The defender's wager
An attacker has to succeed at every kill-chain phase. A defender only has to stop them at one. The point of defense-in-depth is to make every phase be defended by at least one control, so that any single bypass doesn't lose the game.
The eight controls below are not optional. They are the table stakes for any organization that handles money, data, or anyone's safety. The trade-offs they each carry are real; the cost of skipping them is realer.
The eight controls
EDR / XDR
Application Allowlisting
update.exe in %APPDATA% and tries to run it, nothing happens.Network Segmentation
Immutable Backups (3-2-1-1-0)
Least Privilege
Patch Cadence
Phishing-Resistant MFA Everywhere
Security Awareness
The matrix — which control breaks which phase?
Read across to see which kill-chain phases each control disrupts. The pattern matters: no single control covers everything, but no phase is uncovered. That's the right shape for a defensive stack.
| Control | Recon | Delivery | Exploit | Install | C2 | Discovery | Lateral | Impact | Recovery |
|---|---|---|---|---|---|---|---|---|---|
| EDR / XDR | · | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · |
| Allowlisting | · | ~ | ✓ | ✓ | ~ | · | ✓ | ~ | · |
| Segmentation | · | · | · | · | ~ | ✓ | ✓ | ✓ | · |
| Immutable Backups | · | · | · | · | · | · | · | ✓ | ✓ |
| Least Privilege | · | · | ✓ | ~ | · | ~ | ✓ | ~ | · |
| Patch Cadence | · | ~ | ✓ | · | · | · | ✓ | · | · |
| Phishing-Resistant MFA | · | ✓ | ~ | · | · | · | ✓ | · | · |
| Security Awareness | ~ | ✓ | ~ | · | · | · | · | · | · |
Legend: ✓ = strongly disrupts · ~ = partially disrupts · · = doesn't help
Every column has at least one ✓. That's the goal. There is no defensive control that catches everything, but there is no single phase that has zero defenders. An attacker who phishes successfully gets caught by EDR; an attacker who bypasses EDR is constrained by least privilege; an attacker who escalates is contained by segmentation; an attacker who deploys ransomware can't destroy your backups.
The order to deploy them in
If you're starting from zero, the order matters. Some of these controls are prerequisites for others to be effective; some are quick wins that buy time for the rest.
- Backups first. Until backups exist and are tested, you have no recovery option. Everything else only matters if you would survive a failure.
- Phishing-resistant MFA on admin accounts second. Highest-leverage single change — closes most affiliate access paths.
- EDR everywhere third. The detection foundation that makes every other control observable.
- Patch cadence and segmentation in parallel. Both take time; both need executive sponsorship.
- Least privilege as ongoing work. Never finished; always improving.
- Allowlisting after least privilege is mature. Disruptive to deploy; needs a stable application baseline.
- Security awareness as continuous reinforcement. Not a one-time training; a culture.
What this all costs
The unsubtle answer: a lot. EDR licensing alone is $5-$20 per endpoint per month for enterprise tiers. Immutable backup storage is double-or-triple the storage cost. Hardware FIDO keys are $20-$70 per user. Network segmentation projects run six figures for a mid-sized enterprise.
The unsubtle answer to the unsubtle answer: a successful ransomware incident at a 1,000-employee company averages $2-$10M in direct costs (ransom, IR, downtime) plus regulatory fines and reputation damage. Cyber insurance carriers have stopped underwriting organizations that lack the basics — especially MFA and immutable backups — because the actuarial math no longer works for them.
The choice isn't "spend on defense or don't." It's "spend on defense, or spend the same amount on incident response with worse outcomes."