Defence in depth
Defence in depth is the practice of layering independent controls so that the failure of any single layer does not lead to compromise. In security architecture the operative word is independent: two controls that share an assumption, a credential or a management plane are one control drawn twice.
The idea is old and the failure mode is consistent. An estate lists a firewall, an endpoint agent, multi-factor authentication and a mail gateway, and calls that four layers. If a single administrative account can disable all four, that is one layer with four names. Genuine depth means an attacker who defeats the perimeter still faces network segmentation, still lacks the rights to reach anything worthwhile because of least privilege, and still generates a signal on the way.
It is also not an argument for buying more products. Adding a fifth tool that reads the same telemetry as the other four adds cost and no depth, while raising the operational load that causes controls to be left in monitoring mode.
The way this is measured on an engagement is by counting how many independent things had to fail for us to reach the objective. When the answer is one, the report says so plainly, and the recommendation is usually not a new control but the removal of a shared dependency: a shared local administrator password, a management network reachable from user workstations, or an identity that can administer both the estate and its backups.