Field guide

The Map of Modern Information Security

Eleven domains, one field. Each branch below is a discipline you can build a career in; together they form a single system that decides what to protect, builds it securely, defends it while it runs, and attacks it on purpose to check the work.

Core principles

These ideas run through every domain on the map. Learn them first, then look for them in each branch.

Confidentiality, integrity, availability
The three properties security exists to protect.
Threat, vulnerability, risk
Who could cause harm, what they could exploit, and what it would cost.
Least privilege
Give people and systems only the access a task needs.
Separation of duties
Require more than one party for sensitive actions.
Defense in depth
Layer controls so one failure doesn't decide the outcome.
Trust boundaries
Know where data crosses between trust levels, and check it there.
Secure by default
Make the safe configuration the one you get without trying.
Assume breach
Plan to detect, contain, and recover, because prevention eventually fails.

The full map

Foundations on the left: governance, architecture, identity, data, and cloud. On the right, the delivery lifecycle (building software, operating it, and adversarially testing it), then people, AI, and the moving edge. Hover a branch to focus on it.

The eleven domains of modern information security and their major sub-disciplines. DevSecOps sits inside the green branch, where application security meets the delivery pipeline.

How the domains interrelate

A mind map shows the taxonomy; this shows the machine. Security runs as a loop across three moments in time — decide, build, run — with offensive security stress-testing the last two and every outcome feeding back into the first. Regulators, suppliers, and attackers act on the loop from outside.

Regulators & law Suppliers & open source Attackers OUTSIDE THE LOOP DECIDE BUILD RUN VALIDATE Governance, Risk & Compliance risk appetite · policy · audit AI — governance Architecture & Engineering AppSec & DevSecOps Cloud — configured securely IAM — designed in Data protection — by design AI — contained by design Security Operations Cloud — monitored at runtime IAM — enforced at runtime Data protection — in production AI — agents monitored People & physical defense Recovery — backup & continuity Offensive Security AI — adversarial testing legal duties packages, appliances target developer tools exploits, stolen credentials policy, risk, requirements ships hardened, observable systems threat intel & exploited flaws set fix priority response duties, insurance scope & written authorization findings become fixes & regression tests red teams exercise detection & response findings incidents & metrics recalibrate risk
The lifecycle view. Solid arrows run inside the loop; dashed arrows come from outside it. Identity, data, cloud, and AI security cut across stages, appearing at both build time and run time. Emerging areas (OT, post-quantum, digital assets) enter the loop wherever the new technology lives.

The domains at a glance

One sentence each, enough to know which door you're walking through, plus what each domain feeds and what feeds it.

Governance, Risk & Compliance

Decides what must be protected, to what standard, and who is accountable, including what the law requires when something goes wrong.

Feeds: requirements, test scope, response duties
Fed by: regulators, incidents, findings, metrics

Architecture & Engineering

Makes security structural, from trust boundaries and cryptography to networks, edge devices, operating systems, and hardware.

Feeds: secure designs, build standards
Fed by: requirements, threat intel

Identity & Access Management

Controls who — and what — can do which actions where; the foundation that zero trust is built on.

Feeds: access decisions in every domain
Fed by: access policy, audit findings

Data Security & Privacy

Follows the data itself: classifying, encrypting, and governing it wherever it lives or moves.

Feeds: protection requirements, recovery capability
Fed by: privacy rules, risk decisions

Cloud Security

Secures what you run on someone else's infrastructure: identities, workloads, and configuration.

Feeds: hardened platforms, runtime telemetry
Fed by: architecture standards, access policy

AppSec & DevSecOps

Secures the software you build and the tools you build it with, so the secure path is the default path.

Feeds: hardened releases, software inventories
Fed by: requirements, supplier code, offensive findings

Security Operations

Keeps running systems defended by knowing what you have, patching what's exposed, and responding to what gets through.

Feeds: fix priorities, risk metrics, incident lessons
Fed by: telemetry, threat intel, offensive findings

Offensive Security

Attacks your own systems on purpose to prove whether the defenses actually hold.

Feeds: fixes, regression tests, detection tuning
Fed by: test scope, written authorization, threat intel

Human & Physical Security

Covers the layer software can't: people, buildings, and the social engineering that targets both.

Feeds: phishing reports, insider risk signals
Fed by: awareness policy, threat intel

AI Security

Protects AI systems and agents from manipulation and escape, and tracks how attackers use AI themselves.

Feeds: agent containment rules, AI risk findings
Fed by: AI governance, model suppliers, attacker techniques

Emerging & Frontier

The moving edge — industrial control networks, digital assets, and the coming post-quantum transition.

Feeds: new requirements for every domain
Fed by: new technology, research, regulators