Network traversal is the movement an attacker makes through internal systems after gaining the first foothold in a target environment. It includes pivoting from one host to another, discovering reachable assets, and using internal trust relationships or remote services such as SMB, RDP, or SSH to continue the intrusion.
This matters because many breaches become serious only after the attacker leaves the entry point and reaches file servers, domain controllers, or other high-value systems. Defenders look for traversal by watching east-west traffic, unusual administrative logins, remote execution, and access that crosses normal segmentation boundaries. Strong network segmentation, least privilege, and detailed logging can slow or stop this stage and limit how far an intrusion can spread.