The cybersecurity stack: a field guide for IT leaders

how to think about the stack

The hardest part of security for a non-specialist is that the field has no obvious shape, so it feels like an endless list of products with three-letter names. The way to make it hold still is to look at it through two simple lenses at once.

The first lens is what you are protecting. Security tools cluster around territories, and there are only a handful: your identities, your devices, your network, your data, your applications, your cloud, and your people. Almost every product on the market is defending one of these. Once you see the territories, the product names stop being a random list.

The second lens is whether each territory is actually covered. It is not enough to own a tool in a territory; you have to know what that tool does and does not do. The cleanest way to check completeness is the NIST Cybersecurity Framework, which sorts everything into six functions: Govern (deciding your risk approach and who owns what), Identify (knowing what you have), Protect (preventing bad things), Detect (noticing when prevention fails), Respond (acting on what you detect), and Recover (getting back to normal afterward). You can have a territory that is well protected and completely undetected, which is a common and dangerous gap.

Put the two lenses together and you get a grid: your territories down one side, the six functions across the top. A complete stack has something real in most cells. A typical mid-market stack has a few cells heavily over-served, a few empty, and nobody who has ever looked at it this way. One more idea worth holding: defense in depth. No single control stops everything, so security works in layers, on the assumption that any one of them can fail. A stack is strong when its layers overlap and weak where one territory is left to a single control with nothing behind it.

the territories, walked one by one

identity and access

Who can reach what, and how they prove they are who they claim to be. This is the territory that matters most, because the network perimeter has dissolved and identity is now the main thing standing between an attacker and your systems. The categories: an identity provider (IdP) with single sign-on (SSO) is the directory and login layer. Multi-factor authentication (MFA) adds a second proof. Privileged access management (PAM) controls admin accounts. Identity governance (IGA) handles who gets access and who loses it. Identity threat detection and response (ITDR) watches for identity attacks. Non-human identity covers the service accounts, API keys, and AI agents that now outnumber your people. And zero trust network access (ZTNA) grants access per-app based on identity. When you need it: always, and first. Even the smallest company needs an IdP it uses fully, MFA everywhere, and clean offboarding. The heavier pieces scale in as you grow.

endpoints and devices

The laptops, phones, and servers your people work on. The categories: antivirus and endpoint protection (EPP) block known malware. Endpoint detection and response (EDR) watches device behavior for attacks and lets you respond, and extended detection and response (XDR) stretches that across devices and identity. Mobile device management (MDM) or unified endpoint management (UEM) configures, secures, and wipes devices. Plus disk encryption and patching. When you need it: EDR or at least solid endpoint protection is essential for almost everyone, and device management matters the moment you have more than a handful of laptops.

network

The connections between your systems and the outside world. The categories: a firewall, and its modern form the next-generation firewall (NGFW), controls traffic. ZTNA replaces the old VPN for remote access. A secure web gateway (SWG) filters web traffic, and DNS security blocks malicious domains. Intrusion detection and prevention (IDS and IPS) watch traffic for attacks. Bundled from the cloud, these become SSE, and with networking added, SASE. When you need it: a firewall is a given. The bigger move for most companies now is replacing the VPN with ZTNA, because a flat VPN that drops users onto the network is both a daily irritation and a favorite ransomware path.

email and the human layer

Email is still the front door for most attacks, and your people are the ones who open it. The categories: a secure email gateway (SEG) or modern email security filters out phishing, malware, and business email compromise. Security awareness training and simulated phishing teach people to spot what gets through. Increasingly relevant, defenses against deepfake and AI-assisted social engineering. When you need it: email security is essential for everyone. Awareness training is high-value and cheap, though it works as a supplement to technical controls rather than a replacement. Treat the human layer as something to support, not something to blame.

data

The thing you are ultimately protecting. The categories: data classification identifies and labels what is sensitive, the foundation everything else rests on. Data loss prevention (DLP) stops sensitive data leaving through email, the browser, AI tools, and other channels. Data security posture management (DSPM) finds where sensitive data is exposed across your cloud and SaaS. Encryption protects data at rest and in transit. And backup keeps a recoverable copy, your last line of defense against ransomware. When you need it: classification and backup are for everyone, and untested backup is one of the most common and dangerous gaps there is.

applications

The software you build or run. The categories: application security (AppSec) broadly, with SAST and DAST testing code for flaws, a web application firewall (WAF) filtering attacks against web apps, API security, secrets management so credentials are not sitting in code, and a software bill of materials (SBOM). When you need it: if you build software, this territory is core. If you only buy and run software, it shrinks to keeping things patched and choosing vendors carefully.

saas

The dozens or hundreds of cloud applications your teams actually run, most of which IT never formally approved. The categories: SaaS management discovers your apps and controls spend. SaaS security posture management (SSPM) finds risky settings and connected-app risk. CASB brokers and controls cloud-app access. And the OAuth grants and app-to-app integrations that quietly hand third parties standing access. When you need it: the moment your company runs more SaaS than IT can name, which is almost immediately.

cloud infrastructure

If you run workloads in AWS, Azure, or Google Cloud, this is the security of that infrastructure. The categories: cloud security posture management (CSPM) finds misconfigurations. Cloud workload protection (CWPP) secures running workloads. CIEM manages who and what has entitlements in the cloud. Bundled together these become a CNAPP. When you need it: as soon as you run meaningful infrastructure in a public cloud. A misconfigured cloud storage bucket is one of the most common causes of a data exposure.

ai

The newest territory, and the one moving fastest. It splits into two jobs. AI security controls AI as a data-egress and attack surface. AI governance is the oversight and compliance side, knowing what AI you use and meeting obligations like the EU AI Act. Both rest on an AI inventory: knowing what AI is actually in use. When you need it: now, because your team is already using AI whether or not you have governed it. The first step is small and free, knowing what is in use.

the cross-cutting layers

Detection and response. Owning protective tools is not the same as watching for attacks. A SIEM collects and correlates logs, a SOC is the team that watches, MDR is that watching bought as a managed service, and SOAR automates the response. The common gap is enormous: companies buy detection tools and have nobody to act on what they find. If you have no team watching, managed detection is usually the honest answer.

Governance and risk. The deciding layer. GRC tooling tracks governance, risk, and compliance. Frameworks like the NIST Cybersecurity Framework, ISO 27001, or CIS Controls give you a structure to work against. This is where you decide what matters and who owns it.

Resilience and recovery. What happens after something goes wrong. Backup and disaster recovery, an incident response plan, and business continuity planning. The recurring failure is a backup that was never tested and turns out not to restore, discovered at the worst possible moment.

what you actually need, by size and situation

The fastest way to waste money on security is to buy an enterprise stack for a mid-market company, and the fastest way to get breached is to leave a basic territory uncovered. The right answer moves with your size, your sector, and what you do.

• Identity, MFA, SSO · Lean / small (under ~50): Essential · Growing mid-market (50 to 500): Essential · Larger / multi-entity (500 to 2000): Essential · Enterprise / regulated: Essential
• Endpoint protection / EDR · Lean / small (under ~50): Essential · Growing mid-market (50 to 500): Essential · Larger / multi-entity (500 to 2000): Essential · Enterprise / regulated: Essential
• Email security · Lean / small (under ~50): Essential · Growing mid-market (50 to 500): Essential · Larger / multi-entity (500 to 2000): Essential · Enterprise / regulated: Essential
• Backup, tested · Lean / small (under ~50): Essential · Growing mid-market (50 to 500): Essential · Larger / multi-entity (500 to 2000): Essential · Enterprise / regulated: Essential
• Security awareness · Lean / small (under ~50): Essential · Growing mid-market (50 to 500): Essential · Larger / multi-entity (500 to 2000): Essential · Enterprise / regulated: Essential
• SaaS and AI visibility · Lean / small (under ~50): Start now · Growing mid-market (50 to 500): Essential · Larger / multi-entity (500 to 2000): Essential · Enterprise / regulated: Essential
• Firewall / ZTNA · Lean / small (under ~50): Basic · Growing mid-market (50 to 500): ZTNA replacing VPN · Larger / multi-entity (500 to 2000): SSE · Enterprise / regulated: SASE
• Cloud posture (CSPM) · Lean / small (under ~50): If cloud-native · Growing mid-market (50 to 500): If cloud-native · Larger / multi-entity (500 to 2000): Essential · Enterprise / regulated: Essential
• PAM · Lean / small (under ~50): Basic hygiene · Growing mid-market (50 to 500): Right-sized · Larger / multi-entity (500 to 2000): Full · Enterprise / regulated: Full
• Access governance (IGA) · Lean / small (under ~50): Process + IdP · Growing mid-market (50 to 500): Process + IdP · Larger / multi-entity (500 to 2000): Platform · Enterprise / regulated: Full
• DLP · Lean / small (under ~50): Built-in · Growing mid-market (50 to 500): Built-in plus AI channel · Larger / multi-entity (500 to 2000): Broader · Enterprise / regulated: Full program
• Detection and response · Lean / small (under ~50): Managed (MDR) · Growing mid-market (50 to 500): Managed or hybrid · Larger / multi-entity (500 to 2000): SOC plus tooling · Enterprise / regulated: 24/7 SOC
• ITDR · Lean / small (under ~50): IdP built-in · Growing mid-market (50 to 500): XDR or managed · Larger / multi-entity (500 to 2000): Dedicated · Enterprise / regulated: Full
• GRC tooling · Lean / small (under ~50): Spreadsheet · Growing mid-market (50 to 500): Spreadsheet or light · Larger / multi-entity (500 to 2000): Platform · Enterprise / regulated: Platform

The top five rows are essential for literally everyone, and a company with only those, done properly, is in better shape than one with a dozen tools and a gap in the basics. Most of the heavier tooling is about scaling and evidence rather than fundamental protection. And the thing most often missing across every size is not a protective tool but the detection-and-response layer, which is why it appears as "managed" so often. Your sector shifts the priorities too: a software house weights application security; a financial entity under DORA weights resilience, access controls, and evidence; a healthcare provider weights data protection and access to patient systems; a professional services firm weights email security and client-data protection. The territories are the same; the order changes.

how to map your own stack

Reading about the stack is useful. Mapping yours is what actually changes anything, and it takes an afternoon. Draw the grid: down the side, the territories that apply to you; across the top, the six functions. Now fill it in honestly, cell by cell. For identity: do you Govern it (a policy, an owner), Identify it (do you know every account and what it can reach), Protect it (MFA, least privilege), Detect attacks on it, Respond (can you disable a compromised account fast), Recover (can you restore access cleanly). Mark each cell covered, partial, or empty. Be ruthless, because a comfortable map is a useless one.

Then read the pattern. The empty cells are missing capability, and the ones that hurt most are usually in Detect and Respond, where companies own protective tools but have no watching, and in Identify, where they are protecting things they cannot fully see. The orphaned territories are the ones with no owner at all, often SaaS, AI, and non-human identity, because they grew faster than anyone's job description. Then prioritize by impact, not by which gap is easiest to close. Pick the few gaps that would hurt most, and close those first. That short, ranked list is your security plan, built from a clear picture rather than a vendor's pitch.

the gaps seen most often

Across mid-market companies, the same holes recur, and none of them are exotic. Identity is under-covered relative to how much it matters, with MFA that is switched on but not everywhere, offboarding that is manual and leaky, and privileged access that is standing and unwatched. Detection and response is missing entirely, with protective tools generating alerts into a void. SaaS and AI are invisible, two whole territories that grew up outside anyone's remit. Backup exists on paper but was never tested, so the recovery plan meets reality for the first time during an actual incident. And governance is absent, so there is no clear owner for security as a whole and decisions get made tool by tool rather than against a plan. The thread through all of them is visibility. You cannot govern, protect, or watch a territory you cannot see, and the territories that hurt companies are almost always the ones nobody was looking at.