Defence in Depth: Why One Security Product Is Never Enough

There is a question that comes up in almost every security conversation: “We already have antivirus, so are we covered?” It is a fair question, and the honest answer is no. Not because antivirus is bad, but because no single control has ever been able to catch everything, and modern attacks are specifically built to walk around whichever one you happen to own.

That is the whole idea behind defence in depth. You do not rely on one wall. You build several, each one covering the gaps in the others, so that an attacker has to defeat all of them rather than just one.

Follow a real attack and the reason becomes obvious

Here is how a typical incident unfolds, and where each layer gets a chance to stop it:

1. A convincing email arrives. It looks like a supplier, or a colleague, or a Microsoft notification. Email security should remove it before anyone sees it.
2. Someone clicks and enters their password. The login page is a copy of the real one. Multi factor authentication makes the stolen password insufficient on its own.
3. The attacker signs in from somewhere else. Now they are inside a real mailbox, reading real conversations. Identity monitoring should flag a sign in from an unusual location or an impossible journey.
4. Malware lands on a machine. An attachment or download runs. Endpoint protection should detect the behaviour and isolate the device.
5. They move sideways across the network. Looking for file shares, servers and backups. Network security and segmentation should limit how far one compromised machine can reach.
6. Data is stolen or encrypted. Backups, tested and kept out of reach, decide whether this is a bad week or an existential one.

Notice that every step had a control that could have ended it. An organization with only one of these layers is relying on that layer being perfect, every single time. None of them are.

What each layer is actually for

Email security

Email is the one system that must accept messages from strangers, which makes it the most common way in. Filtering ahead of the mailbox, attachment sandboxing and link checking remove the overwhelming majority of malicious mail before a person has to make a judgement call about it.

Multi factor authentication

If you do only one thing from this article, do this one. MFA means a stolen password is not enough by itself, which defeats the single most common attack in circulation. Turn it on for everyone rather than just executives, and prefer app prompts or hardware keys over SMS codes where you can.

Endpoint security

Traditional antivirus recognises known bad files. Modern endpoint protection watches behaviour, so it can act on something it has never seen before, and it gives you a central view of which machines are affected. That visibility matters as much as the blocking does, because you cannot clean up what you cannot see.

Network security

A properly configured firewall inspects what enters and leaves, and segmentation limits how far an attacker can travel once inside. A flat network where every device can reach every other device turns one compromised laptop into a whole estate.

Patching and supported software

The least glamorous layer and one of the most effective. A large share of successful intrusions use a vulnerability that had a fix available. This includes keeping devices on editions of the operating system that can actually be managed centrally.

Backup and recovery

Assume one day everything above fails. Backups that are tested, retained sensibly and kept where ransomware cannot reach them are what turns a catastrophe into an inconvenience. An untested backup is a hope, not a control.

Your people

Staff are a layer too, and a good one when supported properly. Regular, realistic phishing simulations and a culture where reporting a mistake quickly is welcomed will catch what technology misses.

Where to start if you cannot do everything at once

Most organizations cannot deploy all of this in one go, and they do not need to. A sensible order:

1. MFA everywhere. Highest impact, lowest cost.
2. Email filtering. Removes most of what would otherwise reach your staff.
3. Managed endpoint protection. Visibility and containment across every device.
4. Tested backups. Confirm you can actually restore, not just that the job ran.
5. Firewall and segmentation review. Limit how far any single compromise travels.
6. Awareness training. Ongoing, not annual.

The point of layering

Defence in depth is not about buying more products. It is about accepting that each control will occasionally fail, and arranging things so that a failure is contained rather than catastrophic. The goal is not a system that never gets attacked. It is a system where one mistake, by one person, on one afternoon, does not become the whole company’s problem.

If you are not sure which of these layers you currently have, or whether the ones you own are actually switched on and working, that is a reasonable place to begin. We are happy to take a look and tell you plainly what is missing.