Chapter 5

Discussion Questions & Scaffolding

5.1: In Chapters 4 and 5, we discussed many different types of cybersecurity tooling to fulfill requirements in different domains. These domains include application security, network security, identity and access management, as well as host security (the categories are not exhaustive).

a. Brainstorm as many distinct categories as you can.
💡 Think about endpoint protection, data loss prevention, cloud security posture management, and SIEMs. How many distinct silos of defense can you list?
b. There is a concept called “defense in depth”. Basically, there are multiple layers of security controls to protect systems and data, so that if one defense fails, another is there to stop an attack. Comment on the viability of such an approach, and explain why different types of organizations may come to different conclusions on “defense in depth”?
💡 Defense in depth can be thought of in two main ways: defense in depth within the same OSI layer, and across OSI layers. However, “defense in depth” also increases cost. E.g. two firewalls from two different countries of origin may be acceptable in a high-security installation such as classified networks, as defense organizations could weigh the risk of one country's firewall being breached by a zero-day or a supply chain attack as a risk they may not be willing to accept. But for most other organizations, buying a second firewall to provide defense in depth is likely a much lower priority compared to implementing a second, different security control such as a endpoint detection and response agent, to provide complementary but different coverage.
c. One such class of detection techniques that achieves this outcome is behavioral anomaly detection. Use the MITRE D3FEND framework to identify as many locations where such behavior analysis can be carried out. (We will describe MITRE D3FEND in greater detail in Chapter 8.)
💡 Under the “Detect” section of MITRE D3FEND, there exists many different levels where analysis can be performed. For a start, let us assume an attacker that uploads a malicious file to a hard disk, that attemps to transfer data from said hard disk to an attacker-controlled device. This means the attacker has to drop a file to disk, initiate an outbound connection from disk across the network and transmit files over a network port. Use the information to think about what could be detected, and then work from here.
d. In February 2026, Claude Code Security was released.¹ This led to thoughts that AI-enhanced code review tools can significantly automate the identification and remediation of application-level vulnerabilities. This was speculated to have caused a sell-off in leading cybersecurity companies that include Crowdstrike, even though Crowdstrike does not operate in the code review domain. What could explain such a market reaction?
💡 This is not a cybersecurity question as much as it is a question to illustrate how the numerous domains in cyber-defense makes it difficult for the average investor/stock trader to understand which cybersecurity companies operate in the different cyber-defense domains. Try asking a LLM how many cybersecurity domains there are, and enumerate them.
e. Forrester frames the potential impact of Claude Code Security in terms of tension between CFO and CISO priorities ². How might those priorities differ, and how should a leadership team assess the resulting trade-offs?
💡 CFOs make decisions before CISOs do typically. How does this affect the CISO's ability to seek budget?

¹ Making frontier cybersecurity capabilities available to defenders. (2026). Anthropic.com. Link ² Pollard, J., Worthington, J., Mellen, A., Burn, J., & Nost, E. (2026, February 23). Claude code security causes a SaaS-pocalypse in cybersecurity. Forrester. Link

5.2: Considering the plethora of security tooling discussed in Chapters 4 and 5, how would you determine the tooling to be incorporated into an organization first?

a. Specifically, how would you think of the ROI of different security tools?
💡 ROI in security is notoriously hard to measure because the "return" is the *absence* of a costly breach. How do you decide on the financial value of a cybersecurity capability?
b. Given the debates between build versus buy and platformization vs best of breed, how would you approach such a ramp-up of capability?
💡 Ranking security tools in a pyramid to indicate when they should be introduced is useful. For example, CTI is auxiliary, whereas tools like firewalls, IDS/IPS and SOC solutions are essential for almost all organizations. To add onto what I provided in the book, ramp-up of capabilities from the financial planning perspective is often a multi-year exercise for the security department as well.

💡 A unified platform offers seamless integration but risks vendor lock-in, while "best of breed" provides top-tier specific defenses at the cost of integration difficulties. How do the capabilities of the team members at your disposal affect your decisions?

5.3: The topic of vulnerability management and patch management often overworks blue teams due to the increasing complexity of tech and development stacks used by the organization, leading to an ever-expanding bill of material to monitor for.

a. Different products can use similar technology and platform stacks. E.g. many front-ends that the organization runs could use different versions of ReactJS/NodeJS. How do we reconcile with this type of sprawl?
💡 From a technology perspective, there exists methods to obtain a bill of material (BOM). The industry has come up with standard methodologies of populating such BOMs, such as the standard from CycloneDX³.
b. Another type of sprawl arises from a merger of organizations, resulting in the acquisition of potentially conflicting security solutions and tech stacks. Are there easy ways of harmonizing tech stacks, and can a similar logic apply to harmonizing security solutions?
💡 What are the difficulties behind the options of (a) decommissioning one company's infrastructure in favor of another, (b) operating these networks separately, (c) integrating these networks to operate as one entity or (d) building a new network for both organizations that have come together?

³ OWASP Foundation. (n.d.). CycloneDX software bill of materials (sbom) standard. In cyclonedx.org. Retrieved 2 August 2026. Link

5.4: Along the lines of platformization is the discussion of putting together different security services today in the form of Secure Access Service Edge (SASE). This goes beyond the security suite of offerings in a typical CASB.

a. What functionalities does SASE offer on top of a CASB?
💡 While a CASB primarily secures cloud applications, SASE offers other security features such as zero-trust network access (this is a replacement for legacy VPNs), and allows for optimization and routing of data traffic across distributed sites (this is known as SD-WAN integration). Now try to understand how this is useful for an employee that works remotely.
b. Is SASE suitable for all organizations? Why or why not?
💡 SASE requires shifting network perimeters entirely to the cloud. Can all organizations adopt this cloud-only model?
c. Comment on whether SASE functions as an example of “platformization” of security capabilities in an organization.
💡 By bundling routing, VPNs, firewalls, and data loss prevention into one centralized cloud service, SASE eliminates the need for multiple distinct hardware appliances. Is this considered unified enough?

5.5: Another example of platformization is cloud-native versus cloud-agnostic tech stacks. In short, architects decide between a more integrated cloud-native architecture (which can pose the risk of vendor lockdown) or a more migratable cloud-agnostic architecture (which typically forgoes the ease of use of a cloud-native platform).

a. Comment on whether this issue translates in a similar way to security stacks that are cloud-native versus cloud-agnostic.
💡 A cloud-native security tool (like AWS GuardDuty) works perfectly out-of-the-box but binds you to that specific provider. How do organizations decide on whether they should be tied to one cloud vendor, or operate across multiple cloud vendors? One consideration is the extent of operational resiliency required.
b. Examine the concept of network architecture across different cloud platforms. Example: in AWS, there exists the concept of virtual private clouds (VPCs) and network security groups (NSGs). To what extent do cloud-native architecture solutions work well with varying security solutions available on the cloud? (native, solutions on the marketplace, solutions that are manually configured).
💡 Cloud providers offer deep, API-level integration for their native tools, whereas third-party marketplace solutions often rely on complex routing tricks to inspect traffic. Is this a variant of the problem brought up in Discussion 5.2 (b)?

5.6: Beyond the concept of a SOAR is the topic of an agentic SOC. Broadly, a SOAR platform provides automation but still requires analyst inputs in the form of understanding context (e.g. through the SIEM), performing threat hunts before playbooks can be written using the SOAR.

a. In the book, we have covered numerous activities that blue teams do. Which activities must be highly deterministic, and which activities allow for creativity and lateral thinking?
💡 Blocking a known malicious IP is a highly rigid, deterministic task, whereas hunting for a novel, stealthy persistent threat requires intuition and connecting disparate dots. How would you decide when a playbook ends and human ingenuity begins?
b. How do your answers in (a) affect the extent to which agentic AI can be used to perform said tasks?
💡 Consider the type of problems encountered in the blue team. Classify these problems, and decide the capabilities required to solve these smaller problems. Then infer if an agentic AI solution is useful.

5.7: Read the article titled Levels of Autonomy for AI Agents to answer several questions ⁴.

a. Given the varying cybersecurity capabilities mentioned in Chapter 5, what level of autonomy is the likely maximum level of autonomy you might be comfortable with?
💡 First, define the levels of autonomy, and begin from the least automated level. Describe the trade-offs required.
b. How about other types of AI systems?
💡 There are many types of AI systems, as you have seen in Chapter 1. For instance, ML algorithms are highly automated today. However, many hardware AI applications still require safety considerations.
c. What are your considerations before coming to the conclusions you derive in (a) and (b)? Would others likely have similar considerations? What does this imply about the extent to which a capability can be augmented/automated by AI?
💡 Consider trying to get a LLM to explore as many considerations as possible. We will go through some of these topics in Chapter 9.

⁴ Feng, K., D. McDonald, and A. Zhang. Levels of Autonomy for AI Agents. Knight First Amendment Institute, 2015, https://knightcolumbia.org/content/levels-of-autonomy-for-ai-agents-1.