Map your defense-in-depth layers
Tick the controls you have across 9 layers (46 controls). See which layers are covered, thin or missing, where a single failure would break everything, and the next five controls to add.
Tick the controls you have
Only tick what is actually in place and working. Key controls must all be present for a layer to count as covered.
Policies and peopleCovered · 3/5Governance, risk, training and the human element.
PhysicalCovered · 2/4Who can touch the hardware.
PerimeterThin · 4/6What faces the internet, and the first filters.
Internal networkMissing · 0/5How far an intruder can move once inside.
Endpoint and serverThin · 3/6Hardened, patched, protected hosts.
ApplicationMissing · 1/5Secure code, configuration and dependencies.
DataThin · 1/5Encryption, classification, backups: the thing being protected.
Identity and accessThin · 2/5Who is allowed in, proved each time. Cuts across every layer.
Monitoring and responseThin · 2/5Seeing what got through and acting on it. Cuts across every layer.
Your layer map
Depth 44/100- Perimeter is thin: missing no exposed rdp, smb or admin panels.
- Internal network is missing: missing network segmentation (users, servers, ot, guests).
- Endpoint and server is thin: missing no local admin rights for users.
- Application is missing: missing secrets kept out of code (vault).
- Data is thin: missing restores tested in the last year.
- Identity and access is thin: missing separate admin accounts / pam.
- Monitoring and response is thin: missing alerts watched 24/7 (soc or mdr), asset inventory kept current.
Covered = every key control and at least 60% of the layer. Missing = under 25% or no key control. PlayCISO's thresholds, not a standard.
Single points of failure
- Everyday accounts are admin accounts. Without separate admin accounts, one compromised user session carries admin rights across the estate.
- Hard shell, flat inside. The perimeter firewall is the only network barrier. Once anything gets past it (a phished laptop, a VPN flaw), the whole internal network is reachable.
- Untested last line. Backups are your final layer against ransomware, but they have not been restored recently. If they fail on the day, there is nothing behind them.
- Alarms with nobody listening. EDR raises alerts, but nobody watches them out of hours. Detection depends on one tool and office hours.
- The edge is the way in. Exposed remote services or slowly patched VPN and edge devices give a direct route past the perimeter, often without any user being phished.
- Keys that skip the layers. Secrets in code or config mean one leaked repository or log file opens production directly, bypassing network and identity layers.
Next 5 controls to add
Key controls in missing or thin layers first, and anything that closes a single point of failure.
- 1
Network segmentation (users, servers, OT, guests)
Internal network: missingCIS 12Key controlStops one compromised laptop reaching everything.
- 2
No exposed RDP, SMB or admin panels
Perimeter: thinCIS 4 / 12Key controlExposed remote services are a direct way in that skips every other perimeter filter.
- 3
Separate admin accounts / PAM
Identity and access: thinCIS 5 / 6Key controlA phished user account should not also be a domain admin.
- 4
Alerts watched 24/7 (SOC or MDR)
Monitoring and response: thinCIS 13Key controlMany intrusions run overnight and at weekends; an alert nobody reads is not a layer.
- 5
Secrets kept out of code (vault)
Application: missingCIS 16Key controlA leaked key bypasses every layer in front of the system it opens.
Layer map report
Layer status, single points of failure, next controls and what you have.
Preview the report
DEFENSE-IN-DEPTH LAYER MAP Generated 2026-10-31 with PlayCISO (playciso.com/tools/defense-in-depth-mapper) Depth score 44/100. Layers covered 2, thin 5, missing 2 (of 9). LAYERS - Policies and people: Covered (3/5 controls, 64%) - Physical: Covered (2/4 controls, 67%) - Perimeter: Thin (4/6 controls, 67%). Missing key: No exposed RDP, SMB or admin panels - Internal network: Missing (0/5 controls, 0%). Missing key: Network segmentation (users, servers, OT, guests) - Endpoint and server: Thin (3/6 controls, 56%). Missing key: No local admin rights for users - Application: Missing (1/5 controls, 21%). Missing key: Secrets kept out of code (vault) - Data: Thin (1/5 controls, 33%). Missing key: Restores tested in the last year - Identity and access: Thin (2/5 controls, 47%). Missing key: Separate admin accounts / PAM - Monitoring and response: Thin (2/5 controls, 44%). Missing key: Alerts watched 24/7 (SOC or MDR); Asset inventory kept current SINGLE POINTS OF FAILURE - Everyday accounts are admin accounts: Without separate admin accounts, one compromised user session carries admin rights across the estate. - Hard shell, flat inside: The perimeter firewall is the only network barrier. Once anything gets past it (a phished laptop, a VPN flaw), the whole internal network is reachable. - Untested last line: Backups are your final layer against ransomware, but they have not been restored recently. If they fail on the day, there is nothing behind them. - Alarms with nobody listening: EDR raises alerts, but nobody watches them out of hours. Detection depends on one tool and office hours. - The edge is the way in: Exposed remote services or slowly patched VPN and edge devices give a direct route past the perimeter, often without any user being phished. - Keys that skip the layers: Secrets in code or config mean one leaked repository or log file opens production directly, bypassing network and identity layers. NEXT 5 CONTROLS TO ADD 1. Network segmentation (users, servers, OT, guests) (Internal network, CIS 12). Stops one compromised laptop reaching everything. 2. No exposed RDP, SMB or admin panels (Perimeter, CIS 4 / 12). Exposed remote services are a direct way in that skips every other perimeter filter. 3. Separate admin accounts / PAM (Identity and access, CIS 5 / 6). A phished user account should not also be a domain admin. 4. Alerts watched 24/7 (SOC or MDR) (Monitoring and response, CIS 13). Many intrusions run overnight and at weekends; an alert nobody reads is not a layer. 5. Secrets kept out of code (vault) (Application, CIS 16). A leaked key bypasses every layer in front of the system it opens. CONTROLS IN PLACE - Security policy and named owner - Security awareness and phishing training - Incident response plan, exercised - Badge or key access to offices - Locked server / network rooms - Firewall with default-deny inbound - Email filtering plus SPF, DKIM and DMARC - VPN and edge devices patched fast - DNS / web filtering - EDR on every laptop and server - OS and app patching on a defined SLA - Full-disk encryption on laptops - Secure development and code review - Backups with an offline or immutable copy - MFA on email, remote access and cloud - Single sign-on with central off-boarding - Central log collection - Vulnerability scanning of internal and external assets Layer model after NIST (defense-in-depth), CISA defense-in-depth practice, NIST CSF 2.0 and CIS Controls v8.1. Thresholds are PlayCISO's judgement; this is a coverage map, not an audit.
Loading…
TL;DRThe short answer
5 points
- Defense in depth means several independent layers of control, so one failure (a phished password, an unpatched VPN) does not hand over everything. NIST defines it as variable barriers across multiple layers.
- Typical layers run outside-in: policies and people, physical, perimeter, internal network, endpoint, application and data, with identity and monitoring cutting across all of them.
- The common failure is not a missing product but a single point of failure: a hard perimeter with a flat network, MFA nowhere, backups that were never restored, alerts nobody watches.
- This mapper shows each layer as covered, thin or missing, names the single points of failure it finds, and ranks the next five controls by how much depth they add.
- It is a coverage map built on NIST, CISA and CIS guidance, not an audit: a ticked box only counts if the control actually works.
The nine layers and their controls
Governance, risk, training and the human element.
- Security policy and named owner (key) · CSF Govern
- Risk assessment reviewed yearly · CSF Govern / Identify
- Security awareness and phishing training (key) · CIS 14
- Third-party / vendor risk management · CIS 15
- Incident response plan, exercised (key) · CIS 17
Who can touch the hardware.
- Badge or key access to offices (key) · Physical
- Locked server / network rooms (key) · Physical
- Secure device disposal and wiping · CIS 3
- Visitor sign-in and CCTV · Physical
What faces the internet, and the first filters.
- Firewall with default-deny inbound (key) · CIS 12 / 13
- Email filtering plus SPF, DKIM and DMARC (key) · CIS 9
- No exposed RDP, SMB or admin panels (key) · CIS 4 / 12
- VPN and edge devices patched fast (key) · CIS 7
- DNS / web filtering · CIS 9
- WAF or DDoS protection for public apps · CIS 13
How far an intruder can move once inside.
- Network segmentation (users, servers, OT, guests) (key) · CIS 12
- Separate management network / jump hosts · CIS 12
- Internal (east-west) traffic filtering · CIS 13
- Network detection (IDS / NDR) · CIS 13
- Secured Wi-Fi (WPA3/802.1X, guest isolated) · CIS 12
Hardened, patched, protected hosts.
- EDR on every laptop and server (key) · CIS 10
- OS and app patching on a defined SLA (key) · CIS 7
- Hardened baseline configuration · CIS 4
- No local admin rights for users (key) · CIS 5 / 6
- Application allowlisting · CIS 2
- Full-disk encryption on laptops · CIS 3
Secure code, configuration and dependencies.
- Secure development and code review (key) · CIS 16
- Dependency and SBOM scanning · CIS 16
- Secrets kept out of code (vault) (key) · CIS 16
- Penetration testing of key apps · CIS 18
- SaaS and cloud configuration reviews · CIS 4
Encryption, classification, backups: the thing being protected.
- Backups with an offline or immutable copy (key) · CIS 11
- Restores tested in the last year (key) · CIS 11
- Data inventory and classification · CIS 3
- Encryption at rest for sensitive stores · CIS 3
- DLP or egress controls · CIS 3
Who is allowed in, proved each time. Cuts across every layer.
- MFA on email, remote access and cloud (key) · CIS 6
- Phishing-resistant MFA for admins · CIS 6
- Separate admin accounts / PAM (key) · CIS 5 / 6
- Single sign-on with central off-boarding · CIS 5 / 6
- Access reviews and least privilege · CIS 6
Seeing what got through and acting on it. Cuts across every layer.
- Central log collection (key) · CIS 8
- Alerts watched 24/7 (SOC or MDR) (key) · CIS 13
- Vulnerability scanning of internal and external assets · CIS 7
- Asset inventory kept current (key) · CIS 1 / 2
- Tabletop or purple-team exercise yearly · CIS 17 / 18
How the map works
Each layer's score is the share of its control weight you have ticked. Key controls are the ones a layer cannot do without (for example MFA for identity, offline backups for data, central logs for monitoring). Single points of failure are fixed patterns we check for, such as a perimeter firewall with no internal segmentation, EDR with nobody watching alerts, or backups never restored. The next five controls are ranked by weight, whether they are key, how weak their layer is, and whether they close a single point of failure.
For the concept and real breach examples, read defense in depth explained.
Frequently asked questions
What is defense in depth?
Defense in depth is a security strategy that layers several independent controls so an attacker has to defeat more than one to reach what matters. NIST defines it as integrating people, technology and operations capabilities to establish variable barriers across multiple layers and missions of the organization.
What are the layers of defense in depth?
There is no single official list. A common model, close to CISA's defense-in-depth recommended practice, is: policies, procedures and people; physical security; perimeter; internal network; endpoint and host; application; and data. Identity and access, and monitoring and response, cut across every layer. This mapper uses those nine.
What is an example of defense in depth?
Against ransomware: email filtering and training to stop the phish, MFA so a stolen password is not enough, EDR to catch the payload, segmentation to stop it spreading, 24/7 monitoring to see it, and offline backups so the data can be restored if everything else fails. Each layer covers for the one before it.
Is zero trust the same as defense in depth?
No, but they fit together. Zero trust (NIST SP 800-207) removes implicit trust based on network location and checks every request against identity and device. That strengthens the identity layer and replaces reliance on a single perimeter, which is exactly the "hard shell, soft centre" weakness defense in depth is meant to avoid.
How does the mapper decide a layer is covered, thin or missing?
Each control has a weight from 1 to 5, and some are marked key. A layer is covered when every key control is present and you have at least 60% of its weight; missing when you have under 25% or none of its key controls; thin otherwise. These thresholds are PlayCISO's judgement. Each control is tagged with the CIS Controls v8.1 group it falls under.
Sources
- NIST CSRC: Glossary: defense-in-depth (current page, read 31 Oct 2026). Defines defense-in-depth as an information security strategy integrating people, technology and operations capabilities to establish variable barriers across multiple layers and missions of the organization.
- CISA (DHS NCCIC / ICS-CERT): Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies (Sep 2016). Organises defense-in-depth strategies as risk management, asset inventory and risk characterization, physical security, network architectures, security architectures (perimeter and zones), host security, security monitoring, vendor management and the human element. Written for industrial control systems; the layering applies well beyond them.
- NIST: Cybersecurity Framework (CSF) 2.0 (Feb 2024). Organises outcomes into six Functions (Govern, Identify, Protect, Detect, Respond, Recover). Detection, response and recovery are layers in their own right, not afterthoughts to prevention.
- Center for Internet Security: CIS Critical Security Controls v8.1 (Jun 2024). 18 prioritised controls (for example 3 Data Protection, 4 Secure Configuration, 5 Account Management, 6 Access Control Management, 8 Audit Log Management, 10 Malware Defenses, 11 Data Recovery, 13 Network Monitoring and Defense, 14 Security Awareness). Used here to tag each control.
- NIST: SP 800-207: Zero Trust Architecture (Aug 2020). Moves defenses from the network perimeter to users, assets and resources: no implicit trust based on network location, with per-request authentication and authorisation.
- CISA: Cross-Sector Cybersecurity Performance Goals (current page, read 31 Oct 2026). A baseline set of high-impact practices (for example phishing-resistant MFA, separate user and privileged accounts, log collection, system backups, mitigating known exploited vulnerabilities) for organisations of any size.
Educational coverage map, not an audit or certification. A control only counts if it is deployed, configured and working.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.