Short answer
When you strip away the vendor pitches, an enterprise security stack comes down to twelve categories. Most of them protect identity and endpoints: identity and access management, multifactor authentication, privileged access management, endpoint protection with detection and response, and antimalware. Then there's the firewall, data loss prevention and endpoint encryption, plus vulnerability management and threat intelligence to tell you what to fix and watch for. Backup and disaster recovery gets you back on your feet, and extended detection and response (XDR) or a SIEM lets you see across all of it.
Pretty much everything else you'll be pitched is a refinement of one of those twelve. I go through each one below with what it does, which NIST Cybersecurity Framework function it serves, and a link to the shortlist of products we rank in it, so it's useful if you're the one deciding what to buy first.
Browse the Full Cybersecurity Market. Every Category.
Every category on CybersecTools, from AI Security and Cloud Security to Threat Intelligence and Offensive Security. Filter by use case, industry, or company size.
What "essential" means here
I call a category essential when leaving it out opens a gap an attacker can use without any special skill. Every category below fails that test when it's missing. They're also listed in the order most companies should buy them, which is roughly the order attackers go after them: identity first, then endpoints, the network edge and data, and then the products that help you see and recover.
The NIST Cybersecurity Framework 2.0 splits security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. I've tagged each category with the function it mainly serves, because you need a mix. If you only buy Protect products you won't see what gets through, and if you only buy Detect products you'll drown in alerts with nothing to stop the attack.
1. Identity and access management (Protect)
Start with identity, because most attackers today log in with stolen credentials instead of breaking in. Identity and access management is your record of who exists, what they're allowed to do, and what changes when they join, move or leave. That covers the directory, the joiner and leaver automation, and role-based access.
If you mainly need the login layer, look at the access management category and our access management shortlist. The IAM shortlist covers the wider directory and governance products.
2. Multifactor authentication (Protect)
Multifactor authentication is the cheapest control you'll buy for what it gives back. Phishing-resistant methods such as passkeys and hardware keys stop the credential theft that starts most incidents, so the hard part isn't rolling out MFA. It's covering the accounts that can't take it, like service accounts, legacy applications and contractors.
You'll probably get MFA from your identity provider. A separate product only starts to matter when coverage has to reach VPNs, on-premises applications and devices, and the MFA and passwordless category lists those.
3. Privileged access management (Protect)
Even with MFA everywhere, the accounts that can change everything are where companies still get hurt. Those are domain admins, root, cloud owners and service accounts with high permissions, and privileged access management (PAM) is how you control them. It keeps the credentials in a vault, brokers and records the sessions, and hands out rights just in time, so nobody sits on admin rights they aren't using.
Compare products in the PAM category and on the PAM shortlist.
4. Endpoint protection, detection and response (Protect, Detect, Respond)
The endpoint is where the attacker usually lands, and you need two things there. Endpoint protection blocks known malware, while endpoint detection and response (EDR) records what happens on the machine, spots an intruder even when no malware is involved, and gives your analysts what they need to contain it. Modern products do both in one agent, and the data it collects feeds almost everything your SOC does.
Third-party test results help you narrow the field, but run your own attack simulations before you choose. The EDR shortlist and the endpoint security category are good places to start.
5. Antimalware (Protect)
Antimalware is the part of endpoint protection that matches files and behavior against known bad patterns and blocks them before they run. Every endpoint protection platform and most EDR agents include it, so few companies buy it on its own anymore. It's still on this list because a missing or unmanaged antimalware setup is still the most common finding in small and mid-size environments that rely on operating system defaults without central management.
See the endpoint protection platform category.
6. Firewall and network security (Protect, Detect)
The next-generation firewall is still the control at the network edge and between segments. It knows which applications are talking, it runs an intrusion prevention system, and more and more it's the policy engine that reaches cloud and remote users through SASE. If your company is spread across many sites, the firewall decision and the SASE decision are now the same decision.
See the next-generation firewall shortlist and the SASE shortlist. To control which devices may join the network at all, see network access control.
7. Data loss prevention (Protect)
Data loss prevention (DLP) finds sensitive data and stops it leaving through the channels people really use: email, web uploads, cloud storage, endpoints and now generative AI prompts. A modern DLP program starts with finding and labeling the data. Then it enforces one central policy across every channel instead of a different rule in each product.
See the data protection shortlist and the DLP category.
8. Endpoint encryption (Protect)
Endpoint encryption turns a lost or stolen laptop into a hardware loss instead of a data breach. Every major operating system has full-disk encryption built in, so what an enterprise needs on top is central key escrow, enforcement, and proof of encryption status for compliance reports. That usually comes from your device management platform rather than a separate product.
See the encryption category and mobile device management.
9. Vulnerability management (Identify)
Vulnerability management finds the weaknesses attackers use across servers, endpoints, cloud and applications, and ranks them by whether an attacker can actually reach them. The category has grown into exposure management, which also weighs internet exposure, active exploitation and the controls you already have. When it goes wrong, the problem is usually a backlog of findings nobody can work through.
See the vulnerability assessment category and the attack surface shortlist for the outside view.
Compare Enterprise Security solutions side by side
Features, integrations, NIST coverage and deployment for every Enterprise Security solution we list, in one table.
10. Threat intelligence (Identify, Detect)
Threat intelligence tells your detection products what to look for and tells leadership which threats apply to your company. It comes as feeds that plug into the SIEM and the firewall, and as platforms that manage indicators and reports. A real-time feed only helps if something reads it automatically, so make sure it's wired into the products that act on it.
See threat intelligence platforms and threat intel feeds.
11. Backup and disaster recovery (Recover)
Backup and disaster recovery is what turns ransomware from a company-ending event into a bad week. You need copies an attacker with domain admin rights can't delete, restores you've tested with a known recovery time, and coverage for SaaS data, which the SaaS vendor doesn't back up for you.
See backup as a service and business continuity.
12. Seeing across all of it: XDR or SIEM (Detect, Respond)
The last essential is whatever connects everything above. Extended detection and response does it inside one vendor's platform, joining endpoint, identity, email and cloud signals into one incident. A SIEM does it across vendors, with your own detection logic and longer retention. Cloud-native SIEM products have closed most of the cost and scaling gap that used to make this a purchase only large enterprises could make.
If nobody on your side can watch it around the clock, buy this as a service and see the MDR shortlist. Otherwise, see the XDR category and the SIEM shortlist.
Categories that are essential for some, not all
Four more categories become essential depending on your environment:
- Mobile threat defense, when phones and tablets reach company data, which covers most companies with a bring-your-own-device policy. See mobile threat defense.
- Virtualization and cloud workload security, when servers run as virtual machines, containers or serverless functions instead of on hardware. See cloud workload protection and container security.
- Network access control, when unmanaged devices can plug into the network, such as guest laptops, IoT and operational technology. See NAC.
- Email security beyond what your mail platform includes, when phishing is the main threat, which it is for most companies. See the email security shortlist.
The order to buy in
If you're starting from nothing, buy MFA and identity first, because they close the front door. Endpoint protection and detection come second, since the endpoint is where the attacker lands, and backup comes third because it's the only control that still works after everything else has failed. After that, add the firewall and SASE, PAM, DLP and vulnerability management, and finish with the SIEM or XDR that ties them together, or an MDR service if nobody will watch it.
The most common mistake is buying that last layer first. A SIEM with nothing good feeding it is an expensive log archive.
Check a vendor before you sign
Mandos tracks funding, acquisitions, hiring and news for security companies. Look up any vendor on your shortlist before the renewal.
Conclusion
Twelve categories cover the ground. Identity, MFA and PAM decide who gets in, and endpoint protection, antimalware, the firewall, DLP and encryption decide what they can do once they're inside. Vulnerability management and threat intelligence decide what you fix and what you watch for. Backup decides whether you survive, and XDR, SIEM or an MDR service decides whether you see any of it happening.
Frequently Asked Questions
What is the minimum viable enterprise security stack?
MFA and identity, endpoint protection with EDR, backup with copies that can't be changed, and a firewall. Those four stop most opportunistic attacks and make recovery possible. Add PAM, DLP, vulnerability management and a SIEM or MDR as the company grows.
Is XDR a replacement for SIEM?
If your company has standardized on one security vendor, XDR often covers the need to connect signals. If you run mixed vendors, write your own detection logic or have to keep data for a long time, you still need a SIEM. Many companies run both.
Do small companies need all twelve categories?
They need the same twelve functions, but they can get several from one product. An endpoint platform can include antimalware and EDR, an identity provider can include MFA, and a device management platform can enforce encryption. The number of products shrinks, but the list of functions doesn't.
How does NIST CSF map to these products?
Identify covers vulnerability management and threat intelligence. Protect covers IAM, MFA, PAM, antimalware, the firewall, DLP and encryption. Detect and Respond cover EDR, XDR and SIEM, and Recover covers backup and disaster recovery. Govern is a process rather than a product, though GRC platforms support it.
Where do managed services fit?
Managed detection and response means you don't have to staff the Detect and Respond functions yourself. It doesn't replace the Protect products, because the provider still needs EDR, identity and cloud data to watch.
How often should the stack be reviewed?
Once a year against your threat model, and again whenever your environment changes shape. A cloud migration, an acquisition or a move to remote work each change which categories are essential.
How this guide was made
I picked the categories and products from the CybersecTools catalog of 9,168 security products. Read the methodology for how shortlists are built.