Guided reading
Start here
Drawn2Security is a growing library. If you are new, this sequence gives you the most useful foundation.
These twenty ideas are not the whole library. They are the ideas that make the rest easier to understand. Work through them in order, or jump to whatever is most relevant right now.
12 of 20 ideas published
The remaining ideas are in progress. This page updates as new sketches are published.
What security is actually trying to protect
Confidentiality, integrity and availability. Three words that explain most of what security is for.
Risk is not the same as severity
Severity tells you how bad a vulnerability is in theory. Risk asks what it means for you.
Defence in depth
The principle behind layered security. No single control should be the last line of defence.
Least privilege
Give people and systems only what they need. Nothing more.
Identity is the new perimeter
When work happens everywhere, the network edge is no longer the security boundary.
Why MFA is not all the same
All MFA is better than none. Some MFA is much better than others.
What zero trust actually means
Zero trust is not a product. It is an architectural principle.
Shared responsibility in cloud
Moving to cloud does not transfer your security responsibilities. It redistributes them.
Why cloud security is mostly an identity problem
In cloud environments, identity and configuration often define the boundary.
What an attack surface really is
You cannot protect what you cannot see. Attack surface is everything an attacker might reach.
Why vulnerabilities are not equally important
Sorting by CVSS score alone is not risk-based prioritisation.
What lateral movement means
Getting in is often the easy part. Lateral movement is how attackers get to what they actually want.
What blast radius means
You cannot always prevent the explosion. You can limit how far it reaches.
Detection versus prevention
Prevention is valuable. Detection is essential. Both have limits.
Why backups must be tested
An untested backup is a hope, not a recovery plan.
What secure by design means
Security bolted on afterwards is fragile and expensive. Security designed in from the start is structural.
What prompt injection means
When AI processes untrusted content, that content can become an instruction.
Why AI agents change the security model
The security model changes when AI can act, not just answer.
Software supply chain risk
The code you did not write can still compromise you.
One mistake should not be enough
People make predictable mistakes. Good security limits what happens next.
What next?
Ready to explore further?
Once you have worked through the foundation, browse by category or use search to follow whatever interests you most.