A compromised Wi-Fi laptop on the city network begins unusual lateral protocols toward internal hosts. Which control is best positioned to identify that behavior in transit?

When a compromised Wi-Fi laptop on the city network begins unusual lateral protocols toward internal hosts, a next-generation firewall that inspects and identifies rogue lateral protocols from the WLAN client path is best positioned to see that behavior in transit. Endpoint infection may start on the air, but east-west discovery and lateral tooling often become visible where policy inspection sits on the wired path after the AP or controller. Civic SOCs need that transit visibility beyond SSID renaming or cosmetic endpoint checks alone. A lobby TV content schedule cannot identify lateral protocols on the network. Renaming the SSID without traffic inspection changes branding, not packet analysis. Client wallpaper compliance alone does not inspect transit traffic for unusual protocol use between WLAN clients and internal hosts. Exam caveat: if WLAN clients are bridged flat with servers, the firewall may never see east-west flows—segmentation that forces traffic through an inspection point is part of making this control real rather than diagrammatic. Operational check: simulate or replay a benign unusual lateral protocol from a lab Wi-Fi client toward an internal host, confirm the next-generation firewall identifies or blocks it per policy, and verify the SOC receives an alert tied to the client identity or address.