Buying guides
Security stack guide
Layering defences without overspending: what each control actually stops, and which ones to buy first.
Published
June 17, 2026
Topic
Buying guides
Talk it through
Bring us the requirement and we will price it.
Security products are sold as a stack, but they do not all carry the same risk reduction. Some controls stop the incidents that happen most often; others protect against rarer events and cost considerably more. This guide sets out what each layer does and suggests the order to buy them in when the budget arrives in stages.
What each layer stops
- Multi factor authentication: the majority of account takeover attempts, which is why it comes first
- Email filtering: phishing, malicious attachments and links, which remain the most common entry route
- Endpoint protection: malware and ransomware executing on a device
- Full disk encryption: the consequences of a lost or stolen laptop
- Firewall with documented rules: unwanted inbound access and uncontrolled outbound traffic
- Backup with an offline copy: the financial damage of ransomware after it has executed
- Patch management: the known vulnerabilities that attackers scan for
A sensible buying order
If you are building the stack over time rather than all at once, this order reflects both risk reduction and cost. The first three items are inexpensive relative to what they prevent.
- Multi factor authentication on email, remote access and administrative accounts
- Email filtering in front of every mailbox
- Endpoint protection and device encryption on the machines that leave the building
- Backup with a tested restore and at least one offline copy
- Documented firewall rules and network segmentation for payment or clinical systems
- Patch and vulnerability management on a defined schedule
Buy the foundation before the advanced tooling. An endpoint detection platform on top of an estate without multi factor authentication is spending in the wrong order.
Where the money is wasted
- Overlapping endpoint products on the same devices, which slow machines down and confuse response
- A backup appliance with no tested restore, which provides confidence rather than recovery
- Licences bought for services that were never deployed, quietly renewing each year
- Perimeter hardware protecting an environment where every user already has remote access