What Is Defense in Depth?
Defense in depth is the practice of layering independent security controls so that no single failure becomes a breach. If an attacker slips past one layer, another stands behind it. The strategy assumes — correctly — that every individual control will eventually fail, and designs for that day rather than pretending it will not come.
Why isn’t one strong control enough?#
Because every control has a failure mode, and attackers hunt for exactly that. A firewall does nothing against a malicious insider; input validation does nothing against a stolen credential; a strong password does nothing once phishing has handed it to an attacker. Each control is a wall with a specific door. Depth is about ensuring that walking through one door lands you in front of another.
The layers should be independent — their failures must not correlate. Ten scanners that all miss the same bug are one layer wearing ten badges.
What does layering look like in practice?#
For a single web request, depth might stack like this:
| Layer | Stops | If it fails |
|---|---|---|
| Network / WAF | Obvious attack traffic | Request still hits the app |
| Authentication | Unauthenticated access | Authorization still checks rights |
| Authorization | Acting on others’ data | Input validation still applies |
| Input handling | Injection payloads | Output encoding still neutralizes |
| Monitoring / logging | Nothing — it detects | You still learn an attack happened |
Notice the last layer prevents nothing. Detection and response are part of depth precisely because prevention is assumed to fail.
Defense in depth is how the CIA triad survives contact with reality, and it is the reason a threat model plans for control failure. See the Security Fundamentals hub for the rest of the toolkit.
Frequently asked questions#
Is defense in depth just buying more security products?
No — that is a common and expensive misreading. Defense in depth is about independent, overlapping controls, not quantity. Ten tools that all fail the same way provide one layer, not ten. The goal is layers whose failure modes do not correlate, so a single bypass does not defeat all of them.
What is the difference between defense in depth and layered security?
They are often used interchangeably. Purists reserve defense in depth for a strategy that also assumes controls will fail and plans detection and response around that assumption, while layered security refers narrowly to stacking preventive controls. In practice, treat depth as layering plus the expectation of failure.