In fact, it’s not a matter of if, but a matter of when you will be successfully breached. You still need to do the basics – patching, firewalls, endpoint AV, threat detection and so on. But you also need to protect against, and monitor for, lateral movement.