Customer data breach barriers

This data-breach bowtie makes the boundary between prevention and response explicit. It treats customer data as the hazard and unauthorised access as the top event. Credential theft and application weaknesses are separate threats because they need different controls. Detection, revocation and response sit on the consequence side because they limit harm after access has occurred. A security team can use the diagram to discuss whether every control has an owner, monitoring and a realistic response procedure. Replace the generic controls with the systems and requirements used by the organisation. This is a qualitative risk map, not a security assessment, compliance determination or incident-response runbook.