# How does application-layer brokering prevent lateral movement?

- Link: https://www.agilicus.com/faq/how-does-application-layer-brokering-prevent-lateral-movement/
- Published: 2026-05-11T15:50:25+00:00
- Author: Don Bowman

Application-layer brokering prevents lateral movement by connecting a user only 
to a specific application or service, rather than dropping them directly onto a 
network subnet. In traditional architectures, once a user is authenticated, they
can often see and attempt to connect to any device on the same local area network.
By brokering at the application layer, the user remains isolated from the underlying
infrastructure, ensuring that an adversary cannot use a single compromised session
to scan the network for other vulnerable targets. Learn about [brokering vs. port forwarding](https://www.agilicus.com/compare/port-forwarding/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).