Introduction

In the security environment, the effectiveness of operations is measured not only by what risks are controlled, but how controls interact to prevent, identify, and respond to threats. One of the most widely applied strategic approaches is the Detect, Deter, Delay, Deny, Defend, and Defeat methodology.

Aligned with the principles of ISO 18788:2015 (Security Operations Management Systems) and ISO 31000:2018 (Risk Management), this methodology ensures that controls are not just implemented in isolation but are layered systematically to manage risks across the threat lifecycle.

The Six Layers of Security Methodology

1. Detect

Purpose: Identify the presence of a threat as early as possible.

Examples: CCTV systems, intrusion detection, patrols, alarm sensors, access logs.

Role in Risk Treatment: Early detection reduces the risk of surprise and allows swift escalation.

Key ICE Measurement: How consistently are threats detected, how quickly, and how reliable is the detection system?

2. Deter

Purpose: Discourage adversaries from attempting an attack by demonstrating that success is unlikely or costly.

Examples: Visible patrols, signage, perimeter fencing, lighting, uniformed guards, body-worn cameras.

Role in Risk Treatment: Acts as a psychological barrier—making the target appear “hard.”

Key ICE Measurement: How often does visibility of deterrence reduce attempted intrusions or incidents?

3. Delay

Purpose: Slow down adversaries to allow time for a response to be mounted.

Examples: Physical barriers, access control doors, turnstiles, safes, layered perimeters.

Role in Risk Treatment: Extends the window for response after detection but before a breach occurs.

Key ICE Measurement: How much time does the delay provide, and is this sufficient to enable a security intervention?

4. Deny

Purpose: Prevent unauthorized access or actions outright.

Examples: Secure locking systems, biometric access, strong password protocols, armed response procedures.

Role in Risk Treatment: Stops the adversary from achieving their objective.

Key ICE Measurement: How often are unauthorized access attempts successfully blocked?

5. Defend

Purpose: Actively respond to a threat once it has materialized.

Examples: Intervention by security personnel, cyber incident response teams, coordinated law enforcement engagement.

Role in Risk Treatment: Ensures that once a threat is engaged, it is neutralized with minimal impact.

Key ICE Measurement: Speed and effectiveness of response, proportionality, and alignment with human rights and rules of engagement.

6. Defeat

Purpose: Neutralize the threat completely, ensuring it cannot reoccur in the same form.

Examples: Arrest and prosecution of offenders, dismantling of organized crime networks, corrective security redesigns.

Role in Risk Treatment: Ensures long-term reduction of threat through removal or disruption.

Key ICE Measurement: Evidence of successful neutralization and prevention of repeat incidents.

Linking to Risk Treatment Methodology

This layered methodology aligns seamlessly with ISO 18788 Clause 6.1 (Risks and Opportunities) and risk treatment options in ISO 31000:

• Detect & Deter → Preventive and Detective controls.
• Delay & Deny → Preventive and Corrective controls.
• Defend & Defeat → Corrective and Recovery-oriented controls.

Each stage ensures that risks are not only identified but treated with a balanced combination of preventive, detective, and corrective strategies.

Why the Methodology Matters

1. Layered Defence - No single control is foolproof; layered measures reinforce resilience.
2. Cost-Effectiveness - Encourages smarter investments: not just buying “super locks” but combining them with detection, deterrence, and response measures.
3. Measurable Assurance - Using Internal Control Effectiveness (ICE), each layer can be assessed for actual performance vs. perception.
4. Combined Assurance Mapping - Each stage (detect through defeat) can be tested and assured by different lines of defence (management, compliance, audit, external oversight).
5. Human Rights Integration - Especially in “Defend” and “Defeat,” actions must remain lawful, proportional, and respectful of human rights.

Conclusion

The Detect, Deter, Delay, Deny, Defend, and Defeat methodology provides a structured, layered approach to security risk management. Unlike vendor-driven solutions that sell one expensive product without context, this methodology ensures that every control is implemented strategically, measured for effectiveness, and aligned with the organization's risk treatment methodology.

By combining this model with ICE scoring and Combined Assurance frameworks, organizations move beyond reactive or fear-based approaches (like FUD) to a professional, auditable, and internationally aligned system of security assurance.