Containing a domain compromise: How predictive shielding shut down lateral movement