A layered program built on hygiene, protective controls, detection and response, and validation still holds up against faster, AI-assisted attackers. None of the four observes a passive tap on a WAN fiber link, so that path needs a separate control.
This guide explains what layered network security consists of, how AI has changed the threat, and where a gap remains for data crossing fiber between sites. It also compares three Layer 1 approaches: CyberRidge, Ciena, and Adva.
The four control categories and what each one watches for
Layered security, also called defense-in-depth, is the practice of applying several independent controls so that a failure in one does not leave the network exposed. A NIST glossary definition describes it as applying multiple countermeasures in a layered or stepwise manner, so an attack that one technology misses can be caught by another. Most wide area network (WAN) programs use four categories, which align loosely with the functions in NIST’s Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover.
| Category | Question it answers | What it needs in order to act |
|---|---|---|
| Hygiene and patching | Is software current and configured correctly? | A known weakness on a system |
| Protective controls | Who can access and read the traffic? | A login, session, or data flow to control |
| Detection and response | Is an intrusion visible? | Abnormal behavior to observe |
| Validation | Do the other controls work? | A control to test |
Every category in the table depends on something happening on a system or an account. That dependency is the reason the categories work well against most attackers.
For more on how encryption leaves the physical signal exposed, see Encryption Protects the Meaning of Your Data. It Doesn’t Protect the Signal Carrying It.
How AI has changed attacker speed and cryptography research
AI has shortened how long each attack stage takes. CrowdStrike’s 2026 Global Threat Report states that AI-enabled adversaries increased their operations by 89 percent in 2025. It gives an average eCrime breakout time of 29 minutes, defined as the time from initial access to lateral movement, which it reports as 65 percent faster than the previous year. The pressure falls mainly on detection and response, which exists to catch an attacker already inside a compromised environment.
AI is also being applied to cryptanalysis. On July 28, 2026, Anthropic’s Frontier Red Team published two results produced with Claude Mythos Preview:
- HAWK-256: an improved key-recovery attack on this candidate post-quantum signature scheme. HAWK is not deployed, and larger HAWK parameter sets remain impractical to attack.
- Round-reduced AES-128: a classical attack on a version with 7 of its 10 rounds, reported as 200 to 800 times faster than the previous best.
Anthropic states that neither result affects production systems. The findings do not weaken full AES-128 or AES-256, and they do not relate to quantum computing. They show that cryptanalysis tools are improving, which is relevant to how long recorded data may stay protected.
Why passive interception falls outside all four categories
A passive tap copies the optical signal on a fiber span without altering the network. NIST’s glossary defines a passive attack as one that does not alter systems or data. Applied to the table above, a tap provides no weakness for hygiene to find, no session for protective controls to restrict, no abnormal behavior for detection to observe, and no control for validation to test.
The encryption on the link continues to function, and the tap collects ciphertext. An attacker can store that ciphertext. If the key exchange or algorithm protecting it is broken during the data’s useful life, the stored copy becomes readable. This is the harvest-now-decrypt-later pattern. It is most relevant for data that must remain confidential for many years, such as government communications, financial records, and long-term intellectual property.
Do you know Your Encrypted Fiber Isn’t as Safe as You Think? This podcast episode covers why encrypted fiber traffic can still be recorded.
Photonic layer security explained
Photonic layer security (PLS) is a category of protection applied to the optical signal at the physical layer of a fiber link. Controls in the four categories above work on systems, accounts, and software. A PLS control works on the transmission itself, with the goal of making a copied signal unusable instead of detecting the copy.
PLS does not replace any of the four categories. Encryption continues to protect data at higher layers, monitoring continues to catch compromised systems, and PLS covers transmission that those controls do not observe.
Layer 1 approaches compared: CyberRidge, Ciena, and Adva
The table below compares three approaches to protecting traffic on optical links, using each vendor’s own published descriptions.
| Dimension | CyberRidge (Carmel) | Ciena (WaveLogic Encryption) | Adva (Adtran) Layer 1 encryption |
|---|---|---|---|
| Method | Spreads the signal across a wide optical spectrum, changes optical phase under an optical key, and adds noise, per the CyberRidge technology page | AES-256-GCM encryption built into the optical transport, per Ciena’s blog | Symmetric AES-256 line-rate encryption for DWDM systems, per the Adva page |
| What an observer on the fiber sees | Described as background noise | Encrypted data | Encrypted data |
| Quantum-related approach | Described as complementary to post-quantum cryptography | Supports post-quantum algorithms and interworks with third-party QKD | Post-quantum key exchange combined with traditional methods, with a QKD upgrade |
| Relationship to existing encryption | Described as complementary to higher-level digital encryption | Built into the transport platform | Built into DWDM systems |
All three entries are drawn from vendor materials, so they describe what each vendor says rather than independently measured behavior. Ciena and Adva protect traffic by encrypting it and hardening key exchange, so a tap collects encrypted data and protection depends on those cryptographic components over time. CyberRidge describes a design in which the signal itself is altered, so an observer collects noise. The approaches work at different points, and CyberRidge describes its own as designed to run alongside encryption.
Which WAN links to review first
Not every link carries the same exposure, so a review can be ordered by how long the data needs to stay confidential and how much a recorded copy would be worth. Three questions help rank the links:
- How long must the data stay secret? Data with a confidentiality life of many years is the main concern for harvest-now-decrypt-later, because a recorded copy has time to be attacked.
- Does any control observe the physical transmission? If the answer is no, the link depends entirely on the cryptography protecting the traffic.
- Who would benefit from a recorded copy? Links between government, defense, financial, telecom, or data center sites tend to carry traffic that is valuable to a determined attacker.
Links that score high on all three are the first candidates for a physical-layer control. Links carrying short-lived data can usually wait.
Bottom line
Layered defense remains the right foundation, and AI has increased attacker speed more than it has changed the categories of control. The gap that predates AI is the WAN fiber link that no control observes for a passive copy. For links that carry long-lived sensitive data, a physical-layer control is the category designed for that gap, and it is intended to be added to the existing stack instead of replacing any part of it.
FAQs
Q: What is layered network security?
A: It is a program that applies several independent categories of control, typically hygiene and patching, protective controls, detection and response, and validation. The goal is that an attack missed by one control can be caught by another.
Q: Can intrusion detection or a SIEM find a passive fiber tap?
A: Not reliably. A passive tap does not alter systems or data, so it generates no log entry or abnormal behavior for these tools to detect.
Q: Does AI make encryption unsafe to use?
A: No. The Anthropic results cited above concern a candidate signature scheme that is not deployed and a round-reduced version of AES-128. Anthropic states that neither affects production systems.
Q: What is Carmel?
A: Carmel is the platform CyberRidge describes on its technology page, linked in the comparison section above. It alters the optical signal on a fiber link so that an observer sees background noise.
Q: Does CyberRidge position Carmel as a replacement for encryption?
A: No. CyberRidge describes the approach as complementary to post-quantum cryptography and other higher-level protocols.
Q: How do CyberRidge, Ciena, and Adva differ?
A: Ciena and Adva describe AES-256 encryption at the optical layer. CyberRidge describes altering the optical signal itself, so that what a tap collects is noise instead of encrypted data.