SSH that skipped the bastion was lateral movement confessing

Define 'impossible' flows, like internal SSH not coming from the bastion, and lateral movement becomes a one-line detection.