Layered cybersecurity: nine domains of defense

Explore the nine layers

1. L1

   Human Layer

   Phishing Sim · Awareness · Risk Score

   Most incidents start with someone clicking. We measure that risk person by person and bring it down with practice, not an annual talk.

2. L2

   Identity Security

   MFA · SSO · Conditional Access · PIM

   When a credential leaks, the attacker walks in the front door, with permission. This layer decides who can get in, from where, and with what privilege.

3. L3

   Endpoint Security

   EDR · XDR · Autonomous Response

   The user’s device is where the attack executes. Here we detect it by behavior and contain it before it spreads to the rest of the network.

4. L4

   Network Security

   ZTNA · Gateway · CASB · DLP · Email

   The perimeter stopped being the office. This layer controls traffic where it actually happens: between the user, the internet, and cloud applications.

5. L5

   Application Security

   WAF · DDoS · CDN · DNS · Bot Mgmt

   What you publish on the internet is exposed to everyone, all the time. This layer filters traffic before it reaches your application.

6. L6

   Vulnerability Management

   CVE Scan · Risk Score · Auto-Patch

   Having the vulnerability list doesn't help if no one works through it. We prioritize by real risk and follow through on closing it, not just reporting it.

7. L7

   Data Protection

   Backup · DR · Immutable · Legal Hold

   A backup only counts if it can be restored. We test recovery periodically so incident day isn't the first time.

8. L8

   Threat Intelligence

   IOC Feeds · MITRE ATT&CK · Dark Web

   Knowing what's attacking organizations like yours today changes what gets watched tomorrow. This layer feeds that context to the rest.

9. L9

   Data Security

   Classification · DLP · Insider Risk

   Before protecting information you need to know what is sensitive and where it lives. This layer classifies it and controls how it leaves the organization.