Claude Mandy is the Chief Evangelist at Zscaler and a former Gartner analyst and former CISO.gettyThis series tracks what happens when cybersecurity takes a useful technical term and runs it through the marketing machine. Defense in depth is different from data lineage or AI-native—it didn't start as a buzzword. It earned its credibility over decades of genuine security practices, which is exactly what makes it dangerous to misapply and what makes it so attractive to vendors who want to borrow that credibility for AI stacks that don't hold up to the math.The core idea behind defense in depth is sound: layer multiple independent controls so that the failure of any single one doesn't compromise the whole. It has roots in military strategy, codified for cybersecurity in the early 2000s by NSA guidance. A firewall fails, but the IDS catches it. The IDS misses something, but network segmentation contains it. When vendors applied this to AI security, the logic seemed to transfer. It doesn't. The original framework rests on an assumption that breaks almost immediately in the AI context.Why The Math Only Works With Orthogonal ControlsTraditional defense in depth works because its layers are orthogonal and largely deterministic. A firewall either blocks a packet or it doesn't. Stack deterministic orthogonal controls and the math is straightforward: if each layer has a 1% failure rate and failures are independent, your combined failure rate drops to fractions of a percent.AI controls don't work this way. The problem shows up in two distinct places.The first is common cause failure. Two AI-powered controls built from similar training data share a definition of what attacks look like. Anything outside that definition defeats both. Stack as many layers as you like—if they learned from the same data, they have the same blind spot. Two 96% controls with a shared blind spot don't give you 99.8%. They give you 96%. The math looks like defense in depth. It isn't.The second is that orthogonality between control design doesn't guarantee orthogonality under attack. When every layer in your stack is AI-powered, the attacker doesn't need to evade your controls, but simply evade AI. A prompt injection attack embedded in a document doesn't need to defeat each control in sequence. It just needs to craft an instruction the agent follows while every monitoring layer treats it as benign. The controls are different products. The target is the same model class. One payload, every layer.Neither problem is an engineering flaw. The first is structural—broad generalization from shared training data produces shared boundaries, and two controls capable for the same reason tend to fail for the same reason. The second is adversarial—when every layer is AI-powered, attacking one is effectively attacking all. Versatility and orthogonality pull in opposite directions. So do defense in depth and an all-AI-powered stack.Why The Vendor Stack Fails The Independence TestHere's the irony. The reason every layer ends up AI-powered is actually a good one: rules-based controls miss too much. Threats are themselves becoming AI-powered, and as a result are too subtle, too contextual for signatures to keep up. So each layer gets a model. The logic at each layer is defensible. The cumulative result isn't. Shared training data means shared blind spots, and an attacker who targets the model class defeats the stack in one move. Same boundary, every product name on the slide.Agentic architectures make this worse in a way architecture diagrams don't show. Controls in an agentic stack don't evaluate independently—they pass context forward. Each layer's classification becomes the next layer's prior. A misclassification early in the chain doesn't get caught downstream. It gets inherited, reinforced, until the final control endorses the input as benign. That's not a second opinion, but an echo chamber.Human oversight was always the backstop. Agentic architectures can eliminate it entirely. By the time a human sees anything, the agent has decided, executed and logged. The math problems don't get worse in agentic systems. They just become unrecoverable.What The Math Actually DemandsNone of this is an argument against AI-powered security controls. It's an argument against assuming that stacking them produces the independence defense in depth requires. For most CISOs, the question isn't how to build it right from scratch anyway. They are struggling with how to evaluate what's already running. Three requirements apply either way:Can You Prove Your Controls Aren't Correlated?Treat AI-powered controls as a correlated system, not independent layers. Test them together—deliberately try to break each control with inputs that broke the others. If the same adversarial inputs defeat multiple layers, those layers are redundant. Ask your vendor for red team results showing which inputs defeated multiple layers. No results means the independence claim is untested.Do You Know What Each Control Actually Fails On?AI-powered controls generalize from training data, so their failure boundaries are probabilistic and often undocumented. Ask for a documented failure boundary—specifically, the categories of input each control was not trained to catch. "It generalizes broadly" is a capability claim, not a failure analysis.Where Does Human Judgment Actually Sit?Draw the architecture with human intervention points marked explicitly. Not where the diagram suggests they sit, but where they actually sit relative to consequential decisions. If intervention can only happen after the agent has acted, the oversight is retrospective. That's logging, not control.Making The Math Actually MathCybersecurity has always borrowed frameworks before finishing the translation. Defense in depth took years to mean something precise after crossing from military doctrine—people had to map where the analogy held and where it broke. That work hasn't been done for AI yet, and the hype cycle isn't waiting.The buzzword is fine. The math isn't. The organizations that treat independence as something to be proven—not assumed—will build something the framework actually describes. The rest will count layers and call it done.Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?