This is a general, reference-style guide to how the entire security stack of a large, high-stakes organisation is built and operated — the network foundation, every major security domain, the specific tools in each, and how it all ties together operationally. It names real vendors and is honest about cost, operational burden, and where teams commonly regret a choice, so it reads like an internal reference rather than a marketing overview. It describes common industry practice; it is not a claim of any particular deployment.
It is a companion to the more conceptual 100,000-user enterprise guide — that page is the why and the operating model; this one is the what, down to the tooling in each layer.
0. The environment we're defending (assumptions)
Unless stated otherwise, model a global bank / financial institution — the archetype of “high-stakes.” Concretely:
- 50,000+ employees across many countries, plus large contractor and third-party populations.
- Multiple physical data centres + heavy hybrid/multi-cloud (AWS + Azure primary, some GCP).
- Hundreds of branches, a large remote/hybrid workforce, and constant BYOD pressure.
- Severe regulatory exposure: PCI DSS (cards), SOX (financial reporting integrity), GDPR (EU privacy), DORA (EU operational resilience), GLBA (US financial privacy), plus national regulators.
- Very high uptime SLAs, near-zero tolerance for blast radius, and a mature threat model that explicitly includes nation-state and insider threats.
How “high-stakes” shapes every decision. Four forces recur, and I call them out throughout: Regulation (a control must be provable to an auditor, not just effective), Uptime (security cannot be the thing that takes trading offline — fail-open vs. fail-closed is a real debate), Blast radius (assume any single node is compromised; the design limits what that costs), and Auditability (every privileged action is logged, immutable, and attributable). These are why a bank's answer differs from a start-up's even when the threat is identical.
1. Guiding principles & architecture philosophy
Before any box on a diagram, the programme commits to a small set of principles that every later decision is checked against:
- Defense in depth. No control is load-bearing alone; an attacker must defeat many independent layers. Every layer below assumes the ones around it will sometimes fail.
- Zero Trust (per NIST 800-207). In practice this means: no implicit trust from network location; every access is authenticated, authorised, and encrypted based on identity + device posture + context; access is least-privilege and continually re-evaluated. It is a direction of travel, not a product — the network, identity, and endpoint sections are all implementations of it.
- Least privilege & assume-breach. Standing privilege is minimised; the interior is designed as though the attacker is already in it (which is what makes segmentation and monitoring non-negotiable).
- Segmentation of blast radius. The single most important structural idea — carve everything so one compromise is contained.
- Secure-by-design & resilience. Security and recoverability are designed in, not bolted on; BCDR and ransomware recovery are first-class.
- Auditability & provable control. Regulation turns “we are secure” into “prove it, continuously” — so logging, evidence, and change control are architecture, not paperwork.
2. Network architecture & design
This is the deepest section, because the network is the substrate every other control sits on and the place segmentation lives or dies. It works from the physical fabric outward to the user edge, then traces an end-to-end traffic flow.
2.1 Overall topology
Data-centre fabric. Modern DCs are built as a spine-leaf (Clos) fabric rather than the old core/distribution/access three-tier, because east-west (server-to-server) traffic now dominates and spine-leaf gives predictable, non-blocking, low-latency any-to-any paths. Leaf switches connect workloads; every leaf connects to every spine; an overlay (VXLAN/EVPN, or Cisco ACI / Arista / Juniper fabrics) carries tenant segmentation on top. The classic three-tier core/distribution/access model still appears in campus/branch LANs.
Cloud connectivity. On-prem joins cloud over private circuits — AWS Direct Connect and Azure ExpressRoute (never the public internet for production data-plane traffic) — landing in a transit gateway / hub. Each cloud is organised as a landing zone (AWS Control Tower / Azure Landing Zones) with a hub-and-spoke VNet/VPC design: a central hub holds shared security services (firewalls, inspection, DNS, egress), spokes hold workloads, and spoke-to-spoke traffic is forced through the hub for inspection rather than peered flat.
Topology pattern: hub-and-spoke for control and inspection; selective mesh only where latency demands it.
2.2 Segmentation & micro-segmentation (the core of the design)
Segmentation is enforced at multiple granularities, from coarse zones to per-workload policy:
- Security zones (coarse, firewall-enforced): Internet → DMZ (internet-facing/proxied services) → Internal → Restricted (the PCI cardholder-data environment, PII stores, the SWIFT/payments zone) → Management / OOB (a physically or logically separate out-of-band network for device management, iLO/iDRAC, jump hosts — never reachable from user space). A dedicated OOB network is a bank staple: it means an attacker on the user LAN cannot reach the management plane of the infrastructure.
- VLANs + firewall rules segment subnets; inter-zone traffic always crosses a firewall with explicit allow rules (default-deny).
- Micro-segmentation (fine, per-workload): host-based or fabric-based policy so each workload only talks to the specific peers it must, killing lateral movement even within a zone. This is where PCI scope is reduced and where ransomware is contained.
| Capability | Leading tools | Open-source / alternative | Notes & trade-offs |
|---|---|---|---|
| Host-based micro-segmentation | Illumio, Akamai Guardicore Segmentation | Cilium/eBPF (containers), host firewalls | Agent-based, workload-aware, cloud-portable; best for brownfield because it doesn't require re-IP. Operational burden is policy authoring — start in "visualise" mode for weeks before enforcing. |
| Fabric/network-based | Cisco Secure Workload (ex-Tetration), Cisco ACI, VMware NSX | — | Tight to the infrastructure vendor; powerful in a homogeneous DC, lock-in and cost are the downsides. NSX shines where VMware is the compute platform. |
| Cloud-native | Security groups / NSGs, AWS/Azure firewall, service mesh | Istio/Linkerd mTLS | Free-ish and native, but policy sprawls across accounts — needs CNAPP (§6) to govern. Service mesh adds mTLS identity between services. |
High-stakes lens: micro-segmentation is where blast radius is actually bought. You rarely micro-segment everything (the policy burden is real) — you ring-fence the crown jewels (CDE, payments, Tier-0 identity, PII) hard and accept coarser control elsewhere. Teams most often regret going straight to enforce without a long observe phase and outage-causing deny rules.
2.3 Remote access: from VPN to ZTNA/SASE
Legacy remote access was IPsec site-to-site (branch→DC) and SSL/remote-access VPN (user→DC concentrator: Cisco AnyConnect, Palo Alto GlobalProtect, Fortinet FortiClient). The fatal flaw of VPN is that it drops the user onto the network — once connected, they can reach far more than the one app they needed, which is exactly the flat-access lateral-movement problem Zero Trust attacks. So VPN is being replaced by ZTNA (per-application, identity- and posture-brokered access; the app is never exposed, and the user never joins the LAN), delivered as part of SASE/SSE (Secure Access Service Edge / Security Service Edge) which converges ZTNA + SWG + CASB + FWaaS in the cloud, close to the user.
| Capability | Leading tools | Alternative | Notes & trade-offs |
|---|---|---|---|
| ZTNA / SSE | Zscaler (ZIA + ZPA), Netskope, Palo Alto Prisma Access | Cloudflare One, Cato Networks, Cisco Umbrella+Duo | Zscaler is the enterprise default for scale; Netskope is strong on data/CASB; Cato is a single-vendor SASE favoured by leaner teams. Trade-off: you route all traffic through a vendor cloud — latency, privacy, and vendor-dependency become architecture concerns, and TLS inspection there is contentious. |
| Remote-access VPN (legacy/fallback) | Palo Alto GlobalProtect, Cisco AnyConnect, Fortinet | OpenVPN, WireGuard | Kept as break-glass and for thick/legacy apps ZTNA can't front yet. VPN concentrators are themselves a prized target (many 2020s breaches started on an unpatched VPN appliance). |
| SD-WAN | Cisco Catalyst SD-WAN (Viptela), VMware VeloCloud, Fortinet Secure SD-WAN, HPE Aruba EdgeConnect (ex-Silver Peak) | — | Replaces costly MPLS with policy-driven internet/hybrid transport for branches; security overlays via the SASE PoP. Classic WAN optimisers (Riverbed) still appear for latency-bound legacy apps. |
2.4 Inter-site & cross-DC communication
Between data centres, encryption-in-transit is mandatory even on “private” links: MACsec at layer 2 on dark-fibre/metro links, and IPsec overlays over any shared/MPLS/internet underlay. The underlay choice is a resilience/cost trade: dark fibre (max control, bandwidth, lowest latency; expensive, limited routes), MPLS (reliable, SLA-backed; costly, slow to provision), or internet underlay with SD-WAN (cheap, flexible; needs overlay encryption and careful SLA engineering). Banks typically run diverse paths from different carriers for the crown-jewel DCs so a single fibre cut or carrier outage never isolates a site.
2.5 Perimeter & edge
| Capability | Leading tools | Open-source / alternative | Notes |
|---|---|---|---|
| Next-gen firewall (NGFW) | Palo Alto PAN-OS, Fortinet FortiGate, Check Point, Cisco Secure Firewall | pfSense/OPNsense (small sites) | App-ID/user-ID/TLS-inspecting policy at zone edges. Palo Alto is the enterprise benchmark; Fortinet wins on price/throughput at the branch. Firewalls are also a top CVE target — patch discipline on the security kit itself matters. |
| IDS/IPS | Integrated in NGFW; Cisco Firepower | Suricata, Snort, Zeek | Inline IPS at the perimeter; Suricata/Zeek also feed the SOC as sensors (see the Suricata IDS lab writeup). |
| DDoS protection | Cloudflare, Akamai Prolexic, NETSCOUT Arbor, AWS Shield Advanced | — | Volumetric scrubbing upstream + on-prem for low-and-slow. Always-on for a bank's public services; "fail-open to availability" is the design bias. |
| Load balancer / ADC | F5 BIG-IP, Citrix NetScaler, cloud LBs | HAProxy, NGINX, Envoy | TLS termination, WAF insertion point, and a place attackers probe; F5 is ubiquitous in banks and, being in-path, a high-value target to patch promptly. |
| Secure web gateway / proxy / DNS | Zscaler ZIA, Netskope, Cisco Umbrella | Squid + Pi-hole/RPZ | All egress through a proxy with category/TLS policy; default-deny egress + DNS filtering strangle C2 and exfil — one of the highest-ROI controls. |
2.6 Wireless & NAC
Corporate Wi-Fi is WPA3-Enterprise with 802.1X / EAP-TLS (certificate-based, no shared passwords), with separate guest and corporate SSIDs and rogue-AP/WIPS detection. Network Access Control (NAC) gates what any device can reach the moment it connects, based on identity and posture, and drives dynamic segmentation (an unmanaged or non-compliant device is dropped into a quarantine VLAN automatically).
| Capability | Leading tools | Notes |
|---|---|---|
| NAC | Cisco ISE, Aruba ClearPass, Forescout | ISE if you're a Cisco shop (deep but complex); Forescout is strong on agentless discovery incl. OT/IoT; ClearPass is multi-vendor-friendly. NAC projects are notoriously long — posture + 802.1X everywhere is a multi-year programme. |
2.7 Network Detection & Response (NDR)
NGFW/IPS see north-south; NDR gives the east-west and encrypted-traffic visibility the SOC otherwise lacks, using behavioural/ML analytics on network metadata to catch lateral movement, beaconing, and data staging that signature tools miss. It feeds the SIEM/SOC.
| Leading tools | Open-source / alternative | Notes |
|---|---|---|
| Darktrace, Vectra AI, ExtraHop Reveal(x), Corelight | Zeek (Corelight is commercial Zeek), Arkime, Suricata | Vectra leans to identity/attacker-behaviour; ExtraHop to high-fidelity decode; Darktrace to unsupervised anomaly (noisy without tuning). Corelight/Zeek give the richest, most portable metadata for a detection-engineering-led SOC. Trade-off: NDR is a sensor-placement and data-volume problem — you tap the chokepoints (DC core, cloud mirror/VPC traffic mirroring), not everything. |
2.8 End-to-end traffic flow (described diagram)
A remote user reaching an internal banking app, traced through the stack:
[ User device ]
| (device posture + cert checked by MDM/NAC; identity required)
v
[ SASE / SSE PoP ] -- SWG category+TLS policy, CASB, DLP inline
| ZTNA broker: "is THIS identity+device allowed THIS app?"
v
[ ZTNA connector in the app's segment ] (app never exposed to internet)
|
v
[ NGFW / zone boundary ] -- default-deny, App-ID, IPS, logs -> SIEM
|
v
[ Micro-seg policy (Illumio/NSX) ] -- only this app tier may talk to this DB tier
|
v
[ Load balancer / WAF ] -- TLS, OWASP rules, API schema checks
|
v
[ Application tier ] --(mTLS)--> [ Database tier ]
|
v
[ DAM (Guardium) watches privileged/sensitive queries ]
In parallel, EVERY hop mirrors telemetry:
NGFW/proxy/DNS logs, NDR metadata, EDR events, identity logs, cloud logs
--> log pipeline --> SIEM + data lake --> SOC (detect -> respond)The point of the diagram: an attacker who phishes the user still has to beat device posture, the ZTNA broker, the zone firewall, micro-segmentation, the WAF, and mTLS — and every one of those is also emitting the telemetry that lets the SOC catch them.
3. Identity & Access Management (IAM)
In Zero Trust, identity is the primary control plane — and Active Directory/Entra is the literal crown jewel, since whoever owns the directory owns the bank. IAM is split into authentication, directory, privilege, governance, and machine secrets.
| Capability | Leading tools | Alternative / OSS | Role & trade-offs |
|---|---|---|---|
| IdP / SSO / MFA | Microsoft Entra ID, Okta, Ping Identity | ForgeRock/PingAM, Keycloak (OSS) | One IdP federating thousands of apps (SAML/OIDC/SCIM) with Conditional Access and phishing-resistant MFA (FIDO2/passkeys). Entra if Microsoft-centric; Okta as a neutral broker across many SaaS. Keycloak only where you can own the ops burden. |
| Directory & AD security | Active Directory + Entra; Microsoft Defender for Identity, Semperis, Tenable Identity Exposure (ex-AD) | BloodHound/BloodHound CE (OSS, attacker & defender) | AD is legacy but load-bearing; these tools find the dangerous ACLs/paths (DACL abuse, kerberoasting) and give AD-forest recovery (Semperis). Running BloodHound against your own estate is table stakes. |
| Privileged Access Mgmt (PAM) | CyberArk, BeyondTrust, Delinea (ex-Thycotic) | Teleport (modern, infra-focused) | Vaulting, session recording, just-in-time elevation, break-glass. CyberArk is the bank default (and heavy/expensive to run); Teleport is the cloud-native challenger for infra/SSH/K8s access. |
| Identity Governance (IGA) | SailPoint, Saviynt | Omada, Microsoft Entra ID Governance | Joiner/mover/leaver automation, access certifications, and Segregation-of-Duties enforcement — SoD is a SOX/audit requirement in a bank, not a nicety. IGA programmes are long and political but are where over-entitlement is fixed at scale. |
| Machine/app secrets | HashiCorp Vault, CyberArk Conjur, cloud KMS/secret managers | Vault OSS, SOPS | Dynamic, short-lived secrets for apps/pipelines so static passwords die. Vault is the de-facto standard; the ops burden (HA, unseal, policy) is real. |
| Cloud entitlements (CIEM) | Wiz, Microsoft Entra Permissions Mgmt, Sonrai | — | Rightsizes the explosion of cloud IAM permissions (the cloud's privilege-creep problem); usually a module of the CNAPP in §6. |
Identity flow (described): user → IdP authenticates with phishing-resistant MFA → Conditional Access evaluates device compliance (from MDM) + risk + location → token issued scoped to the app → for privileged actions, the session is brokered through PAM (just-in-time, recorded) from a hardened admin workstation. Standing admin rights approach zero; every elevation is logged and attributable — the auditability the regulator demands.
3.1 PKI, certificates & machine identity
At enterprise scale there are far more machine identities (services, workloads, devices, pipelines) than human ones, and they authenticate largely with certificates and keys. Left unmanaged, certificates become outages (expiries that take payments offline) and security gaps (rogue or long-lived certs). So an internal PKI (an internal CA hierarchy, increasingly automated with ACME) plus a certificate lifecycle management platform is its own control area, tightly coupled to identity and secrets.
| Capability | Leading tools | OSS / native | Role & trade-offs |
|---|---|---|---|
| Certificate lifecycle / machine identity | Venafi (now CyberArk), Keyfactor, AppViewX, Entrust | HashiCorp Vault PKI, step-ca, cert-manager (K8s), ACME/Let's Encrypt for public | Discover, issue, rotate, and revoke certs automatically so none expire unnoticed or outlive their purpose. Venafi/Keyfactor are the enterprise standards; Vault PKI + cert-manager cover cloud-native well. The post-quantum-crypto migration and ever-shortening cert lifetimes make automation non-negotiable. |
| Internal CA / HSM-backed root | Microsoft AD CS, EJBCA, cloud private CA | EJBCA (OSS), smallstep | Issues the internal trust. AD CS is common but a frequent attack path (ESC1–ESC8) — it must be hardened and monitored as a Tier-0 asset. |
4. Data security
The thing we're ultimately protecting. Controls wrap the data itself so it survives when perimeter, endpoint, and identity controls fail — and so PCI/GDPR obligations are met.
| Capability | Leading tools | Alternative / OSS | Role & trade-offs |
|---|---|---|---|
| DLP (endpoint/network/cloud) | Microsoft Purview DLP, Forcepoint, Broadcom/Symantec, Zscaler DLP | — | Stops sensitive data leaving. Purview if Microsoft-centric and data lives in M365; Forcepoint/Symantec for heavy endpoint/network DLP. DLP is notoriously false-positive-heavy — expect a long tuning programme and business friction. |
| Database Activity Monitoring (DAM) | Imperva, IBM Guardium | Native DB audit + SIEM | Watches privileged and sensitive-data queries on crown-jewel databases for compliance and insider detection; a PCI/SOX staple. Agents/taps add DB overhead — placement and scope matter. |
| Classification & discovery (DSPM) | Microsoft Purview, BigID, Varonis | — | Labels drive every downstream control; DSPM finds where regulated data actually sprawled. Varonis is strong on data-access analytics (who can/does touch what). |
| Encryption keys / HSM | Thales Luna/CipherTrust, Entrust, cloud HSM (CloudHSM / Azure Managed HSM) | — | Keys in FIPS-validated HSMs, customer-managed for the most sensitive sets; key lifecycle (rotation, escrow, separation of duties) is itself audited. Tokenisation/masking shrinks PCI scope. |
| CASB (SaaS governance) | Netskope, Microsoft Defender for Cloud Apps, Zscaler | — | Visibility and DLP/policy over sanctioned and shadow SaaS data in transit; usually part of the SASE stack, so it co-locates with the proxy. |
| SSPM (SaaS posture) | AppOmni, Obsidian, Microsoft Defender for Cloud Apps | — | Where a CASB watches traffic, SSPM audits the configuration and entitlements inside critical SaaS (M365, Salesforce, Workday) — the over-shared files and over-privileged OAuth grants that are now a top data-exposure path. Obsidian adds UEBA over SaaS for insider/takeover detection. |
5. Endpoint & workload security
| Capability | Leading tools | Alternative / OSS | Role & trade-offs |
|---|---|---|---|
| EDR / XDR | CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Palo Alto Cortex XDR | Wazuh, osquery + Velociraptor (OSS DFIR) | The endpoint's eyes and kill-switch. CrowdStrike is the premium default; Defender is compelling when you own E5 licensing (cost leverage); SentinelOne/Cortex are strong challengers. XDR extends correlation to identity/email/cloud. Agent performance and single-vendor risk are the debates. |
| NGAV / app control / device control | Built into EDR; WDAC, AppLocker | — | Allowlisting is the strongest control against commodity malware and LOLBins — and the hardest to operate without breaking the business. |
| Server/container workload | CrowdStrike/SentinelOne cloud-workload, Defender for Servers; part of CNAPP | Falco (OSS runtime), Trivy | Runtime protection for VMs and K8s; Falco for OSS runtime threat detection in containers. |
| MDM / UEM (managed + BYOD) | Microsoft Intune, Jamf (Apple), VMware Workspace ONE | — | Enrols, hardens, and attests devices; device compliance is the Conditional-Access signal that ties endpoint back to identity. BYOD is handled with MAM/app-protection or containerisation rather than full management. |
6. Cloud & application security
The multi-cloud estate and the app pipeline create new risk daily, so security shifts left (build) and right (runtime), delivered as a platform developers consume.
| Capability | Leading tools | Alternative / OSS | Role & trade-offs |
|---|---|---|---|
| CNAPP (CSPM+CWPP+CIEM) | Wiz, Palo Alto Prisma Cloud, Orca Security, Microsoft Defender for Cloud | Prowler, CloudQuery, Steampipe (OSS CSPM) | One platform for misconfig, workload, and entitlement risk across AWS/Azure/GCP. Wiz won the market on agentless speed and an attack-path graph; Defender for Cloud leverages Azure-native integration. The risk is alert overload — prioritise by exploitable attack path, not raw findings. |
| Kubernetes / container | Wiz/Prisma, Aqua, Sysdig | Falco, Trivy, Kyverno/OPA Gatekeeper | Image scanning, admission control (policy-as-code), runtime detection. Sysdig/Falco lead on runtime; OPA/Kyverno enforce guardrails at deploy. |
| AppSec — SAST/DAST/SCA | Snyk, Checkmarx, Veracode, SonarQube | Semgrep (OSS SAST), OWASP ZAP (OSS DAST), Dependency-Track | Wired into CI/CD for fast developer feedback. Snyk owns developer-first SCA; Semgrep is the OSS/low-cost SAST favourite. Gate on new critical findings, not the whole backlog, or developers route around you. |
| WAF | F5, Imperva, Cloudflare, AWS WAF, Akamai | ModSecurity + OWASP CRS (OSS) | In front of web apps at the ADC/CDN. Cloudflare/Akamai at the edge for public apps; F5/Imperva in-DC. Tuning to avoid blocking legit traffic is the ongoing cost. |
| API security | Salt Security, Akamai API Security (ex-Noname), Traceable | — | APIs are the modern attack surface (and a bank is all APIs); these discover shadow APIs and detect abuse/business-logic attacks the WAF misses. |
| Secrets scanning | GitGuardian, Snyk, native (GitHub Advanced Security) | Gitleaks, TruffleHog (OSS) | Catches credentials committed to code — the exact failure behind countless breaches. Cheap, high ROI, run in pre-commit and CI. |
6.1 AI & LLM security
AI — especially generative/LLM applications — is now a first-class part of the application attack surface, both the systems an organisation builds with AI and the AI tools its staff use. The recognised control vocabulary is the OWASP Top 10 for LLM Applications (2025) — prompt injection, sensitive-information disclosure, supply-chain and model/data poisoning, insecure output handling, excessive agency, and so on — sitting inside the governance frameworks NIST AI RMF and ISO/IEC 42001 (an AI management system, the ISO 27001 analogue for AI).
| Concern | Leading tools / controls | Notes & trade-offs |
|---|---|---|
| LLM guardrails / AI firewall | Lakera, Protect AI, Robust Intelligence (Cisco), HiddenLayer; cloud-native (Azure AI Content Safety, AWS Bedrock Guardrails) | Filter prompt injection, jailbreaks, and sensitive-data leakage at the app boundary. Still an immature market — treat as defence-in-depth, not a sole control; the real fix is least-privilege tool/agent design. |
| AI posture & model supply chain | Wiz AI-SPM, Protect AI, HiddenLayer; model/artefact scanning | Discover where AI/ML is running (shadow AI), scan models and notebooks for malicious artefacts, and govern which third-party models are allowed. |
| Data protection for AI use | DLP/CASB with GenAI policies, SSPM, enterprise-controlled AI gateways | Stop staff pasting regulated data into public chatbots — route them to a sanctioned, logged enterprise AI endpoint instead of blocking (shadow-AI is the alternative). |
| Governance | NIST AI RMF, ISO/IEC 42001, an AI use-case register & risk review | A bank must inventory AI use, assess model risk (bias, explainability, regulatory), and keep a human in the loop for high-impact decisions — this is model-risk-management territory regulators already understand. |
AI security has two faces: securing the AI you deploy (the OWASP-LLM surface, agent/tool permissions, model supply chain) and governing the AI your people use (data leakage, shadow AI). Both are increasingly audited; neither is optional in a regulated enterprise. AI also increasingly augments the defender — triage, detection tuning, and hunting in the SOC below.
7. The SOC — end-to-end workflow
The Security Operations Centre is where all the telemetry becomes detection and response. It is people + process + a data pipeline, operated 24×7. Walk it end to end.
7.1 Telemetry & the log pipeline
Everything emits: endpoint (EDR, Sysmon), network (NGFW, proxy, DNS, NDR, flow), identity (AD/Entra sign-ins, PAM), cloud (CloudTrail, Azure Activity, GuardDuty), app and DB (DAM). At a 50k-employee bank this is hundreds of thousands of events per second and tens of TB/day, so the pipeline is tiered: a collection/ normalisation layer (Cribl Stream, Logstash, or vendor forwarders) routes high-value, detection-relevant data hot into the SIEM and the bulk cold into a cheap data lake (S3/ADLS) for compliance retention and investigation search. Routing at ingest is where most of the SIEM cost is won or lost.
7.2 SIEM & detection engineering
| SIEM | Notes & trade-offs |
|---|---|
| Splunk Enterprise Security | The powerhouse; unmatched flexibility, infamous cost at bank-scale ingest. Still the enterprise default. |
| Microsoft Sentinel | Cloud-native, strong if you're Azure/M365-heavy; cost scales with ingest, pairs with the cheap data-lake tier. |
| IBM QRadar / Google SecOps (Chronicle) / Elastic Security | QRadar is a legacy bank mainstay; Chronicle's flat-rate, petabyte-scale search is attractive for high-volume; Elastic (OSS core) for teams that want to own the stack. |
Detection engineering is the heart of SOC quality: detections are written and tuned as code (Sigma rules in Git), mapped to MITRE ATT&CK so coverage is measured technique-by-technique rather than by vendor dashboard, version- controlled, peer-reviewed, and tested. UEBA adds behavioural baselines for insider and anomaly detection (critical given the explicit insider threat model).
7.3 Threat intel & SOAR
| Capability | Leading tools | OSS | Role |
|---|---|---|---|
| Threat Intelligence Platform | Recorded Future, Mandiant (Google), Anomali, ThreatConnect | MISP, OpenCTI | Enriches alerts with context (is this IP/hash/TTP known-bad, who uses it) and drives proactive blocking/hunting. MISP is the OSS backbone many banks run alongside a paid feed. |
| SOAR / automation | Palo Alto XSOAR, Splunk SOAR, Tines, Torq | Shuffle (OSS) | Playbooks that auto-enrich, auto-contain (isolate host, disable account), and auto-close noise. Mandatory at scale: with ~70% of default-ruleset alerts being false positives at ~15 min triage each, you cannot hire your way out. Tines/Torq are the modern low-code challengers to XSOAR. |
| Case management | In-SIEM, ServiceNow SecOps, TheHive (OSS) | TheHive + Cortex | Ticketing, evidence, SLA tracking, and metrics. |
7.4 The analyst workflow & IR lifecycle
A follow-the-sun model (regional SOCs hand off around the clock) runs a tiered workflow:
- Tier 1 — triage: validate and prioritise alerts, close known false positives, escalate real ones. SLA-driven (e.g. acknowledge P1 in minutes).
- Tier 2 — investigation: scope the incident across tools, pivot through telemetry, contain (SOAR-assisted), and drive to eradication.
- Tier 3 — threat hunting / IR: proactive hypothesis-driven hunting (ATT&CK-guided), deep forensics, malware analysis, and leading major incidents.
Incidents follow the NIST SP 800-61 lifecycle: preparation, detection & analysis, containment, eradication, recovery, and post-incident learning. A retained IR firm (Mandiant, Unit 42, CrowdStrike Services) is on call for major events, and an MDR/MSSP augments the internal SOC for surge, after-hours, or specialised coverage — you staff for the median and burst to the partner for the peak. Purple teaming runs continuously so detections are tested against real adversary emulation, not assumed.
7.5 Detection-to-response pipeline (described diagram)
SOURCES PIPELINE BRAIN ACTION
-------- -------- ----- ------
EDR -----\
Network ----\ Collect/normalise SIEM (hot) Tier 1 triage
Identity ----+--> (Cribl/forwarders) --> + detections --> Tier 2 investigate
Cloud ----/ | mapped to ATT&CK Tier 3 hunt/IR
App/DB --/ | UEBA baselines |
v TI enrichment v
Data lake (cold) | SOAR playbook:
retention + search +----------> enrich -> contain
(isolate host,
disable account)
|
v
NIST IR: contain -> eradicate
-> recover -> lessons learned
(retainer + MDR on surge)8. Vulnerability, exposure & offensive security
The modern framing for this area is Continuous Threat Exposure Management (CTEM) — a Gartner cycle of Scoping → Discovery → Prioritization → Validation → Mobilization that moves beyond periodic scanning to a continuous, business-aligned loop: define what matters, find the exposures across the whole attack surface, rank them by real exploitability and business impact, prove they're actually exploitable (and that controls catch them), then drive remediation. The tools below are how each stage is operationalised.
| Capability | Leading tools | OSS | Notes |
|---|---|---|---|
| Vulnerability management | Tenable (Nessus/.io), Qualys, Rapid7 InsightVM | OpenVAS/Greenbone | Scan + prioritise. Raw CVSS is not enough at bank scale — prioritise by EPSS (exploit probability) and CISA KEV (known-exploited) plus asset exposure, or you drown. Patching is the hard operational half. |
| Attack Surface Management | Microsoft Defender EASM, Censys, Palo Alto Cortex Xpanse | amass, Shodan | Finds the internet-facing assets you forgot you had — a top breach vector after M&A. |
| Pen testing & red team | Internal red team + external firms; Cobalt Strike, Core Impact | the toolkit here (BloodHound, Impacket, NetExec, Nuclei…) | Objective-based adversary emulation validates the whole stack end-to-end, not one bug. |
| Breach & Attack Simulation (BAS) | AttackIQ, SafeBreach, Cymulate | Atomic Red Team, Caldera (OSS) | Continuously fires known TTPs to prove controls and detections actually work — closes the loop with detection engineering. Atomic Red Team is the OSS way to test ATT&CK coverage cheaply. |
9. Email & the human layer
Phishing is still the #1 initial-access vector, so mail and people are treated as a control surface.
| Capability | Leading tools | Notes |
|---|---|---|
| Email security | Proofpoint, Mimecast, Abnormal Security, Microsoft Defender for Office 365 | Abnormal leads on behavioural BEC/account-takeover detection (the hard, high-loss cases for a bank); Proofpoint/Mimecast are the established SEGs; Defender for O365 is compelling with E5. Enforce SPF/DKIM/DMARC at p=reject to stop domain spoofing. |
| Awareness & phishing simulation | KnowBe4, Proofpoint Security Awareness | Regular training + simulated campaigns; measured by failure rate as a leading indicator. Pair with a frictionless "report phish" button that feeds the SOC. |
| Insider risk | Microsoft Purview Insider Risk, DTEX, Forcepoint | Behavioural signals (plus UEBA and DAM) for the explicit insider threat — balanced carefully against employee privacy and works-council/GDPR constraints. |
10. Governance, Risk & Compliance (GRC)
In a regulated bank, GRC is not back-office — it is what makes the whole programme provable. The job is to operationalise compliance continuously, not scramble annually for the audit.
| Capability | Leading tools | Notes |
|---|---|---|
| GRC / IRM platform | RSA Archer, ServiceNow IRM/GRC, OneTrust, LogicGate | Risk register, control library, policy, and audit evidence in one place. Archer is the heavyweight bank incumbent; ServiceNow IRM wins where ServiceNow is already the system of record; OneTrust leads on privacy/GDPR. |
| Control mapping | Map once to NIST CSF/800-53, ISO 27001, SOC 2, PCI DSS, CIS Controls, DORA | A unified control framework so one control satisfies many regimes and evidence is collected once. Continuous control monitoring (automated evidence from the tools above) replaces point-in-time audits. |
11. Resilience, BCDR & physical/OT
- Backup & ransomware recovery: immutable/air-gapped backups (Rubrik, Cohesity, Veeam with immutability; Dell PowerProtect Cyber Recovery vault) at scale, with tested restores. An untested backup is a hypothesis; a bank rehearses full recovery, including AD forest recovery, which is the critical path after a domain-wide compromise.
- DR strategy: defined RTO/RPO per service tier, multi-region/active- active for crown-jewel services, and DORA-driven operational-resilience testing — regulators now mandate proving you can withstand and recover from severe disruption.
- Exercises: tabletop and live incident/DR drills up to board level, so the plan is muscle memory and the crisis-comms/regulatory-notification clocks (GDPR 72h, DORA reporting) are rehearsed.
- Physical & OT: data-centre physical security (badging, mantraps, CCTV) is in-scope for audit; where industrial/building systems exist they are isolated and monitored passively (Claroty, Nozomi, Forescout) — the device you can't patch, you contain.
12. How it all fits together
The layers are not independent products; they reinforce each other, and the design's whole value is in the interlocks:
- Identity × endpoint: device compliance (MDM) is an input to Conditional Access — a non-compliant device can't get a token, so identity and endpoint enforce each other.
- Network × identity: ZTNA brokers access by identity, so the network stops being a trust boundary and becomes an enforcement point for identity decisions.
- Everything × the SOC: every layer emits telemetry; the SOC is the feedback loop that detects when a control failed and drives response — and purple-teaming/BAS feed fixes back into detections.
- Data × all: classification and encryption mean that even a full bypass of the outer layers still yields unusable data, and DAM/DLP catch the exfiltration attempt.
Biggest single points of failure / trade-offs to watch:
- Active Directory / the IdP is the crown jewel — its compromise is game-over, which is why Tier-0/Enterprise-Access-Model isolation and AD-recovery drills get disproportionate investment.
- The security vendors themselves (SASE cloud, EDR, firewall, VPN appliance) are in-path and privileged — their outages or CVEs are now top operational risks (a single bad EDR update can take down the fleet; an unpatched VPN appliance starts a breach).
- Alert fatigue & tool sprawl: buying 60 tools you can't operate is a worse posture than running 20 well. Consolidation (XDR, CNAPP, SASE) is partly a response to this.
- Fail-open vs. fail-closed: for a bank, availability sometimes wins — architecting where a control fails open (to keep trading up) vs. closed (to stop a breach) is an explicit, risk-accepted decision per control.
Mature vs. immature
| Dimension | Immature | Mature |
|---|---|---|
| Access | Flat VPN, standing admin rights, shared accounts | ZTNA, JIT PAM, phishing-resistant MFA, near-zero standing privilege |
| Segmentation | Big flat zones, east-west wide open | Micro-segmented crown jewels, default-deny east-west |
| Detection | Vendor default rules, alert triage by hand | Detection-as-code mapped to ATT&CK, SOAR-automated response, measured coverage |
| Cloud | Click-ops, no guardrails, findings ignored | Landing zones, CNAPP by exploitable attack path, policy-as-code |
| Resilience | Backups untested, no IR plan | Immutable backups, rehearsed IR/DR incl. AD recovery, DORA-tested |
Realistic build sequence
- Foundations & visibility first: asset inventory, EDR everywhere, MFA + kill legacy auth, centralise logs into a SIEM, PAM for Tier-0. You cannot defend what you cannot see or control.
- Raise the floor: IGA joiner/mover/leaver, SASE/ZTNA for users, segment the crown jewels, security gates in CI/CD, CNAPP on the cloud.
- Operationalise & automate: detection-as-code, SOAR, UEBA, DSPM + data controls, immutable backup and AD-recovery drills.
- Optimise & prove: continuous validation (purple team/BAS), risk-based patching, M&A integration playbook, board metrics (MTTD/MTTR, coverage, MFA/EDR %), and a roadmap that keeps moving each pillar up the maturity curve.
The through-line: no single layer is trusted to be perfect; the system is engineered so that a successful attack has to defeat many independent, overlapping controls and evade the telemetry each one emits — and so that when (not if) something gets through, blast radius is small, detection is fast, and recovery is rehearsed. That is what “defense in depth” actually buys in a high-stakes environment.
References
- NIST SP 800-207 — Zero Trust Architecture
- CISA — Zero Trust Maturity Model v2
- MITRE ATT&CK
- NIST SP 800-61 — Computer Security Incident Handling
- NIST Cybersecurity Framework 2.0
- NIST AI Risk Management Framework
- OWASP Top 10 for LLM Applications (2025)