How would you secure a multi-tenant cloud environment to prevent lateral movement after a hypothetical breach?