Continuous, layered security covering prevention, detection, response, and post-incident hardening. Not a one-time setup — a discipline.