In analysing a real incident, why might "lateral movement" be impossible to reconstruct afterwards, and what does that reveal about an organisation's security maturity?

Question

Accepted Answer

If logging and monitoring were inadequate, the attacker's spread between systems leaves no traceable record — a sign of low detection capability and security maturity.
Lateral movement is how an attacker, after gaining a foothold, pivots from one internal system to others. Reconstructing it requires sufficient logs, network visibility and retained telemetry. When investigators cannot reconstruct it, the usual cause is that the necessary sensors and log retention were missing — exactly the visibility gap that detection depends on. So an inability to trace lateral movement is itself evidence of a low security maturity level (Security Reifegrad): weak detection means attackers can move and dwell undetected.
Go deeper:

MITRE ATT&CK — Lateral Movement (TA0008) — the catalogue of concrete techniques attackers use to pivot between internal systems after gaining a foothold.