Key Takeaways

• The four layers of preventive controls define what we prevent: Build controls catch issues in code, Access controls block risky actions, Config controls make resources secure by default, and Runtime controls auto-fix drift.
• Each layer has distinct strengths and limitations. Comprehensive prevention requires coverage across all four layers rather than perfect coverage in one layer.
• Defense in depth emerges from overlapping controls. Issues that bypass one layer get caught by others. Multiple control failures must align simultaneously for misconfigurations to reach production and persist.
• Organizations deploy the four layers in different orders based on culture, technical landscape, and organizational readiness. What matters is systematic expansion over time.