Defense in Depth
Layer independent safeguards so no single failure leads to compromise.
To an executive
No single safeguard is perfect. Several independent layers mean one failure is caught by another, so a single mistake does not become a damaging breach.
To an engineer
Stack independent controls, such as network limits, authentication, authorisation, monitoring and recovery. Make sure layers do not share a weakness, or they behave as one.
The idea
Medieval castles had moats, walls, gates and keeps. An attacker had to defeat every layer, and each layer bought time and gave defenders a chance to notice and respond.
In security and reliability, assume any single control will fail. NIST describes defence in depth as combining people, technology and operations into layered barriers, so that an attack missed by one countermeasure is caught by another. With overlapping, independent layers, a catastrophe needs several things to fail at once.
Why it works
Every control has a failure rate. Passwords get phished, firewalls get misconfigured, patches arrive late. Planning as if a control is perfect means planning for the day it is not.
Independent layers multiply protection. If two controls fail for unrelated reasons, the chance of both failing together is much smaller than either alone. The key word is independent.
Layers buy time to detect. Even when an attacker gets through several layers, each one slows them down and creates signals that monitoring can catch before they reach the data.
Where it applies
- Security architecture, from identity and network segmentation to encryption and audit.
- Data protection, where backups, access controls and deletion safeguards each catch different mistakes.
- Vendor and platform selection, to check whether a product adds a genuinely new layer or duplicates one you have.
- AI and agent systems, where prompts, tool permissions and output checks each limit what can go wrong.
How to apply
- Name the asset and the paths to it. Draw how an attacker or a mistake could reach the thing you care about.
- Assume each control fails in turn. For each layer, ask what stops the next step if this one is bypassed.
- Check for shared weaknesses. Layers that rely on the same credential, vendor, network or team are one layer, not two.
- Add detection between layers. Prevention will eventually fail; make sure breaching a layer is noticed.
- Test the layers. Run exercises that bypass one control deliberately and confirm the next one holds.
Example scenario
An attacker phished a developer's password. In an earlier design, that password alone would have opened the production console.
Because production also required hardware-key MFA, least-privilege roles and anomaly detection on unusual logins, the stolen password only reached a sandbox account. The alert fired within minutes, the credentials were revoked, and the post-incident review focused on phishing training rather than data recovery.
Questions to ask
- If this control fails, what stops the attacker at the next step?
- Do any two of our layers share the same weakness, credential or vendor?
- Where are we still relying on a single perimeter?
When not to use it
- Low-value, easily rebuilt assets, where several layers cost more in friction than the data is worth.
- As a substitute for fixing a known hole. Adding a new layer in front of a vulnerability you could patch is usually the slower, costlier option.
How it misleads you
Stacking layers that share the same weakness creates only the illusion of depth, for example three controls that all trust the same identity provider. Too many layers also create friction that users route around, which removes the protection you added. Count independent layers, not total ones.
In the wild
Further reading
Last reviewed · Suggest an improvement