Ask ten people what “cyber security” means and most will describe the same narrow slice: antivirus software, firewalls, maybe a phishing email they almost clicked. In practice, cyber security isn’t one discipline, it’s a collection of distinct specializations, each defending a different layer of how organizations build, run, and store things. Understanding the types of cyber security that exist, and where the boundaries between them actually sit, is the first step to knowing which one your organization is underinvesting in.
This overview breaks down the major types of cyber security recognized across the industry, based on what each one actually protects, not on marketing labels.
What Is Cyber Security?
Cyber security is the practice of protecting systems, networks, applications, and data from unauthorized access, damage, or disruption. According to the NIST Cybersecurity Framework 2.0, effective cyber security means helping organizations understand, assess, prioritize, and communicate risk across their entire environment, not securing a single system in isolation.
That “entire environment” framing is exactly why cyber security splits into distinct types. A control that protects a corporate network does nothing to secure a mobile application’s code. A tool that scans cloud infrastructure won’t catch a malicious open-source package. Each type of cyber security exists because the layer it protects has its own attack surface, its own tooling, and its own specialists.
The types of Cyber Security, explained
Network Security
Network security protects the infrastructure that connects everything else: routers, switches, firewalls, VPNs, and the traffic moving between them. Its job is to control who and what can reach internal systems, and to detect intrusion or lateral movement once a perimeter has been crossed.
This is the oldest and most recognized of all the types of cyber security, and for many organizations it’s still where the security budget concentrates, even though modern attack paths increasingly bypass the network layer entirely by going straight through application code or a compromised dependency.
Application Security
Application security protects the software itself: source code, open-source dependencies, build pipelines, APIs, and the infrastructure that builds and ships that code. This includes practices like SAST (static analysis), SCA (software composition analysis), DAST (runtime testing), secrets detection, and CI/CD pipeline security.
Application security has grown from a specialist concern into one of the most active types of cyber security precisely because so much of modern risk now originates in code and dependencies rather than in the network. For a full breakdown of the specific attack patterns this discipline defends against, malware in the supply chain, secrets leakage, dependency risk, and more, see Cyber Threats Explained: The Main Types Security Teams Should Know.
Cloud Security
Cloud security protects infrastructure, configurations, and workloads running in public, private, or hybrid cloud environments. Because cloud resources are provisioned through code (Infrastructure as Code, or IaC) and can be spun up in seconds, misconfiguration is the dominant risk in this category, an exposed storage bucket or an overly permissive role can undo years of otherwise solid security posture in a single deployment.
Cloud Security Posture Management (CSPM) tools exist specifically to continuously check cloud environments against security best practices and flag drift as configurations change.
Endpoint Security
Endpoint security protects the individual devices, laptops, servers, and mobile devices that connect to an organization’s systems. Antivirus, EDR (Endpoint Detection and Response), and device management all fall under this type of cyber security.
Endpoints matter because they’re the most common initial entry point for an attacker: a compromised laptop or an unpatched server can become the foothold for a much larger breach, even when every other layer is well defended.
Data Security
Data security protects information itself, at rest, in transit, and in use, regardless of which system currently holds it. This includes encryption, access controls, and increasingly, secrets management: catching hardcoded credentials, API keys, and tokens before they’re exposed. We covered this specific failure mode in more depth, since secrets leakage remains one of the most common and most preventable causes of breaches.
Identity and Access Management
Identity and Access Management (IAM) protects the credentials and permissions that determine who, or what, can access a given system. This has expanded well beyond human users: service accounts, CI/CD pipeline tokens, and API keys are now identities in their own right, and often carry broader permissions than the humans who created them, with far less oversight.
The principle of least privilege, granting only the access a given identity actually needs, is the foundational concept underlying this entire type of cyber security.
IoT and OT Security
IoT (Internet of Things) and OT (Operational Technology) security protects connected devices and industrial control systems, from smart sensors to the machinery running a factory floor. What sets this category apart from the others is the consequence: a compromised IoT or OT system doesn’t just leak data; it can cause physical damage, safety incidents, or operational shutdowns.
This is also one of the hardest types of cyber security to modernize, since much of the affected hardware runs outdated firmware that was never designed with security updates in mind, and can’t always be patched without taking a physical process offline.
AI Security
AI security protects the AI systems organizations now build with and build on: models, autonomous agents, AI-generated code, and the infrastructure connecting them, including the Model Context Protocol (MCP) servers that let agents take real actions. This is the newest entry on this list, and one of the fastest-growing, because AI has become both a productivity tool and a new attack surface at the same time.
Risks specific to this category include prompt injection, tool poisoning, insecure AI-generated code shipping faster than review processes can catch it, and slopsquatting, where an AI coding assistant recommends a package name that doesn’t exist, and an attacker has already registered it with malware inside. For a deeper look at how this intersects with software supply chain risk specifically, see AI Security and the Expanding Software Supply Chain Attack Surface.
Operational Security
Operational security covers the processes, not the technology, that determine how an organization detects, responds to, and recovers from a security event: monitoring, incident response planning, access reviews, and audit logging. It’s the connective tissue between every other type of cyber security on this list, since a strong technical control is only as useful as the process that acts on what it detects.
Regulatory pressure has made this category increasingly non-negotiable rather than aspirational. Under the EU’s Cyber Resilience Act, for example, organizations face a hard reporting clock once a vulnerability is confirmed as actively exploited, see our breakdown of every CRA deadline from 2024 to 2027 and how risk based vulnerability management fits into meeting it.
Where These Types of Cyber Security Overlap
No organization runs these categories in isolation, and the boundaries between them blur more every year. A compromised endpoint can lead to stolen cloud credentials. A vulnerable dependency in application code can expose data that identity controls were supposed to protect. AI security in particular cuts across nearly every other category at once: an AI coding assistant can introduce a code vulnerability (application security), suggest a malicious dependency (supply chain), or leak a secret into a generated file (data security), all in the same interaction.
This is why the strongest security programs don’t just staff each type of cyber security separately, they connect the findings across categories into a single prioritized view, so a risk discovered by one discipline doesn’t sit invisible to the rest.
Where Application, Supply Chain, and AI Security Meet
Xygeni focuses specifically on the intersection of application security, software supply chain security, and AI security, the categories where modern software risk actually originates. ASPM unifies findings across native scanners and third-party tools into one prioritized view, so risk discovered anywhere in that stack doesn’t get lost in a separate dashboard. AI Security extends that same visibility to AI-generated code, AI agents, and MCP configurations, while Secrets Security and Malware Defense close the data and supply chain gaps that sit right next to it.
Xygeni doesn’t replace network, cloud, endpoint, or IoT security, those remain their own disciplines, with their own specialized tools. What it does is make sure that where code, dependencies, and AI meet, the risk gets caught, prioritized, and fixed before it becomes someone else’s incident to report.
FAQ
How many types of cyber security are there?
There’s no single official count, since categories overlap and new ones emerge as technology changes, AI security is a recent example. Most industry frameworks recognize somewhere between six and ten major types, typically including network, application, cloud, endpoint, data, identity, IoT/OT, and operational security.
What is the most important type of cyber security?
There isn’t a universal answer, it depends on where an organization’s actual attack surface is. A company with no cloud footprint gains little from cloud security investment, while a software company shipping code daily is more exposed through application and supply chain security than through network perimeter defenses. The right priority follows the risk, not a generic ranking.
Is application security the same as cyber security?
No. Application security is one type of cyber security, focused specifically on code, dependencies, and the pipelines that build and ship software. Cyber security is the broader discipline that also includes network, cloud, endpoint, identity, and other categories.
How does AI security relate to the other types of cyber security?
AI security is unusual in that it overlaps with nearly every other category rather than standing apart from them. An AI system can introduce risk into application security (insecure generated code), supply chain security (a hallucinated malicious dependency), and data security (a leaked secret in generated output), often in a single interaction, which is why it’s increasingly treated as a cross-cutting discipline rather than an isolated one.
