative session that preceded it. Network monitoring can reveal a connection while missing the identity context or actions inside a managed service. The gap is often relational: each system records part of the story, but alerts are not joined into one timeline.
What the SOC can actually reconstruct depends on each service’s audit configuration, retention period, licensing and event detail. Logging should be verified service by service; do not assume every provider emits the same fields or that an enabled connector captures all relevant events.
What telemetry should the SOC correlate?
Build an identity-centered view that joins a principal and session to a device, action and target resource. The following sources provide complementary context; event names and fields vary by platform.
- Identity provider: authentication outcomes, federation and synchronization events, session or token activity, role changes, and service or workload identity use.
- On-premises endpoint and directory: account and group changes, administrative execution, remote service use, and the device or directory context associated with them.
- Cloud control plane and workloads: audit actions, role assumptions, workload identity use, and access to storage, databases or other sensitive resources.
- SaaS and deployment systems: administrative changes, software deployment actions, initiating account and session, and the devices or services reached.
- Network and asset context: source and destination, asset ownership and criticality, and whether the account, device and resource normally interact.
- Data activity: where available, access, export or modification events that help distinguish routine administration from activity with consequential impact.
CISA’s Cloud Security Technical Reference Architecture recommends enterprise-wide identity awareness across cloud and on-premises environments, as well as integrated asset and vulnerability management. That context helps analysts interpret events rather than treating a familiar username as sufficient attribution.
Rank #4
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
How should analysts investigate a suspected pivot?
- Start with the alert and preserve context. Record the account or principal, session identifiers if available, source device and address, event time, target resource and action. Preserve relevant logs before retention limits or response changes remove context.
- Reconstruct the identity path. Look backward and forward across authentication, federation or synchronization, token or session use, role assumption, privilege changes, and service or workload identity activity. Establish which identity authorized each step, not just which username appears in the event.
- Connect the endpoint and administrative activity. Check the associated device for execution, remote service use and account changes. Determine whether a cloud or SaaS administrative tool initiated activity on that device, and whether the device is expected to be managed through that path.
- Trace the resource and outcome. Identify which cloud, SaaS or on-premises resources were reached and what happened there. Review workload, control-plane and data events to see whether access led to execution, configuration changes or sensitive data activity.
- Compare with expected relationships. Use asset ownership, business role, normal source device, usual access pattern and change records. An unusual combination can merit investigation even when each individual action is technically permitted.
- Contain the chain, not just the first alert. Coordinate identity, cloud, endpoint and network responders. Depending on evidence and business impact, revoke sessions or credentials, disable or narrow an identity, isolate a device, and restrict the relevant administrative or east-west path.
Keep the timeline explicit: event times, affected principal and resource, evidence source, and response action. If a provider’s logs do not expose a needed relationship, record that limit rather than inferring the missing step.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which controls reduce the chance and impact of a pivot?
A practical implementation sequence, synthesized from MITRE, CISA and NIST guidance, is to map trust relationships first, then reduce unnecessary access and strengthen monitoring and containment around the paths that remain.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- Map identities and trust: inventory human, service and workload identities; document federation and synchronization; identify accounts that span environments and the resources they can reach.
- Remove excess privilege: narrow roles and permissions, remove stale accounts and credentials, and separate routine administration from high-impact duties.
- Protect sessions and credentials: require strong authentication appropriate to risk and protect tokens and session material. Plan for revocation so responders can invalidate active access, not only reset a password.
- Scope non-human identities: grant service and workload identities only the permissions and resource reach their tasks require, and review how their credentials or tokens are issued and used.
- Segment access paths: limit communication between network zones and constrain administrative routes. Segmentation reduces opportunities for movement and can limit blast radius, but it does not replace identity controls or monitoring.
- Collect and retain usable telemetry: enable relevant identity, endpoint, directory, network, cloud, SaaS and workload auditing; verify retention and alert routing against investigation needs.
- Plan coordinated containment: make sure responders can revoke identity sessions, restrict cloud access, isolate endpoints and block network paths in a coordinated way.
NIST’s SP 1800-35, Implementing a Zero Trust Architecture: High-Level Document (June 2025) addresses secure access to resources distributed across on-premises and multiple cloud environments. NIST describes the project as involving 24 collaborators and 19 example implementations; those figures describe the guide’s project scope, not measured proof that a particular deployment prevents compromise. The guide’s central idea is that access should be secured across distributed resources rather than inferred from a user’s location alone.
Best Value
- SonicWall TZ370 High Availability Unit (02-SSC-6443) - Seamless Failover Protection: Designed to pair with a primary SonicWall firewall for automatic failover and continuous network uptime. Not a Standalone unit - requires an identical primary SonicWall appliance; cannot function independently.
- Protects against encrypted malware and intrusions using DPI-SSL inspection, IPS, anti-malware, and Capture ATP sandboxing with RTDMI detection.
- Secure SD-WAN intelligently steers traffic across links to reduce MPLS costs and improve cloud application performance for branch users.
- Zero-Touch deployment, SonicExpress onboarding, and centralized management via Network Security Manager simplify rollout and ongoing operations.
- Scales up to 900,000 to 1,000,000 concurrent connections depending on policy mix, supporting secure growth across users and devices.
For network architecture context, NIST also publishes SP 800-215, Guide to a Secure Enterprise Network Landscape (November 2022). Organizations should tailor architecture and controls to the services they operate, their logging capabilities, regulatory obligations and operational constraints.
How can a SOC prove its cross-environment coverage works?
Test a realistic chain that begins with one compromised identity or session and crosses the organization’s actual boundaries. CISA’s March 2023 advisory, CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks, describes activity spanning on-premises SecOps systems, non-SecOps systems and SecOps cloud infrastructure, including workstation-to-workstation movement using an administrator account. CISA recommends testing security processes; the advisory does not prescribe a universal exercise cadence.
Use tabletop and technical exercises to check whether people and systems can:
- detect and link identity, endpoint, cloud and SaaS events into a usable timeline;
- identify the affected principal, session, devices and resources without relying on an isolated alert;
- decide when to revoke access, isolate a system or restrict a route, including the business impact of each action; and
- confirm that containment took effect across the identity provider, cloud tenant, endpoints and network controls.
Compare programs using concrete questions, not a product label or an assumed maturity score:
| Assessment area | Question to answer |
|---|---|
| Identity coverage | Can analysts see authentication, federation, role changes, token use, and service or workload identities across environments? |
| Telemetry coverage | Are relevant endpoint, directory, network, cloud control-plane, SaaS and workload events collected and retained? |
| Relationship context | Can responders connect principal, device, session, privilege and resource rather than investigate isolated alerts? |
| Containment and blast radius | Can teams revoke sessions or credentials, scope identities, isolate endpoints and constrain east-west or administrative paths? |
| Operational proof | Have cross-boundary scenarios tested whether detection, triage and containment actually work? |
These are decision questions drawn from MITRE, CISA and NIST guidance, not a quantified maturity scale or product ranking.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
