The Defensive Controls Guide

Research date: September 14–15, 2026. A practical hierarchy of defensive controls, ordered by evidence of effectiveness rather than by vendor category. Educational material; defensive scope only.

1. The organizing principle: controls in order of what the evidence supports

Most security guidance presents controls as a flat catalog. That is useful for auditors and useless for anyone deciding what to do first with limited money. This guide orders controls by the strength of the evidence that they reduce loss, drawn from breach datasets (Verizon DBIR 2026, Mandiant M-Trends 2026), insurer claims analytics (Marsh), and incident casework (Coveware, CISA advisories).

Tier 0 — the controls that appear in nearly every post-mortem when missing. Phishing-resistant MFA on email, remote access, and administrative accounts. Tested, immutable, offline backups. Fast patching of internet-facing and KEV-listed vulnerabilities. Endpoint detection with someone actually watching it. Asset and account inventory, including SaaS and edge devices.

Tier 1 — the controls that contain the blast radius once Tier 0 fails. Least privilege and removal of standing administrative access. Network segmentation, including the identity, backup, and virtualization planes as Tier 0 assets. Centralized logging with meaningful retention. A drilled incident-response plan with out-of-band contacts.

Tier 2 — the controls that shorten detection and improve decision quality. Detection engineering mapped to ATT&CK. Threat hunting. Identity threat detection and response. Third-party and OAuth-integration governance. Security awareness tuned to vishing and deepfakes rather than generic phishing.

Tier 3 — the controls that only pay off at maturity. Threat intelligence platforms, deception technology, red teaming, breach-and-attack simulation, full Zero Trust architecture. Buying these while Tier 0 is incomplete is the single most common budget mistake in the field.

That sequencing is the spine of everything below, and it is also the spine of the maturity model in 13-risks-and-pitfalls.md.

2. Identity controls

Identity is where the majority of significant 2023–26 incidents began or turned. The controls, in order:

Phishing-resistant MFA. FIDO2/WebAuthn passkeys and PIV or smart cards are the only widely deployed factors that resist attacker-in-the-middle proxy phishing. Authenticator apps with number matching are a meaningful step up from SMS; SMS and voice one-time codes should be treated as a legacy fallback, not a control. Microsoft has repeatedly measured MFA blocking around 99% of account-compromise attacks — but that telemetry predates the AiTM kit economy, so the site should present it as evidence that MFA matters while being clear that which MFA matters more now than it did in 2019. Deploy to administrators and high-risk applications first. Buy two hardware keys per user so that losing one is not an outage.

Conditional access with device trust. Access decisions should factor device compliance, location risk, and session risk, not just a successful login. Blocking legacy authentication protocols is usually the single highest-value conditional-access policy.

Hardened help-desk verification. This is a procedural control that defeats the most successful social-engineering pattern of 2024–26. Requirements: callback to a number of record, identity proofing beyond caller-supplied information, no MFA resets on a single unverified call, a separate escalation path for privileged accounts, and logging of every reset. Products exist in this space (Nametag, Persona and similar), but the policy is the control.

Privileged access management and just-in-time elevation. No standing domain admin. Vaulted credentials, session recording, time-bound elevation. Microsoft's cloud-permissions research found fewer than 5% of granted cloud permissions are actually used — the gap between granted and used privilege is the attacker's working capital.

Identity threat detection and response. Alert on impossible travel, token anomalies, new MFA method registration, new device enrollment, and changes to federation or conditional-access configuration. Attackers who reach the identity plane add their own identity provider; that change is detectable and almost never legitimate without a change ticket.

Lifecycle automation. SCIM-driven provisioning and deprovisioning kills the orphaned-account problem that no quarterly access review ever fully catches.

Non-human identity management. Service accounts, API keys, workload identities, and now AI agent credentials. The goal is short-lived, scoped, auditable, revocable credentials via workload identity federation rather than long-lived static keys. This is the fastest-growing gap in most estates.

3. Endpoint and server controls

EDR with monitoring. The product matters less than whether a human or a service investigates its alerts. An unwatched EDR console is a compliance artifact. For organizations without 24/7 staff, managed detection and response is the control, not the tool.

Patch management with a risk-based SLA. Thirty-day patch SLAs for internet-facing systems are obsolete: VulnCheck found 28.3% of newly catalogued exploited vulnerabilities showed exploitation within one day of CVE publication in Q1 2025. Practical SLAs: KEV-listed and internet-facing within 24–72 hours, critical internal within 7 days, everything else on a monthly cycle. When the SLA cannot be met, the compensating control — segmentation, virtual patching, taking the service off the internet — is the response, not an exception ticket.

Hardening baselines. CIS Benchmarks and Microsoft security baselines, applied through golden images and configuration management rather than by hand. Drift detection matters as much as initial configuration.

Least privilege on endpoints. No daily-driver local administrator accounts. Application allow-listing where the environment tolerates it — it is the single most effective malware control and the single hardest to operate.

Full-disk encryption. Cheap, built in, and the basis of the breach-notification "encryption safe harbor" in most US state laws. The operational requirement is proof of encryption status at the time of loss, which means MDM attestation, not an assumption.

Tier 0 isolation. Treat identity infrastructure, backup infrastructure, and hypervisor management planes as the crown jewels they are: separate administrative accounts, separate workstations, no shared credentials with the general environment, and no internet exposure of management interfaces.

4. Network controls

Reduce the attack surface first. External attack surface management, then removal of unnecessary internet-exposed services. Every 2024–26 edge-device exploitation wave — Ivanti, Fortinet, Citrix, Palo Alto, Check Point, Cisco — hit services that were exposed because nobody asked whether they needed to be.

Segmentation and microsegmentation. The goal is not perfection but blast-radius reduction: IoT and OT on separate VLANs with no lateral access; backup networks isolated; administrative networks separate; cloud accounts and projects as boundaries.

ZTNA replacing always-on VPN. VPN concentrators are both a persistent vulnerability class and an implicit-trust architecture. Zero-trust network access grants per-application rather than per-network access.

Egress filtering and DNS security. Protective DNS and egress controls catch command-and-control and data staging that inbound controls miss, and they are among the few controls that still work when an endpoint is compromised.

Network detection and monitoring. Zeek for metadata, Suricata for signature and anomaly detection, Wireshark for analysis. Encryption limits payload inspection, so the value now is metadata, DNS, and east-west visibility. Budget sensor hardware and an analyst, or do not deploy it.

DDoS mitigation contracted in advance. Procurement during an attack is slow and expensive. Protect origin IPs, because attackers bypass CDNs by finding them.

5. Data and application controls

Data classification, then everything else. DLP is roughly 20% tool and 80% classification program; expect high false positives for the first six to twelve months. Data security posture management (DSPM) has grown specifically because AI projects copy sensitive data into places nobody inventoried.

Encryption at rest with real key management. Transparent database encryption, object and file encryption, and field-level encryption for the most sensitive data, with keys in a KMS or HSM, rotated, and separated from the data they protect. Only about 37% of breached organizations encrypt sensitive data comprehensively.

Secure development. NIST SSDF (SP 800-218) as the backbone. Threat modeling at design time is the cheapest place to fix anything. SAST, SCA, and secret scanning as pull-request gates — with false-positive rates measured on your own code during a pilot, because false positives decide adoption. Signed commits and artifact provenance through Sigstore and SLSA. Isolated ephemeral build runners with OIDC-federated short-lived credentials rather than long-lived deploy keys. Mandatory human review of AI-generated code.

Dependency hygiene. Lockfiles and pinned versions; cooldown periods before adopting brand-new releases (the direct counter to the npm worm pattern); private registry proxies with quarantine; provenance verification; SBOMs per release and consumption of vendors' SBOMs.

Web and API controls. Centralized authentication and authorization at a gateway plus per-endpoint object-level authorization checks — the gateway alone does not prevent broken object-level authorization, which remains the top API risk. Schema validation from OpenAPI definitions, rate limiting, bot management, short-lived tokens, mTLS between services. For e-commerce, PCI DSS 4.0's payment-page script integrity and change-detection requirements (6.4.3, 11.6.1) have been mandatory since March 2025 and directly address client-side skimming.

6. Email and human-layer controls

DMARC at p=reject, with SPF and DKIM. Bulk-sender mandates from Google, Yahoo, and Microsoft made this near-universal for senders between 2024 and 2025. It is free, it is the highest-ROI email control, and it prevents your domain being used against your own customers.

Modern email security. A secure email gateway or, increasingly, an API-based integrated cloud email security product that applies behavioral analysis to the mailbox rather than filtering at the perimeter. Configure the platform you already own — Safe Links, Safe Attachments, anti-phishing policies — before buying an addition.

Out-of-band verification for payment and bank-detail changes. This is the control that defeats both BEC and deepfake fraud, and it costs nothing but process discipline. Callback to a number of record, never a number supplied in the request. Dual approval for wires above a threshold. Code words for executive requests. Brief the finance team specifically, because generic awareness training does not reach the person who actually processes the wire.

A reporting button with a fast response. The measure of an awareness program is not click rate but report rate and time-to-report. Punishing people who click destroys reporting, which destroys detection.

Awareness content tuned to 2026. Vishing and help-desk impersonation, deepfake video and voice, QR-code phishing, malicious OAuth consent prompts, and MFA fatigue — not just "look for spelling mistakes," which AI-generated lures no longer contain.

7. Backup, recovery, and resilience controls

3-2-1-1-0. Three copies, two media types, one offsite, one immutable or air-gapped, zero errors on a tested restore. Sophos found only 54% of ransomware victims restored from backups in 2025 — a six-year low — because attackers now hunt backups first.

Immutability specifically. Object lock, hardened repositories, or genuinely offline copies. Backups reachable with production credentials are not backups from a ransomware perspective.

Tested restores, timed. A backup job that succeeds nightly and has never been restored is the most common finding in ransomware post-mortems. Test at scale, against the RTO you have committed to, and document the result.

Identity-out recovery planning. Modern ransomware compromises Active Directory or Entra. The rebuild order — identity, then backups, then core applications — must be documented in advance, because deriving it during an incident wastes days.

Manual-operations fallback. For manufacturing, healthcare, utilities, and logistics: can you run without the network? Clinicians on paper charts, plant operators on manual control, dispatch on radio. This is a drill, not a document.

8. Cloud and SaaS controls

Identity-first. SSO with phishing-resistant MFA on every console; short-lived credentials and workload identity federation instead of static keys; least-privilege IAM validated with access analyzers; org-wide guardrails such as service control policies.

Continuous posture management. CSPM or CNAPP to catch misconfiguration continuously rather than at audit time. Gartner's projection that essentially all cloud security failures through 2025 would be the customer's fault has aged well; misconfiguration remains the top cloud failure mode.

Audit logging enabled and retained. Cloud provider default retention is frequently too short to reconstruct an incident. This is a configuration decision made before the incident or not at all.

OAuth and integration governance. Quarterly review of connected third-party applications; blocking unverified publishers; scope minimization; token expiry. The Salesloft Drift incident turned this from hygiene into a headline control.

SaaS security posture management. Continuous checking of tenant configuration — sharing settings, admin roles, legacy authentication — across the SaaS estate.

9. OT and industrial controls

Asset inventory comes first, because unknown PLCs cannot be protected. Then segmentation per ISA/IEC 62443 zones and conduits with Purdue-model DMZs. Then removing OT from the public internet, which remains the single most consequential finding in water-sector advisories. Then secure remote access with MFA and session recording, replacing shared always-on vendor VPNs. Then OT-aware passive monitoring, engineering-workstation hardening, strict change control, and safety-instrumented-system isolation.

CISA's CPG 2.0, released December 11, 2025, merged IT and OT goals and added cost, impact, and ease ratings specifically so resource-poor operators can sequence work. For a small water utility or a single-plant manufacturer, the CPGs are the most defensible starting point available.

10. Governance controls

Asset and account inventory. CIS Control 1 and 2 for a reason. Includes SaaS applications, edge appliances, cloud accounts, and non-human identities. You cannot patch, monitor, or decommission what you have not enumerated.

A risk register that drives budget. Not a heat map exercise. FAIR-style quantification for ranking and insurance sizing, with honest uncertainty ranges rather than false precision.

Third-party risk management tiered by criticality. Deep due diligence for the handful of vendors that could stop your business; contractual security and notification terms with SLAs; least-privilege time-bound vendor access; documented exit plans for critical vendors.

A drilled incident-response plan. One page is enough for a small business, provided it names a decision-maker, a technical lead, and a communicator, and lists out-of-band contacts including the insurer's hotline and counsel. Tabletop annually for executives, twice yearly for technical teams. CISA's free Tabletop Exercise Packages remove the excuse of not having scenarios.

Metrics that survive scrutiny. Mean time to detect and respond, paired with quality metrics — reopen rate, false-negative review, detection coverage against ATT&CK — because speed metrics alone are gameable.

11. Control mapping to the two citable floors

CIS Implementation Group 1 comprises 56 safeguards defined as "essential cyber hygiene" and is the defensible minimum for any organization. The CPGs are organized around CSF 2.0's six functions and carry cost, impact, and ease ratings that make them the better sequencing tool for resource-constrained organizations.

12. What good looks like at each budget level

Free to $300 a year (individual). Unique passwords in a manager, MFA on email and banking first, automatic updates, device encryption, credit freezes, a tested backup. The highest-value controls for individuals are free.

Under $30,000 a year (small business). Microsoft 365 Business Premium or Google Workspace equivalent (which bundles endpoint, identity, and device management), a password manager, managed EDR or MDR, tested backups, DMARC at enforcement, phishing training, cyber insurance, and an annual external vulnerability assessment. No SIEM, no penetration test, no compliance platform unless a customer demands it.

$250,000–$500,000 a year (50-person startup). The above plus one security engineer, MDR to offload 24/7 detection, SOC 2 Type II if customers require it, an annual application and cloud penetration test, and cloud security posture management. Roughly half the budget is one salary — which is the central fact of security economics at every size.

$1.5M–$3.5M a year (500-person company). A team of four to seven, managed SOC, a real tooling stack, penetration testing with some purple teaming, compliance program, insurance, and an IR retainer.

$20M+ (regulated enterprise). A security organization of 50 to 150, hybrid 24/7 SOC, threat intelligence, red team, enterprise tooling, and a compliance function spanning multiple regimes.

Full line-item budgets with assumptions are in 10-cybersecurity-economics.md.

13. The uncomfortable truths to state plainly

Controls fail for operational reasons far more often than for technical ones. The recurring patterns in post-mortems are: EDR deployed but not covering the compromised host; backups present but never restore-tested; MFA enabled but not on the one legacy portal; logging on but retained for 30 days when the dwell time was 60; a vendor with standing access nobody inventoried; and a patch SLA that the team could not meet and therefore quietly stopped measuring.

No product is universally secure, and the site should never say otherwise. Every tool's results depend on configuration, coverage, tuning, policy mode, and whether a human investigates what it produces. The most defensible editorial line is that the marginal value of the next security product is almost always lower than the marginal value of operating the ones already owned.