The five-layer defense framework models cybersecurity as concentric protective layers. Each layer catches threats that bypass the previous one. Attackers only need one gap; defenders must close all five. This page breaks down each layer in detail.
Email is the #1 attack vector. L1 stops malicious emails, phishing links, and dangerous attachments before they reach users. Web security blocks access to malicious sites.
| Tier | What You Get | Cost | Setup Time |
|---|---|---|---|
| Basic | Built-in email filter + SPF/DKIM/DMARC | Free (included) | 1–2 hrs |
| Standard | + URL sandboxing + attachment detonation | $2–5/user/mo | 1 day |
| Advanced | + Domain-based message quarantine, BEC detection | $5–10/user/mo | 1 week |
L2 protects the devices where users interact with data. When a malicious email gets through (which some will), L2 is the last chance to stop the malware before it executes.
L3 assumes credentials will be compromised and limits the damage. MFA, least privilege, and SSO prevent attackers from moving laterally after they obtain a password.
L4 is about knowing when something bad is happening — fast enough to respond before damage spreads. Most SMBs lack in-house SOC capability; MDR (Managed Detection & Response) fills this gap.
| Factor | MDR | In-House SOC |
|---|---|---|
| Setup cost | $0–5K | $100K–500K |
| Ongoing cost | $6–15/user/mo | $200K–800K/yr (staff) |
| Time to value | Days | 6–18 months |
| Coverage | 24/7 always | Depends on headcount |
| Best for | SMBs, lean teams | Large orgs with security teams |
L5 is the fail-safe. When attackers bypass L1–L4, L5 determines whether you recover in hours or lose everything. Immutable, tested backups are the only reliable defense against ransomware.
Each row represents a real-world attack path. Each ✓ is a layer that catches it. Note: most attacks are caught by L1, but the sophisticated ones that matter get through — requiring all five layers.
| Attack Scenario | L1 Email | L2 Endpoint | L3 Identity | L4 Detect | L5 Recovery |
|---|---|---|---|---|---|
| Phishing → credential theft → account takeover | ✓ (blocks most) | — | ✓ (MFA blocks) | ✓ (anomaly alerts) | ✓ (audit trail) |
| Phishing → malware download → ransomware | ✓ (blocks most) | ✓ (EDR catches) | — | ✓ (behavioral alert) | ✓ (backup restore) |
| Exposed RDP → brute force → lateral movement | — | ✓ (lockout policy) | ✓ (MFA) | ✓ (failed login alerts) | ✓ (snapshot) |
| Supply chain → compromised software update | — | ✓ (allowlist) | — | ✓ (network anomaly) | ✓ (rollback) |
| Insider threat → data exfiltration | — | — | ✓ (least privilege) | ✓ (DLP alerts) | ✓ (audit logs) |