By Gary Miliefsky

Cybersecurity has a complexity problem.

We have thousands of vendors, countless product categories, overlapping platforms, endless acronyms, rapidly changing attack techniques, and a growing number of frameworks telling organizations what they should be doing.

For a CISO, that complexity can become its own risk.

Security teams are often forced to manage dozens of tools across cloud, endpoints, identities, applications, networks, data, code, and infrastructure. Boards hear terms such as Zero Trust, XDR, CNAPP, SASE, DSPM, ASM, IAM, PAM, EDR, MDR, SIEM, SOAR, SBOM, and now AI security, agentic security, and post-quantum cryptography.

All of those technologies may have value.

But there is a more fundamental question:

What exactly are we trying to protect?

That question led me to a simple cybersecurity model I call PANCCD.

PANCCD stands for:

People. Applications. Networking. Computing. Code. Data.

Six areas.

Nearly every meaningful cybersecurity problem can be mapped back to one or more of them.

And almost every security control can be evaluated by asking how well it protects them.

That simplicity is the point.

Cybersecurity Does Not Have to Begin With Technology

Organizations often build cybersecurity backward.

They start with products.

They buy a firewall.

Then endpoint security.

Then identity management.

Then vulnerability scanning.

Then cloud security.

Then another dashboard to manage the other dashboards.

Eventually the organization has an impressive security architecture diagram that very few people can fully explain.

PANCCD starts somewhere else.

It starts with the enterprise itself.

Who uses the environment?

What applications run the business?

How are systems connected?

Where does computing occur?

What software and code make everything operate?

Where is the valuable information?

Those questions lead directly to the six PANCCD domains.

P: People

People remain one of the largest cybersecurity attack surfaces.

Employees, contractors, administrators, executives, partners, suppliers, customers, and privileged users all interact with systems and information.

Attackers know that compromising a person can often be easier than compromising technology.

That is why phishing, business email compromise, credential theft, social engineering, MFA fatigue, deepfakes, insider threats, and identity attacks continue to succeed.

Protecting the People layer therefore includes areas such as:

• Identity and access management
• Privileged access
• Authentication
• Security awareness
• Behavioral analytics
• Phishing protection
• Insider-risk management
• Social-engineering resistance
• Least privilege

The question is simple:

Can we trust the person requesting access, and should that person have access right now?

With AI-generated voices, synthetic identities, and deepfake video becoming more convincing, answering that question will become increasingly difficult.

A: Applications

Applications are where much of modern business actually happens.

CRM platforms, financial systems, collaboration tools, SaaS applications, mobile apps, cloud applications, customer portals, operational systems, and internally developed software all represent potential attack surfaces.

An application may be perfectly functional while still being dangerously insecure.

The Applications layer includes:

• Application security
• SaaS security
• API security
• Web application protection
• Authentication
• Configuration management
• Application vulnerability management
• Runtime protection
• Cloud application controls

The important question becomes:

Can this application be exploited, manipulated, misconfigured, or abused?

As organizations increasingly depend upon APIs and AI agents, application boundaries will become even more fluid.

N: Networking

Everything connected to something else creates opportunity for both business and attackers.

Networking includes the infrastructure allowing people, systems, applications, devices, clouds, workloads, and data to communicate.

That includes:

• Internal networks
• Internet connectivity
• Wi-Fi
• VPNs
• Cloud networks
• Software-defined networks
• 5G
• IoT
• OT environments
• Remote access
• Network segmentation

Security controls in this domain include firewalls, intrusion detection, network detection and response, Zero Trust network access, segmentation, secure access service edge technologies, encryption, and traffic analytics.

The fundamental question is:

Who or what is communicating with whom, and should that communication be happening?

A well-designed network architecture can prevent an initial compromise from becoming an enterprise-wide disaster.

C: Computing

Computing is the machinery performing the work.

That once meant servers and desktops.

Today it includes:

• Laptops
• Servers
• Virtual machines
• Containers
• Cloud workloads
• Mobile devices
• Industrial systems
• Edge devices
• IoT equipment
• Kubernetes environments
• AI infrastructure

The Computing layer concerns the security, configuration, visibility, resilience, and integrity of these systems.

Controls may include:

• Endpoint detection and response
• Extended detection and response
• Workload protection
• Patch management
• Configuration management
• Device management
• Vulnerability management
• Container security
• Cloud workload security

The central question is:

Can we trust the system doing the computing?

If the device, workload, operating system, or infrastructure has been compromised, everything running on top of it becomes questionable.

C: Code

Code is one of the least visible but most important elements of cybersecurity.

Software powers almost everything.

But software is increasingly assembled from enormous ecosystems of proprietary code, open-source components, libraries, packages, containers, dependencies, APIs, scripts, and third-party services.

Weaknesses can be introduced intentionally or accidentally at almost any point.

The Code layer therefore includes:

• Secure software development
• Static analysis
• Dynamic analysis
• Software composition analysis
• Dependency management
• Supply chain security
• SBOMs
• Code signing
• Repository security
• Malware analysis
• DevSecOps

The core question is:

Can we trust the code before we allow it to execute?

That question becomes even more important as AI begins generating more of the world’s software.

Code can now be produced faster than humans can manually review it.

Security therefore has to move closer to the software itself.

D: Data

At the end of most cyberattacks is something attackers actually want.

Data.

Intellectual property.

Customer records.

Financial information.

Credentials.

Healthcare records.

Source code.

Trade secrets.

Government information.

Business plans.

Personal information.

Sometimes attackers steal it.

Sometimes they encrypt it.

Sometimes they manipulate it.

Sometimes they destroy it.

The Data layer includes:

• Data loss prevention
• Encryption
• Data classification
• Backup
• Recovery
• Database security
• Data access controls
• Data security posture management
• Ransomware protection
• Privacy controls

The question is:

Where is our important data, who can access it, and what happens if it is stolen, altered, encrypted, or destroyed?

If an organization cannot answer that clearly, it has a security problem regardless of how many cybersecurity products it owns.

The Power of Looking at All Six Together

The real value of PANCCD is not treating each category independently.

Attackers do not attack in neat product categories.

A single compromise may cross all six.

Imagine a phishing attack.

An attacker fools a Person into surrendering credentials.

Those credentials provide access to an Application.

The attacker moves through the Network.

They compromise a cloud Computing workload.

They exploit vulnerable Code.

Then they steal the organization’s Data.

That is one attack.

But it crosses the entire PANCCD model.

This is why cybersecurity must be viewed holistically.

The strongest firewall in the world will not save an organization if privileged credentials are compromised.

The best identity system may not stop vulnerable software.

Perfectly secure code cannot protect data if access controls are wrong.

Everything connects.

PANCCD as a CISO Decision Model

PANCCD can also help CISOs evaluate cybersecurity investments.

When someone proposes a new product, ask:

Which PANCCD layer does this protect?

Then ask:

What risk does it reduce?

Then:

Do we already have another control attempting to solve the same problem?

And finally:

Does this strengthen our overall security posture, or does it simply add another tool?

This can expose both gaps and redundancy.

For example, an organization might discover that it has seven products protecting Computing but very little visibility into Code.

Or enormous investment in Networking but poor controls around People.

Or sophisticated detection capabilities but inadequate Data recovery.

PANCCD turns an intimidating security architecture into something executives and boards can actually discuss.

Wrapping Intelligence Around PANCCD

Artificial intelligence has the potential to make the model even more powerful.

Imagine continuously observing all six domains:

People: Has user behavior changed?

Applications: Is an application suddenly behaving differently?

Networking: Is unexpected communication occurring?

Computing: Has a workload configuration changed?

Code: Has vulnerable or malicious code entered the environment?

Data: Is sensitive information being accessed unusually?

Instead of analyzing these events separately, AI can correlate them.

Perhaps an administrator logs in from an unusual location.

A sensitive application is accessed.

A server begins communicating with an unfamiliar external address.

A script is executed.

A database begins transferring unusually large amounts of information.

Individually, those events may appear insignificant.

Together, they tell a story.

That is where cybersecurity is heading.

Not simply more alerts.

More context.

Not simply more telemetry.

Better decisions.

Not simply more tools.

Continuous understanding of risk.

From Prevention to Resilience

PANCCD also provides a useful framework for resilience.

For every layer, an organization should ask two questions.

First:

How do we prevent compromise?

Then:

What happens when prevention fails?

For People, can stolen credentials be detected quickly?

For Applications, can compromised systems be isolated?

For Networking, can lateral movement be contained?

For Computing, can workloads be restored?

For Code, can malicious components be identified and replaced?

For Data, can critical information be recovered?

That second question is becoming increasingly important.

Cybersecurity cannot promise perfect prevention.

What it can provide is the ability to detect, contain, recover, and continue operating.

A Simple Language for the Board

Perhaps one of PANCCD’s greatest strengths is that it removes unnecessary technical language from conversations about cyber risk.

Instead of showing a board 147 controls and 36 cybersecurity technologies, a CISO can explain:

We protect our people.
We protect our applications.
We protect our networks.
We protect our computing environments.
We protect our code.
We protect our data.

Then the discussion becomes:

Where are we strongest?

Where are we weakest?

Where are attackers most likely to succeed?

Where would failure have the greatest impact?

Where should the next dollar be spent?

That is a cybersecurity conversation a board can understand.

Cybersecurity Simplified

The cybersecurity industry will continue becoming more complex.

Artificial intelligence will create new threats.

Quantum computing will challenge existing cryptography.

Cloud architectures will continue evolving.

Software supply chains will become larger.

Identity will become increasingly machine-based.

Autonomous agents will operate throughout enterprises.

There will always be another acronym.

Another product.

Another category.

Another threat.

But beneath all that complexity, we are still protecting the same fundamental things:

People.

Applications.

Networking.

Computing.

Code.

Data.

That is PANCCD.

Six simple areas that provide a way to understand an extraordinarily complicated cybersecurity world.

The model does not eliminate cybersecurity complexity.

It does something potentially more valuable.

It gives us a simple way to organize it.

And in cybersecurity, clarity may be one of the most powerful defenses we have.

Gary S. Miliefsky
Publisher, Cyber Defense Magazine
Cyber Defense Media Group