Passive discovery, intent segmentation, and protocol-aware detection reduced lateral propagation risk without impacting safety.