Security Reference Architecture
A reference architecture for modern security, bringing together the capabilities needed to govern, protect, monitor and recover your most critical assets.
Security Component Model
72 logical security services across 13 layers. Hover to highlight, click any component for its definition and example implementations.
The Policy Engine and Policy Administrator together form the Policy Decision Point. Decisions are made centrally; enforcement happens locally, at many Policy Enforcement Points.
Overview
This reference architecture defines the capabilities an organisation needs to protect its people, systems and data, and the components that deliver them. Unlike the Integration and Data Platform architectures — each of which follows a path that data travels — security has no single flow. It is a set of controls applied across every other architecture, so this model is organised by what is being protected rather than by where data moves.
Every access decision in the architecture resolves through one control plane, described first. The layers that follow are the asset classes that control plane protects, and the cross-cutting layers are the disciplines that govern, watch and restore them.
This architecture is our own, though it is informed by several well-known frameworks — NIST, SABSA, OSA and others. We wrote our own because those frameworks are built to assess an organisation rather than to design one: they say what you must be able to do, not what to build. This model names the components instead, so an architect can work from it.
The Control Plane: Policy Decision and Enforcement
Zero Trust is not a product tier — it is the decision that every request is evaluated on its merits rather than trusted because of where it came from. Three logical components make that possible, and separating them is what distinguishes an architecture from an application with roles in it.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Policy Engine (PE) | Makes the decision. Evaluates each request against policy, identity, device posture, behavioural history and threat intelligence to produce an allow, deny or step-up outcome. Owns the trust algorithm. | Open Policy Agent, Microsoft Entra Conditional Access, Cedar/AVP |
| Policy Administrator (PA) | Executes the decision. Establishes or terminates the session, issues and revokes the credentials the enforcement point will accept. The bridge between deciding and enforcing. | Entra ID, Okta Workflows, HashiCorp Vault (credential issuance), SPIRE Server |
| Policy Enforcement Point (PEP) | Sits in the data plane immediately in front of the resource and actually permits or blocks the connection. There are usually many PEPs for one PE. | API gateways, service-mesh sidecars (Envoy/Istio), ZTNA proxies such as AWS Verified Access, host agents |
| Trust Signal Sources | Feed the engine the context it needs: device posture, identity risk score, threat feeds, session anomaly, data classification. Decision quality is bounded by signal quality. | EDR posture APIs, identity protection services, CTI feeds, CSPM findings |
PE + PA together form the Policy Decision Point. The PDP/PEP split is the single most useful idea in this architecture: the decision is made centrally and consistently, while enforcement happens locally and close to the resource.
Component Model Layers
1. Identity & Access Layer
Establishes who or what is making a request, and what they are permitted to do. The foundation every other layer depends on — a compromised identity bypasses most other controls.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Directory Services | The authoritative store of user, group and device records. Frequently a legacy on-premises directory that must be integrated with, rather than replaced, for years. | Active Directory, OpenLDAP, Entra ID, Google Cloud Identity |
| Federation & Single Sign-On | Exchanges an authenticated session at one party for a trusted assertion at another, so credentials are presented once and held in one place. | SAML 2.0, OpenID Connect, Okta, Ping Identity, Keycloak (Open Source) |
| Authorisation Server & Token Service | Issues, refreshes, exchanges and revokes the tokens that carry identity and scope between parties. Where OAuth grant flows are implemented. | Entra ID, Auth0, Okta, Keycloak, Ory Hydra (Open Source) |
| Multi-Factor & Step-Up Authentication | Requires additional proof, either at sign-in or at the point a sensitive action is attempted, rather than trusting the original session indefinitely. | FIDO2/WebAuthn, passkeys, Duo, Entra Conditional Access |
| Privileged Access Management | Brokers, time-bounds and records administrative access, including the break-glass path used when normal controls are unavailable. | CyberArk, BeyondTrust, Entra PIM, HashiCorp Boundary |
| Workload & Machine Identity | Gives services their own cryptographic identity so service-to-service calls are authenticated rather than assumed. | SPIFFE/SPIRE, mTLS, cloud workload identity federation, Vault |
| Entitlement & Policy Models | The models by which permission is decided — roles, attributes, or relationships — and the store that holds them. | RBAC, ABAC, ReBAC (Zanzibar-style), OpenFGA, Cedar, OPA |
| Trust Domain Model | Names the trust boundaries policy is written against — which systems share a common trust level, policy and risk appetite, and on what terms one domain accepts assertions from another. The logical model that segmentation and federation physically enforce. | SPIFFE trust domains, cloud landing-zone / account boundaries, AD forest and federation trusts, Purdue zoning |
| Session & Credential Lifecycle | Governs the time dimension of access: enrolment, session lifetime, token TTL, how often a live session is re-evaluated, credential rotation and deprovisioning. Zero Trust claims continuous evaluation; this is the component that makes the claim concrete. | Refresh-token rotation, Continuous Access Evaluation / CAEP shared signals, short-lived workload certificates, Vault dynamic secrets, SCIM deprovisioning |
2. Endpoint & Device Trust Layer
Establishes whether the device carrying a request is in a state fit to be trusted. Posture is half of what makes conditional access meaningful; without it, Zero Trust reduces to identity alone.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Device Identity & Enrolment | Registers devices, issues device certificates, and distinguishes managed from unmanaged hardware. | Intune, Jamf, Workspace ONE, SCEP/certificate enrolment |
| Configuration & Hardening Baselines | Enforces a known-good configuration and detects drift away from it. | CIS Benchmarks, Group Policy, Ansible, Intune configuration profiles |
| Endpoint Detection & Response (EDR) | Detects malicious behaviour on the device itself and provides the containment capability to isolate it. | CrowdStrike, SentinelOne, Microsoft Defender for Endpoint |
| Posture-Gated Access | Publishes device health as a signal to the Policy Engine so access can be conditioned on it. | Entra Conditional Access, Chrome Enterprise device trust, Okta Device Trust |
| Unmanaged & BYOD Containment | Isolates corporate data on devices the organisation does not control, typically by containerisation or browser isolation. | MAM policies, enterprise browsers, VDI/DaaS |
3. Network & Infrastructure Layer
Controls reachability. Modern practice moves from a hardened perimeter towards identity-aware access and segmentation that limits how far an intruder can travel.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Zero Trust Network Access (ZTNA) | Grants access to individual applications based on identity and posture rather than placing the client on a network. Replaces broad VPN access. | Zscaler Private Access, Cloudflare Access, Entra Private Access, Tailscale |
| Micro-segmentation | Restricts lateral movement by permitting only the flows that are explicitly required between workloads. | Illumio, Cilium network policies, security groups, service-mesh authorisation |
| Edge Protection (WAF & DDoS) | Filters hostile traffic before it reaches an application — injection attempts, bot traffic, volumetric floods. | AWS WAF/Shield, Azure Front Door, Cloudflare, ModSecurity (Open Source) |
| Egress Control | Governs what internal systems may reach outbound, constraining both data exfiltration and command-and-control traffic. | Managed NAT with FQDN allow-listing, forward proxies, SASE/SWG |
| Private Connectivity | Keeps traffic between systems off the public internet entirely. | AWS PrivateLink, Azure Private Endpoint, GCP Private Service Connect |
| Operational Technology Isolation | Separates industrial and building-control networks, which frequently cannot be patched or authenticated conventionally. | Purdue-model zoning, unidirectional gateways, OT-aware firewalls |
4. Application & API Layer
Secures what the organisation builds and exposes. Split between assurance activities before deployment and protection at runtime.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Static Analysis (SAST) | Inspects source code without running it, finding injection flaws, unsafe patterns and hardcoded secrets during development. | Semgrep, SonarQube, CodeQL, Checkmarx |
| Software Composition Analysis (SCA) | Identifies third-party and transitive dependencies and their known vulnerabilities. Produces the component inventory an SBOM is built from. | Dependabot, Snyk, Trivy, OWASP Dependency-Check |
| Dynamic Analysis (DAST) | Exercises a running application to find issues only visible at runtime — authentication defects, misconfiguration, broken access control. | OWASP ZAP, Burp Suite, Invicti |
| Secrets Management | Stores, issues, rotates and audits credentials so they never live in source, configuration or images. | HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, SOPS |
| Container & Image Assurance | Scans images for vulnerable packages and blocks non-compliant or unsigned artefacts at deployment. | Trivy, Grype, Sigstore/Cosign, OPA Gatekeeper, Kyverno |
| API Threat Protection | Applies schema validation, authentication, rate limiting and abuse detection at the API edge, addressing the OWASP API risks. | API gateways, Salt Security, 42Crunch, Kong plugins |
| Runtime Application Protection | Detects and blocks exploitation of a running workload, including behaviour never seen in testing. | Falco (Open Source), Sysdig, Aqua, cloud workload protection platforms |
5. Data Protection Layer
Protects the data itself, so that a control failure elsewhere does not automatically become a disclosure.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Classification & Discovery | Finds sensitive data and labels it, producing the metadata every other data control depends on. | Microsoft Purview, AWS Macie, Google Cloud DLP, BigID |
| Encryption & Key Management | Encrypts data at rest and in transit, and governs the keys — including customer-managed and hold-your-own-key arrangements. | AWS KMS, Azure Key Vault, Google Cloud KMS, HashiCorp Vault Transit |
| Masking & Tokenisation | Substitutes sensitive values with masked or surrogate equivalents. Masking is a presentation control applied at query time; tokenisation replaces the value at rest. | Snowflake dynamic masking, Protegrity, Thales CipherTrust, Vault Transform |
| Data Loss Prevention | Inspects data in motion and at rest for policy violations and blocks or quarantines egress. | Purview DLP, Symantec DLP, Google Workspace DLP |
| Rights & Access Governance | Reviews and certifies who holds access to which data over time, closing the gap between access granted and access still warranted. | SailPoint, Saviynt, Entra Access Reviews |
| Content & Malware Inspection | Scans files entering the organisation — uploads, attachments, partner transfers — before they reach a trusted store. | ClamAV (Open Source), cloud malware scanning services, CDR/sanitisation tooling |
6. Cloud Platform Layer
Secures the control plane of the cloud itself. Most cloud incidents originate in configuration rather than in exploitation of a vulnerability.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Posture Management (CSPM) | Continuously evaluates cloud configuration against benchmarks and flags drift and exposure. | Wiz, Prisma Cloud, AWS Security Hub, Microsoft Defender for Cloud |
| Cloud Entitlement Management (CIEM) | Analyses effective cloud permissions — usually far broader than intended — and drives them toward least privilege. | Wiz CIEM, Entra Permissions Management, AWS IAM Access Analyzer |
| Infrastructure-as-Code Assurance | Evaluates infrastructure definitions before provisioning, so misconfiguration is prevented rather than detected. | Checkov, tfsec, Terrascan, OPA/Conftest |
| Secure Landing Zone | Provides accounts, networks and guardrails that are compliant by default, so teams inherit controls rather than implementing them. | AWS Control Tower, Azure Landing Zones, GCP Organization Policy |
| Workload Protection (CWPP) | Protects running compute — VMs, containers, serverless — with vulnerability and runtime threat detection. | Wiz, Aqua, Sysdig, Defender for Cloud |
7. AI & Autonomous Agents Layer
Secures AI systems and the agents acting on their output. The newest layer and the least settled — the threat model differs from conventional application security because the input itself can carry instructions.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Model & Use-Case Approval | Governs which models may be used for what, with review proportionate to the risk of the use case. | AI registries, model cards, internal AI review boards |
| Prompt & Content Filtering | Inspects inputs and outputs for injection attempts, sensitive data disclosure and unsafe content. | Azure AI Content Safety, AWS Bedrock Guardrails, Llama Guard, Rebuff |
| Retrieval Access Control | Ensures retrieval-augmented systems only surface content the requesting user is entitled to see — the most common way an AI feature leaks data. | Per-user vector filtering, document ACL propagation, entitlement-aware retrieval |
| Agent Containment | Bounds what an autonomous agent may do: tool allow-lists, spend and action limits, human approval for consequential steps. | Tool scoping, sandboxed execution, human-in-the-loop gates |
| AI Supply Chain Assurance | Verifies provenance of models, weights and datasets, treating them as dependencies with the same scrutiny as libraries. | Model signing, Hugging Face scanning, dataset provenance records |
| AI Observability & Audit | Records prompts, retrieved context, tool invocations and outputs so behaviour can be investigated after the fact. | LLM tracing platforms, prompt/response logging with retention policy |
Cross-Cutting Layers
These span every layer above. The first three establish the conditions under which controls are chosen; the last two operate them once systems are live.
Governance, Risk & Compliance
Establishes what the organisation is trying to achieve, what it is prepared to tolerate, and how it demonstrates both.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Policy & Standards | The documented rules control decisions are judged against, and the exception process for departing from them deliberately rather than silently. | ISO 27001 ISMS, internal standards, policy-as-code |
| Risk Management | Identifies, quantifies and tracks risk so investment follows evidence rather than intuition. | FAIR, risk registers, Archer, ServiceNow IRM |
| Control Catalogue & Framework Mapping | Maps implemented controls to the frameworks the organisation is measured against, so one control satisfies many obligations. | NIST CSF 2.0, ISO 27001 Annex A, CIS Controls, SCF |
| Compliance Evidence & Audit Readiness | Collects proof continuously rather than assembling it under audit pressure. | Vanta, Drata, ServiceNow GRC, Audit Manager |
People & Insider Risk
Addresses the fact that most incidents involve a person — through error, coercion or intent — rather than a purely technical failure.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Security Awareness & Phishing Simulation | Builds and measures the ability to recognise social engineering. | KnowBe4, Proofpoint, Hoxhunt |
| Insider Risk Detection | Correlates behavioural signals to surface misuse of legitimate access, which no perimeter control will catch. | Purview Insider Risk, DTEX, UEBA within SIEM |
| Joiner–Mover–Leaver Automation | Ensures access is granted, adjusted and — critically — removed as people move, rather than accumulating. | HR-driven provisioning, SCIM, IGA platforms |
| Collaboration & Sharing Controls | Governs external sharing in the tools people actually work in. | Purview, Google Workspace DLP, Slack/Teams governance |
Supply Chain & Third-Party Risk
Extends assurance to software and organisations outside the boundary, which increasingly carry the same access as employees.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Vendor Assessment & Tiering | Assesses suppliers proportionate to the access and data they hold, and re-assesses as that changes. | SIG questionnaires, SecurityScorecard, Panorays |
| Software Bill of Materials (SBOM) | Maintains a component inventory for what is built and consumed, so exposure to a new vulnerability is a query rather than an investigation. | CycloneDX, SPDX, Syft, Dependency-Track |
| Build Provenance & Artefact Signing | Proves an artefact was built from the expected source by the expected pipeline. | SLSA, Sigstore/Cosign, in-toto, GitHub Artifact Attestations |
| Third-Party Access Control | Grants partners and contractors time-bounded, scoped access rather than standing credentials. | Just-in-time access, vendor PAM, federated B2B identity |
Detection & Security Operations
Assumes prevention will sometimes fail, and shortens the time between that happening and someone knowing.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Log Ingestion & SIEM | Centralises security-relevant telemetry and correlates it into detections. Architecturally an ingestion pipeline with a security purpose. | Splunk, Microsoft Sentinel, Elastic Security, Chronicle |
| Detection Engineering | Treats detections as versioned, tested code mapped to adversary behaviour rather than as tuning done in a console. | Sigma rules, MITRE ATT&CK mapping, detection-as-code pipelines |
| Threat Intelligence | Supplies external context on adversaries and indicators, feeding both detection and the Policy Engine. | MISP (Open Source), Recorded Future, Mandiant |
| Vulnerability & Exposure Management | Finds, prioritises and tracks remediation of weaknesses by real exploitability rather than raw severity. | Tenable, Qualys, Wiz, CISA KEV, EPSS scoring |
| Control Validation | Tests whether controls actually work, rather than assuming deployment equals effectiveness. | Breach-and-attack simulation, purple teaming, Atomic Red Team |
| Tamper-Evident Audit Trail | Records security-relevant actions in a form that resists alteration, including by administrators. | Write-once storage, cloud audit logs with object-lock, append-only ledgers |
Response, Continuity & Recovery
Limits damage once something has happened, and restores service afterwards.
| COMPONENT | DESCRIPTION | EXAMPLES |
|---|---|---|
| Incident Response | Defined playbooks, roles and authority to act — decided in advance, not during the incident. | IR runbooks, PagerDuty, Jira Service Management |
| Response Automation (SOAR) | Executes containment steps at machine speed: isolate host, revoke session, block indicator. | Splunk SOAR, Tines, Torq, Sentinel playbooks |
| Crisis Communication | Coordinates legal, regulatory and customer communication under statutory notification deadlines. | Notification templates, breach-counsel retainers, status pages |
| Immutable Backup | Maintains restore points that ransomware cannot encrypt or delete, including from a compromised admin account. | Object-lock backups, air-gapped copies, Veeam, AWS Backup Vault Lock |
| Recovery Assurance | Proves recovery works by testing it, rather than discovering the gap during an incident. | Restore testing, DR exercises, documented RTO/RPO tiers |
| Post-Incident Learning | Converts incidents into control improvements through blameless review. | Blameless postmortems, corrective action tracking |
From Architecture to Patterns
This reference architecture names the capabilities; the pattern library shows how they are built. Dedicated security patterns — authentication and authorisation flows, secrets handling, workload identity, vulnerability management and more — are in development and will be linked from here as they are published.
Several existing patterns already implement components described above:
| COMPONENT | PATTERN | WHAT IT SHOWS |
|---|---|---|
| Masking & Tokenisation | Dynamic Data Masking | Obscuring sensitive columns at query time based on the caller's role |
| Retrieval Access Control | Retrieval-Augmented Generation | Filtering retrieved content by the requesting user's document permissions |
| Tamper-Evident Audit Trail | Archived Storage | Retention locks and an immutable record of every transition and restore |
| Content & Malware Inspection | External File Transfer | Scanning inbound partner files before they reach a trusted store |
| Edge Protection & API Threat Protection | External API Integration | A web application firewall and OAuth 2.0 or mTLS in front of an API gateway |
| Private Connectivity | Internal API Integration | Private endpoints that keep service-to-service calls off the public internet |