This is part 2 of 3 in a series of posts: The Missing Layer in Cybersecurity. Part 1 can be read here.
In 1912, the Titanic sank in less than three hours. The ship had watertight bulkheads designed to contain flooding before it could spread. The design seemed to make sense, but these bulkheads only extended partway up the hull, so water went over top and filled each adjacent compartment in sequence. The water was contained, yes…but the boundary was wrong.
That failure gets taught in engineering programs to this day, because it illustrated something every mature industry eventually learns: when a process is inherently dangerous, containing the consequences of failure matters as much as preventing it.
Has cybersecurity learned this lesson for infrastructure? Has it been implemented correctly?
Drawing Boundaries
Nuclear plants do not put administrative offices next to reactor cores. The containment structure around a reactor exists because the design assumes something could go wrong, and it gets built accordingly. The goal is to prevent a failure that occurs in one zone from propagating into everything adjacent to it.
Chemical manufacturers isolate hazardous processes from the rest of the facility for the same reason. The hazardous zone doesn’t disappear, workers still enter it, and protocols govern what happens inside it. The isolation exists so that a failure in that zone does not take down the broader facility.
Banks separate custody from control and keep physical assets in vaults, because combining those functions in the same person or location creates an unnecessary exposure. The separation is the control. It operates regardless of individual behavior.
Cloud infrastructure providers stake their entire business model on tenant isolation. The need to create a barrier so one customer’s compromised workload cannot reach another customer’s data. The technical boundary does not depend on each customer following good security practices; it must hold regardless.
Cybersecurity Draws a Line
Security teams also understand containment. Network segmentation, air-gapped systems, zero-trust architecture…the field has been applying containment principles to infrastructure for decades. The application of these principles has seemed to stop at systems and data. It has not extended to daily work.
Most organizations have built boundaries around networks, access paths, and data stores. They have not built boundaries around the activities that are inherently risky by nature. Malware analysis, threat hunting, dark web investigations, AI model evaluation, third-party software assessments, and fraud investigations. These activities require direct engagement with untrusted content, hostile environments, and code that cannot be fully trusted. They happen every week across security, fraud, and technology teams. And in most organizations, they happen from the same corporate environment used for everything else. The boundary between the dangerous zone and everything else is simply not there.
A Pattern Across Industries
Every industry that handles inherently dangerous processes went through a version of this scenario before it built the structural answer: governance policies then isolation/separation.
Chemical manufacturers had safety protocols before they had isolation systems. The protocols helped reduce incidents, but they did not prevent the accidents that eventually made the case for active separation. Financial institutions had compliance programs and audit procedures before they built vault infrastructure and formal duty separation. The programs were real. The structural controls came later and did what the programs alone could not do.
The pattern is that protocols manage the probability of failure. Structural separation manages the consequences. Organizations that only have the first are operating with half the risk model, and the half they are missing is the one that matters when something goes wrong. Governance and monitoring can tell you a failure occurred, help you investigate it, and hopefully, prevent the next one. A containment boundary limits how much damage the current failure does before you find out about it.
The industries that handle dangerous work figured this out decades ago. The cybersecurity industry has absorbed the principle for infrastructure. Now it’s time to apply the concept and best practices to the risky digital work itself.
