A single unflagged service account and an unaudited AD trust relationship turned into a $1M, multi-forest incident. This piece is for security architects and engineers running hybrid Active Directory: how lateral movement actually happens, how Microsoft Defender for Identity detects it now that the old path map is gone, and the validation checklist to run before it happens to you.