How can our small team spot early indicators of lateral movement in networks before attackers manage to exfiltrate our sensitive financial records?