Is “Defense in Depth” still defensible?
Q: Isn’t layering tools supposed to keep attackers out?
That’s the theory. But in his recent Security Boulevard article, Stairwell founder Mike Wiacek makes a bold claim: defense in depth is broken.
“It looks like a wall of security from the inside. But from an attacker’s point of view, they see gaps everywhere.”
Q: What’s wrong with the current approach?
Too often, security stacks are a patchwork of disconnected tools that satisfy compliance but don’t actually reinforce one another. Think of a Jenga tower, it looks solid until you rotate it. That’s how most security programs look to attackers.
Q: What about compliance? Isn’t that the baseline?
Yes, but it’s only the baseline. Compliance tells you that you’ve met minimum standards. Attackers don’t care if you passed an audit, they care if your EDR can be reverse-engineered or if your logs miss crucial context.
Q: So what’s the better approach?
Wiacek outlines a shift in mindset:
- Collect and analyze files, scripts, and executables — not just logs.
- Treat AI as a force multiplier, not a cure-all.
- Build systems assuming layers will fail, and make sure they catch what others miss.
Q: TL;DR?
You can’t secure what you can’t see. And you can’t defend what you only detect too late.
