What is defence in depth?

Defence in depth means using several different protections so that if one fails, another still stands in the way. The ICO uses this exact phrase when explaining that encryption should sit alongside other measures. The American spelling is defense in depth. The idea is the same. ¹²³

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

One control is chosen, such as a firewall, updates, or MFA. ²¹
Further controls are added, so that an attacker would have to get through more than one layer. The NCSC describes this as a layered approach. ²³
The layers can include technical measures, processes, and people knowing how to spot a scam. No set stack is mandatory, and no product bundle is required. ³²

How it can look

The ICO uses defence in depth when it explains that encryption should sit alongside other measures. The NCSC's architecture guidance says the same idea in other words. Adopt a layered approach so that an attacker would have to get through multiple controls. NCSC phishing guidance also argues for a multi-layered approach, covering technical measures, process and people. ¹²³

Warning signs

A single control, such as a firewall or encryption, is treated as the whole defence. ¹²
A seller offers a product bundle as if layers were a package you must buy. ²
Staff have no way to report or check a suspicious message, so the people layer is missing. ³

What to do now

Use more than one kind of protection: updates, a firewall, MFA or passkeys, careful access, and backups are ordinary examples. ²¹
Include a simple process for checking unusual requests, and for reporting suspicious messages. ³
Review the layers when you add a new system or a new supplier, rather than assuming one tool covers everything. ²

UK reporting and support

For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud (opens in a new tab). In Scotland, call Police Scotland on 101. ⁴⁶⁷
For a live cyber attack in England, Wales or Northern Ireland, use Report Fraud (opens in a new tab). Telephone support is also available on 0300 123 2040. ⁵
If someone is in danger, call 999. ⁶⁷

How to protect yourself

Keep several ordinary layers in place, rather than relying on one tool. ²¹
Combine technical measures with a simple process and with people who know how to pause and check. ³
Treat encryption, firewalls, updates and MFA as parts of the same approach, not as rivals. ¹²

Frequently asked questions

What does defence in depth mean for a small shop that only has a laptop and a payment tablet?

It means using several ordinary protections, such as updates, a firewall, MFA or passkeys, careful access, backups, and a habit of checking unusual requests. It does not mean buying a particular product bundle, and it does not make an attack impossible. ²³¹

Is defence in depth a product I can buy?

No. It is a way of combining different protections. The ICO and the NCSC describe the idea. They do not require a particular product bundle. ¹²

Why does the ICO mention defence in depth in encryption guidance?

Because the ICO explains that encryption should sit alongside other measures, rather than being used on its own. ¹

Matching kit

First Hour After a Breach · £29 · Digital download.

An incident-response planning kit for UK small businesses. It is not a live incident-response or legal service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

ICO, Encryption and data protection | ICO (opens in a new tab). Accessed 10 November 2026 (Europe/London).
NCSC, 10 Steps: Architecture and configuration | National Cyber Security Centre (opens in a new tab). Accessed 10 November 2026 (Europe/London).
NCSC, Phishing attacks: defending your organisation | National Cyber Security Centre (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Report Fraud, Report Fraud (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Report Fraud, Guide to reporting cyber crime and fraud - Report Fraud (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Police Scotland, How to report a crime - Police Scotland (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud (opens in a new tab). Accessed 10 November 2026 (Europe/London).