Layered Defense: Security Standard Maturity Simulator

Maturity Tier Presets

Control Coverage

Protect layer 70%

Detect layer 60%

Respond layer 55%

Correlated control failure (shared blind spot bypasses all layers)

Live Risk Readout

Breach probability

0.0%

Maturity tier

Repeatable

Annualized loss expectancy (ALE)

Attempts

Breaches

How it works

Frameworks like NIST CSF, ISO/IEC 27001, CIS Controls and OWASP ASVS all describe security as layered functions rather than one wall. Here three layers — Protect, Detect, Respond — sit between the outside world and a "crown jewel" core asset. Each layer has a coverage c (0–1): the fraction of attack attempts it independently stops.

Independent layers:
  P(breach) = (1-c_protect) * (1-c_detect) * (1-c_respond)

Correlated layers (toggle on):
  a shared blind spot (e.g. one vendor stack, one
  assumption) bypasses ALL layers with fixed share s=15%:
  P(breach) = s + (1-s) * (1-c_protect)(1-c_detect)(1-c_respond)

ALE = P(breach) * attacks/year * asset value

Tier presets — set all three coverages at once to the band NIST CSF assigns each maturity tier: Partial (~25%), Risk Informed (~50%), Repeatable (~75%), Adaptive (~95%).
Sliders — tune each control family independently; particles are simulated attack attempts spawning outside the Protect shell and travelling inward.
Correlated toggle — demonstrates why NIST and CIS both stress *independent, diverse* controls: stacking three correlated controls (same vendor, same blind spot) reduces risk far less than three genuinely independent ones, even at identical coverage numbers.
Particles that are stopped flash the color of the layer that caught them; particles that reach the gold core count as a breach.

Protect Detect Respond Crown jewel (breach)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.