What Does Layered Network Security Look Like in the AI Era?
Layered network security combines hygiene and patching, protective controls like encryption and access control, detection and response, and validation testing into one program. AI has shortened how long each stage of an attack takes an adversary to complete. None of those four layers monitors the fiber link crossing a WAN for harvesting activity. A passive tap that compromises no endpoint, triggers no alert, because nothing on the network actually changes. We built Carmel to close that specific gap, protecting the transmission itself from being harvested, rather than watching for bad behavior around it.
Layered network security in the AI era still runs on the same four categories of control it always has. What AI changed is how quickly an attacker moves through them once inside, and that pressure falls hardest on detection and response. The layer built to notice an attacker in motion is also the one carrying a blind spot. It works by spotting the trace an intrusion leaves behind. An adversary who copies traffic off a fiber span leaves no trace to spot.
The four layers most WAN security programs run
A layered WAN security program typically runs four practical categories of control. Those are hygiene and patching, protective controls such as encryption and access management, detection and response through continuous monitoring, and validation through security assessment. They map onto the functions in NIST's Cybersecurity Framework, and NIST's glossary defines defense-in-depth as applying multiple countermeasures in a layered or stepwise manner. Each layer answers a different question about the network, covering whether software is current, whether traffic is controlled, whether an intrusion is visible, and whether the cryptography has been tested.
Why AI changes the arithmetic, not the model
AI has compressed attack timelines without changing the categories of control that answer them. CrowdStrike's 2026 Global Threat Report puts AI-enabled attacks up 89 percent in 2025, with average breakout time, meaning initial access to lateral movement, falling to 29 minutes and a 65 percent acceleration from the year before. CrowdStrike attributes that drop to AI-assisted reconnaissance. Pressure of that kind lands squarely on detection and response, the layer built to catch an attacker already moving inside a compromised environment.
The same tools are also being turned on cryptography itself. Anthropic's Frontier Red Team published work on July 28, 2026, showing Claude Mythos Preview cutting the estimated cost of breaking HAWK-256, a candidate for post-quantum signature scheme, although never deployed. However, the finding demonstrated the ability to execute a faster classical attack on a deliberately weakened, round-reduced version of AES-128. Neither result touches a currently deployed algorithm. What they show is that the tools for hacking cryptography are improving alongside the tools for hacking networks.
The traffic that never trips any of the four layers
A passive tap on a WAN fiber span doesn't leave a trace of IOCs, doesn't touch an endpoint, and doesn't require credentials. NIST's security glossary defines a passive attack as one that does not alter systems or data. Hygiene checks, access controls, and detection tooling all watch for a system behaving differently, and a passive tap gives them nothing to see. The link keeps running exactly as it did the day before it was tapped.
The encryption on that link is doing its job the whole time. The ciphertext is simply being copied, and whoever copied it can hold the traffic until the key or algorithm protecting it is no longer strong enough. That is the harvest-now-decrypt-later pattern, and it makes long-lived sensitive data a standing target no matter how well the other four layers are run.
Photonic Layer Security: The missing security layer
Photonic Layer Security (PLS) is the category we built Carmel around, and it removes what a passive tap needs to remain stealthy and undetected. Carmel spreads the transmitted signal across a wide optical spectrum, modifies it with a continuously changing optical key, and buries it under true random optical noise. A tap on a link in that state captures a signal indistinguishable from noise instead of a recoverable copy of the ciphertext. That protection sits underneath all four defense-in-depth layers, each of which keeps doing its own job unchanged.
The table sets out where Photonic Layer Security sits in the security stack.
| Feature | Detail | Why it matters |
|---|---|---|
| Layer | Physical (Layer 1), Photonic Layer Security | Sits beneath all four defense-in-depth layers |
| What a tap sees | Optical noise, not ciphertext | Closes the one harvest point none of the other layers monitor |
| Deployment | Plug-and-play; Quantum-Ready status in weeks, no system changes | Adds coverage to a stack that's already built |
| Distance | Up to 100 km unamplified, extending with EDFA or Raman amplification | Fits long-haul and metro WAN spans |
| Fit with existing stack | Complementary to hygiene, protective controls, detection/response, validation | Closes the harvest gap instead of duplicating control functionalities |
What a complete WAN security stack needs now
A layered defense program is still the right foundation, and AI hasn't changed the organization’s security stack. It has changed how fast an attacker moves once inside. It has done nothing about the harvesting blind spot that was always there, which is a WAN fiber link nobody is watching for a passive copy. Closing that gap means adding a layer built for exactly that traffic, not presuming the existing four to do a job none of them were designed for.
FAQs
Q: Can a SOC detect a passive fiber tap using existing SIEM or IDS tools?
A: Not reliably. A passive tap on a WAN fiber link doesn't compromise an endpoint or alter any system, so it produces no log entry, no anomalous behavior, and no event for a SIEM or IDS to flag. Carmel addresses this by making the transmitted signal itself unrecordable, rather than trying to detect the tap after the fact.
Q: Does a standard defense-in-depth program already cover data interception on a WAN link?
A: Only partially. Hygiene, protective controls, detection and response, and validation all address an attacker who compromises a system or account. None of them is built to catch a passive interception of already-encrypted traffic on a fiber link, since nothing on the network is altered when that happens.
Q: Where does Carmel sit relative to the encryption already running on a link?
A: Underneath it. Carmel operates at the physical layer, below whatever protective-control encryption is already in place, so it works alongside existing protocols rather than replacing them.
Q: Does adding Carmel replace any of the four defense-in-depth layers?
A: No. Carmel is complementary to hygiene, protective controls, detection and response, and validation. It adds coverage for WAN transmission specifically.
Q: Does AI change what Carmel protects against?
A: No. Carmel's protection doesn't depend on which technique, AI-assisted or otherwise, an adversary uses tocapture traffic and eventually try to decrypt it, because the traffic is never captured as ciphertext in the first place.
Q: Is Carmel's protection limited to shorter fiber spans?
A: No. We support fiber spans up to 100 km unamplified, extending further with standard EDFA or Raman amplification, so it fits long-haul and metro WAN links without a separate distance workaround.
Q: Who should add a physical-layer control like this first?
A: Organizations running WAN links carrying data that has to stay confidential for years, meaning telecom operators, government and defense networks, financial institutions, and data center interconnects, get the most benefit from closing the interception gap first, since that traffic is the most valuable to attackers.