Every defender protects some combination of these ten surfaces. The center of gravity has shifted: where the perimeter used to be the organizing frame, today it's identity — almost every other surface routes through it. Read this as a map of where threats land, not a vendor roster.
Accounts, credentials, privilege, machine and non-human identities — the control plane the rest of the surfaces increasingly route through.
Workstations, servers, mobile devices — the historical center of detection-and-response.
IaaS/PaaS workloads, configurations, containers, Kubernetes clusters, serverless functions.
Business apps (Workday, Salesforce, Google Workspace), OAuth grants between them, shadow SaaS the company doesn't know it has.
Custom-built applications, public and internal APIs, source code repositories, build pipelines.
Sensitive structured and unstructured data across cloud, SaaS, endpoints — and increasingly, data being ingested by AI/agent systems.
Perimeter, internal segments, remote-access paths.
Vendor relationships, software dependencies, SBOM contents, build artifacts from upstream.
Industrial control systems, connected devices, building automation, medical devices.
Deployed models, agent permissions, prompts, training and inference data, integrations between LLMs and enterprise systems.