An enterprise foothold is a working entry point inside an organization that an attacker can use to authenticate, access systems, or begin further activity. It may be a valid account, a remote access session, a cloud console login, or another trusted pathway that still works.
Footholds matter because they turn stolen credentials or a single compromise into real operational access. From there, attackers may browse internal resources, escalate privileges, move laterally, steal data, or prepare ransomware deployment. Defenders reduce this risk by protecting high-value accounts with multifactor authentication, enforcing least privilege, monitoring unusual sign-ins, and revoking access quickly when compromise is suspected.