[amjo324]

The truth is that when reputable information security specialists are engaged to perform a no holds barred internal network penetration test or red teaming exercise for a client, they will gain full administrative access of the network in more than 9 out of 10 cases. There are well known and documented techniques for escalating privileges and traversing through a network. This is just the reality if you operate a typical Windows corporate network of a sufficient size.

In the past, companies mostly just accepted this risk and focused on protecting their network perimeter. Over time, this attitude has shifted and organisations now recognise the insider threat (e.g. a rogue employee/contractor or an external attacker who has already breached the perimeter).