Defence in depth
Also known as: defense in depth, layered security, layered defence
Defence in depth is a security strategy that uses several independent layers of protection, such as firewalls, multi-factor authentication, endpoint protection, network segmentation, backups, and staff training, so that if one layer fails, others still protect the organization.
No single control is perfect, so layers buy time and limit damage. While the idea is simple, adding layers without coordination can create complexity, cost, and gaps between tools.
Defence in depth, explained at three levels
At home
Think of a castle with a moat, high walls, guards at the gate, and a locked tower for the treasure. If attackers cross the moat, the walls still stop them, and so on. Defence in depth applies that to your digital life: a spam filter, MFA, a password manager, and backups each work differently, so a scammer who gets past one still has to beat the rest.
At work
Defence in depth is a security strategy that layers several independent protections, such as MFA, endpoint protection, network segmentation, staff training, and backups, so that no single failure leads to a breach. If an employee clicks a phishing link, another layer still catches the attack or limits the damage. Businesses use it because every control fails eventually, and layers buy time to respond.
At home
Defence in depth assumes every single protection will fail at some point. So instead of relying on one, you stack several that work differently. At home, a phishing email might get past your spam filter, but your password manager will not autofill on a fake site, MFA blocks a stolen password, and backups recover your files if all else fails. An attacker has to beat every layer, not just one, which is far harder.
At work
Layers usually span identity, such as MFA and least privilege, devices, such as EDR and patching, network controls such as firewalls and segmentation, application security, data protection through encryption and DLP, people through training, and recovery through backups and incident response. The key design rule is independence: layers should fail for different reasons. Two products that rely on the same signature database, or that one stolen admin account can disable, are really one layer.
At home
More security tools are not automatically better. Overlapping antivirus programs can slow your computer or conflict, and constant prompts teach people to click through without reading. When protections become annoying, people switch them off, which removes a layer entirely. In my view, a few well-chosen layers you actually keep running, such as updates, a password manager, MFA and backups, beat a pile of tools you end up ignoring.
At work
The concept comes from military doctrine and was adopted by the NSA for information assurance. Map layers to attack paths using the kill chain or MITRE ATT&CK to find stages with only one control or none. Check independence by asking what a single compromised admin account, identity provider or management console could disable. Measure detection and response, not only prevention, and rationalize overlapping tools to cut cost and alert fatigue, since unused or untuned layers give false comfort.
Real-world examples
At home
Carlos clicked a phishing link and entered his password. Because he had MFA, the attacker still couldn't log in, and his password manager flagged the fake site afterward.
At work
Fatima is security manager at a Halifax shipping firm. When a staff member's laptop got malware, EDR contained it, segmentation blocked spread, and backups were untouched. No single control had to be perfect.
Common confusions
- A good firewall is enough to keep a business safe. — Attacks often come through email, stolen passwords, or cloud apps, bypassing the firewall. Multiple layers are needed.
- Defence in depth means buying as many security products as possible. — It means independent, complementary layers. Overlapping tools can add cost and complexity without adding protection.
For analysts
I'd present security plans as layers mapped to real attack scenarios. It helps leaders see why each investment matters and where a single failure would still be caught.
History & origin
The concept comes from military strategy, where defenders use multiple lines of defence to slow and weaken attackers rather than relying on one wall. The US National Security Agency promoted defence in depth for information security in the early 2000s, describing layers across people, technology, and operations. Nuclear safety engineering uses a similar idea. Psychologist James Reason's 'Swiss cheese model' of accidents, developed in the 1990s, offers a popular analogy: each layer has holes, but attacks succeed only when holes line up. Zero trust thinking in the 2010s and 2020s extended the idea by removing assumed trust inside networks. In my view, defence in depth is the most useful mindset for small businesses, because it accepts that something will fail.