Building a pre-emptive security architecture — what is it and how can your business adopt one?

Dealing with shifting sands is par for the course for cybersecurity practitioners, but what's happening now is different. Indeed, it’s more of a sea change that upends conventional wisdom and business-as-usual approaches to safeguarding an organization. The impact of AI in cybersecurity changes not just the nature of the threats and attack modalities but also adds new challenges, such as dealing with massive spikes in volume.

These challenges are why many across the cybersecurity industry see value in building and propagating a pre-emptive cybersecurity architecture that deviates from a conventionally static and reactive approach. After all, getting ahead of any threat is better than letting it fester – responding only when the damage has taken place. Such an approach may seem like common sense, so why hasn't this notion become more widespread among practitioners?

What is pre-emptive security – and how does it differ from conventional cybersecurity models?

The traditional detect and respond cybersecurity framework has served businesses well for as long as they've tapped into cyberspace. But changes primarily driven by AI are exposing frailties in this model. For example, recent Crowdstrike research shows a plunge to just 29 minutes for the time it takes for an attacker to move from initial compromise to laterally breaking out to other systems. Garner, meanwhile, forecasts there will be a 300% spike in the number of documented vulnerabilities between 2025 and 2030. There's also the question of practitioner burnout, with conventional frameworks relying on overworked humans to investigate security alerts raised after, not before, an intrusion has been detected – and shut off a threat as a matter of urgency.

So what's the alternative? "In simple terms, pre-emptive security architecture means putting security controls directly in the path of an attack so that the attack gets blocked, diverted or contained before any serious damage has happened," explains Mudita Khurana, staff security engineer at Airbnb and cybersecurity expert with a decade of experience in application security, security tooling, vulnerability management and AI security.

"The idea is more architectural than a particular security product or control (thus the word architecture in the term itself)," she continues, adding: "It is a way of connecting security controls across different layers (like users, applications, systems, data, etc.) so that even if one layer is compromised, the blast radius remains limited because of other existing controls."

This is an environment in which attacks are far more likely to "fail on contact" or never really get a grip on systems, Steven Coppola, security engineer at BARR Advisory, tells ITPro. That is, instead of an architecture that relies on somebody noticing the attack while it's happening.

"I love analogies — for pre-emptive security architectures, I use a house," he says. "Detect and respond is akin to a good alarm and a fast call to the police department. A pre-emptive strategy is thinking ahead about where the doors will go, what they are made of, and whether the valuables need to be in the house at all."

What does pre-emptive security entail?

Framing pre-emptive security as a list of components or a single blueprint misses the mark, experts tell ITPro. Nor is this architecture a product that you can buy. Gartner's managing vice president Carl Manion distilled the trend into three elements, including 'deceive', 'disrupt', and 'deny' – and also warned product leaders that they may face losses in market share if they fail to embrace this security architecture in the services they provide to organizations.

His first thesis is to deny hackers entry with a preemptive shield, including advanced obfuscation technologies. Next, organizations should deceive bad actors using decoys, misdirection, and illusion to throw them off the scent. Finally, organizations should anticipate emerging threats and prepare to disrupt these rather than waiting for the attack to materialize and engaging in damage control after the fact.

"I believe that there are many other security controls that can support these three areas that Gartner has set out," adds Khurana.

"For example, zero trust access controls and separation between systems can limit the reach of an attack. Secure development checks can prevent vulnerable code from being deployed in the first place, and encryption can protect stored data so even if someone steals files, they can't read them without the encryption key."

She also noted that confidential computing – in which data is processed inside a separate hardware-protected area with only approved code running within it – can add another layer of defense.

Coppola adds: "Confidential computing closes the gap in the middle, which is data in use. The workload runs inside a hardware-protected enclave — essentially a walled-off section of the processor—so the data stays encrypted even while it is being processed. Even the cloud provider or someone with admin rights on the host cannot read it."

Even if the attacker reaches the underlying server or cloud infrastructure, there is no immediate access to the data, which should be protected. However, it must also be combined with proper access controls and sufficient application security.

How can businesses implement pre-emptive security?

Chris Bailey, head of innovation at systems integrator Jigsaw24, tells ITPro that any plans to implement pre-emptive security should be shaped around a clear idea of what your organization is protecting, how sensitive the data is, and the internal policies.

"Start by identifying the data and systems you’re trying to protect. From there, map out where the vulnerabilities lie, how people access the environment, and what the worst-case scenario would look like," he advises. "Once that is clear, it is important to establish clear policies around access, roles and devices. Ask who genuinely needs access to a particular system or data, what they need to be able to do, and whether that access can be restricted further."

At this stage, Khurana explains that it's important first to understand how an attacker may reach the services or data sources, a process similar to threat modeling, and then where the attacks can be denied, deceived, or disrupted. "This is where the team takes the threats and paths from the previous activity and understands where the controls can sit. If a path is found [to be] unnecessary, it should be removed. For legitimate paths, the principle of least privilege should be adopted."

After putting controls into place, organizations should test them under realistic conditions to make sure they work well, she adds. This may involve penetration testing – which Bailey adds is important because it gives businesses the chance to identify weaknesses before an attacker does – as well as continuous auditing and monitoring.

Organizations should also carry out attack exercises to see if the controls set in place actually stop the intended attack path, and that, importantly, things can be quickly rolled back if the attacks disrupt important business processes.

It's also worth considering escalating the approach. If pre-emptive security works for one service, teams may feel more confident in applying this to more critical services.

While implementing a new approach to safeguarding your organization, it's also important to remember not to simply ditch or replace old techniques. Coppola tells ITPro that pre-emptive controls can make alerts more meaningful – but don't replace them. Then, when it comes to measuring attack paths, he says: "The question at the end of the quarter should be: what can an attacker with stolen credentials reach now versus 90 days ago? If the answer isn’t shrinking, the program in place is not working, no matter how many products were deployed."