Stop Stacking Boxes. Start Designing Security.
In this blog
Why back-to-back firewalls have faded—and what modern defense looks like
For years, back-to-back firewalls were treated as a hallmark of strong security architecture—two layers, two vendors and the assumption of built-in defense-in-depth.
But modern threats don't fail because an organization added another perimeter device. They fail when security is designed around context, identity and prevention rather than device count.
Today, a properly deployed next-generation firewall platform—integrated with segmentation, telemetry and operations—delivers materially stronger protection with far less cost and complexity than stacked legacy controls.
A personal lesson in layering the wrong thing
Early in my career, I worked with a customer who believed the safest possible design was simply to add another layer of the same control.
If one firewall was good, two had to be better.
If two were good, maybe three would finally make them secure.
On paper, the architecture looked impressive—multiple inspection points, redundant vendors and diagrams filled with security icons. But when we walked through how an actual attack would unfold, something became clear:
- Nothing meaningful changed between the first firewall and the second.
- Same ports inspected.
- Same limited context.
- Same lack of visibility into identity, behavior, or intent.
What the customer really had wasn't defense-in-depth.
They had defense-in-duplication.
I've seen similar patterns outside of technology. Years ago, while helping a teenager learn to drive, I caught myself believing that more rules meant more safety. More restrictions. More warnings. More control.
But real safety didn't come from stacking rules. It came from teaching awareness, judgment, and context—the ability to understand what was happening and respond in real time.
Security architecture works the same way.
You don't reduce risk by stacking identical controls in series. You reduce risk by designing systems that understand behavior, enforce intent, and stop threats before impact.
That realization separates legacy perimeter thinking from modern security architecture—and explains why the industry is steadily moving away from back-to-back firewall designs.
Why back-to-back firewalls made sense 15-20 years ago
To understand why the model is fading, it's important to acknowledge a simple truth:
Two decades ago, it was often the right answer.
In the early 2000s, firewalls were fundamentally port-and-protocol-based enforcement devices with:
- No meaningful application awareness
- No identity context
- Limited threat intelligence
- Minimal visibility into encrypted traffic
Because each control was inherently limited, architects compensated the only way technology allowed…..
They stacked controls.
- Two vendors suggested layered protection.
- Compliance language reinforced the design.
- Threats were simpler, slower and largely unencrypted.
Under those conditions, duplicating perimeter inspection could meaningfully reduce risk.
But architecture is always tied to the threat landscape of its era—and that landscape has fundamentally changed.
Where the model breaks down in modern environments
Back-to-back firewalls didn't fail because the idea was flawed. They fail because the world they were built for no longer exists.
Encryption is now (or should be) default
Stacked perimeter devices without shared decryption context create layered blindness, not layered protection.
Identity replaced location
Security must follow who and what, not just where traffic enters.
Duplicated perimeter inspection cannot stop credential abuse or lateral movement.
Attackers accelerated
Modern adversaries automate reconnaissance, escalation, and spread—requiring correlated visibility and rapid prevention that fragmented layers cannot deliver.
Duplication without depth
Two traditional firewalls in series usually perform nearly identical inspection:
- Same ports evaluated
- Parallel rule logic
- Separate, weakly correlated logs
Complexity becomes the real risk
Stacking controls introduces:
- Policy drift
- Slower change windows
- Ambiguous troubleshooting
- Fragmented incident response
Security that cannot be operated clearly and changed safely eventually fails. Cost rises while protection plateaus
Dual architectures double:
- Hardware and licensing
- Engineering overhead
- Misconfiguration probability
. . . Yet deliver near-zero marginal risk reduction.
Organizations pay more for the appearance of depth than actual protection.
What replaces the back-to-back model?
The answer isn't just a newer firewall. It's a different architectural philosophy built on context, integration and prevention. From layered devices to layered capabilities
Modern NGFW platforms provide:
- Application-level inspection
- Embedded identity awareness
- Inline threat prevention
- Encrypted traffic analysis
- Behavioral and AI-assisted detection
- Unified telemetry for operations
This is defense through understanding, not duplication.
This is true segmentation over redundant perimeters
Modern security reduces risk inside the environment through:
- Least-privilege access
- Identity-based policy
- Internal segmentation
This is far more effective than repeating the same edge inspection twice.
Integrated detection and response
NGFW platforms now connect directly to SOC analytics and automation, endpoint, identity, cloud telemetry, and Centralized orchestration
This delivers earlier detection, faster prevention, and precise response.
Fewer control points, stronger security
A modern truth: Reducing enforcement devices can increase protection when controls are context-aware, unified, and operationally clear.
When dual firewalls still make sense
Architectural honesty matters. There are narrow cases—mostly governance-driven:
- Legal or administrative trust boundaries
- Distinct security functions (e.g., DDoS → NGFW)
- Short-term migration states
But these are exceptions, not best practice.
Where legacy patterns still appear—and why
You may still see dual firewalls in:
- Telecommunications — slow refresh cycles and carrier demarcation history
- Financial services — conservative risk posture and legacy compliance views
- Government — procurement and accreditation lag
- Critical infrastructure / OT — extreme change control and long lifecycles
- Healthcare — merger-driven sprawl and fragmented ownership
The common driver is not modern security needs, but time, regulation and inertia.
Common objections—and the reality behind them
"Two firewalls provide defense-in-depth."
Today, they provide redundancy without shared intelligence.
"Two vendors reduce risk."
Fragmentation often increases operational risk.
"Compliance requires it."
Modern compliance measures outcomes, not device count.
"We've always done it this way."
Past success ≠ future resilience.
"More layers mean more security."
Clarity beats quantity in modern defense.
Conclusion: Stop stacking boxes. Start designing security.
Back-to-back firewalls once reflected thoughtful architecture and real risk concerns.
But security effectiveness is never frozen in time.
Today's reality—encryption, identity, cloud, and automated adversaries—demands a different model.
Duplicated perimeter inspection now adds cost and complexity while delivering only the appearance of protection.
Legacy narratives can place a reassuring spin on familiar designs. But risk is not reduced by comfort or tradition. It is reduced by measurable control effectiveness.
That is why leading organizations are shifting toward:
- Context-aware NGFW enforcement
- Identity-driven segmentation
- Integrated prevention and response
- Centralized operational visibility
- Fewer, far more capable control points
Even more importantly, the absolute best practice is to design NGFW capabilities as part of a unified security platform—where policy, telemetry, identity and prevention operate as a coordinated system rather than as isolated perimeter devices.
Defense-in-depth has not disappeared. It has matured—from stacked devices to layered intelligence.
And that leads to the simplest, most important takeaway:
That is the mindset required for the decade ahead.