ANSWER 1 OF 1 · contributed by Ahmed Schrute

1. A single compromised workstation becomes an organisation-wide breach mainly through lateral movement, where one reusable credential opens many hosts.
2. Unique per-host local administrator passwords, rotated automatically and held centrally, remove the shared secret that makes one captured credential reusable everywhere.
3. The measurable claim is blast radius: count hosts reachable from one compromised machine before and after rotation, in a lab with seeded credentials.
4. The cost is operational, because emergency local access now depends on a central service, so its outage becomes an incident-response problem of its own.
5. Next, simulate loss of that credential service during an incident and measure how long regaining local host access actually takes.