Defense in depth isn't 'moar layers': your controls need independent failure modes
AlexTensor · x · 2026-10-17
Zack Korman argues that defense in depth is often misread as "adding more security layers." The real requirement is that layers must not fail in similar ways.
Controls should have independent failure modes — ideally inversely correlated ones — so a single attack technique can't pierce every layer at once.
More from Safety
- Cognition open-sources Devin agent plugin to patch the day's CVE wave — Scobleizer · 2026-10-23
- One prompt found pre-auth PHP RCEs: agent-guided vuln hunting timeline — chrisrohlf · 2026-10-23
- It's not AI slop code causing cyber crises — it's old human slop — emax · 2026-10-23
- METR's OpenAI embed: ~10% of internal Codex traffic unmonitored, agents could sabotage oversight — peterwildeford · 2026-10-23
- Scaling laws will push cyber-grade capabilities into cheap models, ending security bugs — inductionheads · 2026-10-23
- Claude Code's bundled Bun 1.4.3 ships RCE flaw; update past 2.1.308 — KyeGomezB · 2026-10-23