What is Defense in Depth?
A security strategy layering multiple independent controls so no single failure exposes the system.
Full explanation
Defense in depth combines redundant, non-overlapping controls: network segmentation, WAF, authentication, authorization, encryption, audit logging, monitoring. No control is trusted to be perfect — each catches what another misses.
Example
A Supabase-backed app has Row-Level Security (database layer) + API-route authorization (application layer) + rate-limiting + WAF (edge layer). If RLS is bypassed, the other layers catch the leak.
Related
FAQ
Is defense in depth a substitute for getting controls right?
No. Each control should be as strong as possible AND layered with others.