Defense in depth implies a whole lot of things, and is certainly not security theater. Usually it boils down to three major themes: 1. Reduce blast radius: ass

Defense in depth implies a whole lot of things, and is certainly not security theater. Usually it boils down to three major themes: 1. Reduce blast radius: assuming component X is compromised, how far and wide can it be felt? 2: Principle of least privilege: once compromised, what can X do or access? Extend to the credentials X carries or has access to. 3: Detection: how early and how well can you detect the compromise in previous two steps? You can never prevent a compromise, but you can make it easier to notice when it has happened, and you can limit what the attackers can do afterwards.