The areas of cyber security: network, endpoint, cloud, identity and more
In short: Cyber security is usually split into areas such as network, endpoint, application, identity, data, cloud, operational technology and physical security. Each area has its own tools and specialists, but real attacks cross several at once, so the areas only work when they are joined up.
Why split security into areas?
Cyber security covers a huge amount of ground. One person cannot be an expert in firewalls, secure coding, cloud permissions and factory control systems all at once. So organisations, job adverts and courses divide the subject into areas (sometimes called domains or types of cyber security). Knowing the areas helps you understand job titles, read a security strategy and spot gaps in your own knowledge.
The main areas
| Area | What it protects | Typical controls |
|---|---|---|
| Network security | Traffic and network devices | Firewalls, segmentation, VPNs, intrusion prevention |
| Endpoint security | Laptops, desktops, phones, servers | EDR, patching, disk encryption, device management |
| Application security | Software and web applications | Secure coding, code review, testing, web application firewalls |
| Identity and access | User and service accounts | MFA, single sign-on, least privilege, privileged access management |
| Data security | Files, databases and backups | Classification, encryption, data loss prevention, backups |
| Cloud security | Services hosted by a cloud provider | Secure configuration, logging, posture management |
| OT and IoT security | Industrial systems, sensors, smart devices | Segmentation, asset inventory, vendor-approved updates |
| Physical security | Buildings, rooms and hardware | Locks, badges, CCTV, secure disposal |
Two further areas sit across all of these. Security operations watches everything for signs of attack and responds, and governance, risk and compliance (GRC) sets policy, measures risk and checks that rules and laws are followed. Mobile security is often treated as part of endpoint security, and critical national infrastructure, such as power and water, combines OT, network and physical security.
How the areas overlap
Attackers do not respect these boundaries. A typical intrusion starts with a stolen password (identity), runs malware on a laptop (endpoint), moves across the internal network (network) and finally copies files from a database or cloud storage (data and cloud). If each team only watches its own area, nobody sees the whole story.
This is why modern approaches such as Zero Trust and extended detection and response (XDR) deliberately join signals from several areas. It is also why a security framework is useful: it makes sure no area is forgotten.
Real-world example: a growing online shop
A small online shop starts with one IT person who does everything. As it grows, a review lists the areas and asks who owns each one. Network and endpoint security are fine, but nobody owns identity (staff share an admin login for the shop platform) or cloud security (product images sit in a storage bucket nobody has checked). The owner gives identity to the IT person, who turns on individual accounts with MFA, and pays a consultant for a short cloud configuration review. Nothing new was bought; the shop simply stopped having blind spots.
Matching areas to roles
Job titles often map to an area. A network security engineer looks after firewalls and VPNs, an endpoint or desktop security specialist manages EDR and device policies, an application security engineer works with developers, and an identity engineer runs single sign-on and access reviews. Cloud security engineers and OT security specialists are in growing demand. Security analysts in a security operations centre see alerts from every area, which makes the role a good place to learn how they all fit together.
Tip: when you study, pick one area to go deep in and keep a working knowledge of the rest. Employers value specialists who understand how their area connects to the others.
Practice
Which area would multi-factor authentication and single sign-on belong to?
Why is a power station a mix of several areas?
A team only monitors firewall logs. What risk does this create?
Key takeaways
- Cyber security is divided into areas so people can specialise.
- Common areas: network, endpoint, application, identity, data, cloud, OT/IoT and physical.
- Security operations and GRC work across all areas.
- Real attacks cross several areas, so teams and tools must share information.
- Listing the areas and their owners is a quick way to find blind spots.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.