[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Defense in Depth?](/blog/defense-in-depth) Publish date October 21, 2026 {x} minute read # What is Defense in Depth? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Defense in depth is a [cyber security](https://www.upguard.com/blog/cyber-security) strategy that uses a series of layered, redundant defensive measures to protect [sensitive data](https://www.upguard.com/blog/sensitive-data), [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) and information technology assets.  If one security control fails, the next security layer thwarts the potential [cyber attack](https://www.upguard.com/blog/cyber-attack). This multi-layered approach reduces the [cyber threat](https://www.upguard.com/blog/cyber-threat) of a particular [vulnerability](https://www.upguard.com/blog/vulnerability) [exploit](/blog/exploit) being successful, improving the security of the system as a whole and greatly reducing [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk). Simplicity in security is the opposing principle to defense in depth. It operates under the assumption that multiple security measures increases complexity and leads to gaps attackers can leverage. Data centers, the [Internet of Things (IoT)](https://www.upguard.com/blog/internet-of-things-iot) and remote working are all great examples of things that can increase organizational productivity and employee happiness that introduce security risks.  Organizations need to balance productivity and simple security solutions with defense in depth.  ## Table of Contents 1. [Where does defense in depth come from?](#origin) 2. [How does defense in depth work?](#work) 3. [What are the elements of defense in depth?](#elements) 4. [An overlooked part of defense in depth](#overlooked) 5. [How UpGuard can improve your defense in depth strategy](#upguard) ## Where Does Defense in Depth Come From? Defense in depth comes from the National Security Agency (NSA). It was conceived as a comprehensive approach to [information security](https://www.upguard.com/blog/information-security) and cyber security. The term was inspired by a military strategy with the same name.  In practice, the military strategy and the information assurance strategy differ.  Defense in depth as a military strategy revolves around having a weaker perimeter defense and intentionally yielding space to buy time to build a counter-attack. As a cyber security strategy, defense in depth involves parallel systems of physical, technical and administrative countermeasures that work together but do not intentionally cede control to an attacker. A honeypot is akin to the military version of defense in depth. Many people refer to defense in depth as the castle approach as it mimics the layering of defenses used by medieval castles. Before attackers could get to the castle, they had to beat the moat, ramparts, drawbridge, towers and battlements. ## How Does Defense in Depth Work? The most important thing to understand about defense in depth is that a potential attack should be stopped by several independent methods. This means security solutions must address security [vulnerabilities](https://www.upguard.com/blog/vulnerability) over the life cycle of the system, rather than at one point in time.  The increasing sophistication of [cyber attacks](https://www.upguard.com/blog/cyber-attack) means organizations can no longer rely on one security product to protect them. Security professionals need to apply defense in depth across all IT systems. From employee laptops needing protection from Wi-Fi based [man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack) to [domain hijacking](https://www.upguard.com/blog/domain-hijacking) prevention with [DNSSEC.](https://www.upguard.com/blog/dnssec) There is no one layer of security that protects against all [cyber threats](https://www.upguard.com/blog/cyber-threat). Cybercriminals are becoming increasingly sophisticated in their attacks and organizations need to respond by improving their defense in depth. Poor [access control](/blog/access-control), [phishing](https://www.upguard.com/blog/phishing), [email spoofing](https://www.upguard.com/blog/email-spoofing), [ransomware](https://www.upguard.com/blog/ransomware), [data breaches](https://www.upguard.com/blog/data-breach), [data leaks](https://www.upguard.com/blog/data-leak), [typosquatting](https://www.upguard.com/blog/typosquatting) and different [types of malware](https://www.upguard.com/blog/types-of-malware) can all be used in combination to attack your organization. The daily growth of [CVE](/blog/cve) highlights how vulnerable every organization is. A great example for the need for defense in depth was the spread of the [WannaCry](https://www.upguard.com/blog/wannacry). It highlights how poor global [cyber resilience](https://www.upguard.com/blog/cyber-resilience) is.  Organizations need multiple security layers including firewalls, antimalware and antivirus software, [intrusion detection systems](https://www.upguard.com/blog/intrusion-detection-system), [data encryption](/blog/encryption), physical controls and security awareness training to reduce the range of [possible attack vectors](https://www.upguard.com/blog/attack-vector).  ## What are the Elements of Defense in Depth? There are three core parts of any defense in depth strategy namely: 1. **Physical controls: **Security measures that prevent physical access to IT systems such as security guards, keycards and locked doors. 2. **Technical controls: **Security measures that protect [network security](https://www.upguard.com/blog/network-security) and other IT resources using hardware and software, such as intrusion protection systems, [web application firewalls](https://www.upguard.com/blog/web-application-firewall), configuration management, web scanners, [two-factor authentication](https://www.upguard.com/blog/two-factor-authentication), biometrics, timed access, password managers, virtual private networks, at rest encryption, hashing and encrypted backups. 3. **Administrative controls: **Security measures consisting of policies and procedures directed at an organization's employees and their vendors. Examples include information security policies, [vendor risk management](https://www.upguard.com/blog/vendor-risk-management), third-party risk management frameworks, [cyber security risk assessments](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-risk-assessment) and information risk management strategies.  Together, physical, technical, and administrative controls form a basic defense-in-depth strategy.  Additionally, many security professionals utilize [Vendor Risk Management software](https://www.upguard.com/product/vendor-risk) to ensure that vendor security controls align with an organization's cybersecurity defense plan. ## An Overlooked Part of Defense in Depth Every organization wants to protect theirs and their customers [sensitive data](https://www.upguard.com/blog/sensitive-data) from [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak). However, many organizations fail to successfully [manage third-party risk](/blog/manage-third-party-risk) and [fourth-party risk](https://www.upguard.com/blog/what-is-fourth-party-risk). It's no longer enough to simply ensure your organization is secure. Many [big data breaches](https://www.upguard.com/blog/biggest-data-breaches) are caused by [third-party vendors](/blog/third-party-vendor). If you are outsourcing business functions or storing sensitive information on cloud providers, you need to think through how you are managing your vendors.  Your defense in depth strategy needs to look beyond the perimeter of your organization and properly vet third and even fourth-party vendors (the vendors of your vendors) to understand who has access to sensitive data and how good their cyber security is. The 2013 Target data breach,[ which began with an air conditioning subcontractor](https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/), is one such example, but the danger of third-party vendor risk has only increased. [More third party breaches are being discovered](https://www.upguard.com/breaches) than ever before. The design of [Third-Party Risk Management frameworks](https://www.upguard.com/blog/third-party-risk-management-framework) have evolved to better address this new category of cyber risks. ## How UpGuard Can Improve Your Defense in Depth Strategy [UpGuard](https://www.upguard.com/) helps companies like [Intercontinental Exchange](https://www.upguard.com/customers/ice-nyse), [Taylor Fry](https://www.upguard.com/customers/taylor-fry), [The New York Stock Exchange](https://www.upguard.com/customers/ice-nyse), IAG, First State Super, Akamai, Morningstar and NASA protect their data and [prevent data breaches](/blog/prevent-data-breaches). Our [data breach research](/breaches) has been featured in the [New York Times](https://www.nytimes.com/2018/07/20/business/suppliers-data-leak-automakers.html), [Bloomberg](https://www.bloomberg.com/news/articles/2019-06-27/ford-td-bank-files-found-online-in-cloud-data-exposure), [Washington Post](https://www.washingtonpost.com/news/the-switch/wp/2017/12/22/you-may-not-know-much-about-the-companies-exposing-your-personal-information-but-they-know-a-lot-about-you), [Forbes](https://www.forbes.com/sites/lconstantin/2017/07/17/cloud-storage-error-exposes-over-two-million-dow-jones-customer-records) and [Techcrunch.](https://techcrunch.com/2019/09/18/russia-sorm-nokia-surveillance/) UpGuard can monitor your organization's and its vendor's websites for issues relating to [DNSSEC](https://www.upguard.com/blog/dnssec), [SSL](https://www.upguard.com/blog/ssl-certificate), [email spoofing](https://www.upguard.com/blog/email-spoofing), [typosquatting](https://www.upguard.com/blog/typosquatting), [man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack) and [vulnerabilities](https://www.upguard.com/blog/vulnerability). [UpGuard Breach Risk](https://www.upguard.com/product/breach-risk) can help combat typosquatting, prevent data breaches and data leaks, avoiding regulatory fines and protecting your customer's trust through cyber security ratings and continuous exposure detection.  eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)