Preventive, Detective, Corrective, Deterrent & Compensating Controls

#Every Control Has a Purpose — Know the Five Archetypes#link

You can’t choose the right control until you understand what it’s supposed to do. Controls fall into five functional categories: preventive, detective, corrective, deterrent, and compensating. Real‑world security strategies blend multiple categories to create defence in depth.

Preventive: Stop the Incident Before It Happens

Preventive controls block an attack from succeeding. Firewalls, encryption, access badges, and input validation are all preventive. The idea is to eliminate or reduce a vulnerability so the threat can’t exploit it.

Detective: Find What Slipped Through

Detective controls identify an attack that has already occurred (or is in progress). Log monitoring, SIEM alerts, CCTV, and intrusion detection systems fall here. Their effectiveness depends on coverage and timely human review.

# Simulated SIEM alert for multiple failed logins
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head -5

Corrective: Restore Normalcy After the Breach

Corrective controls limit damage and return systems to a known good state. Examples: restoring from backups, patching a vulnerability after an exploit, or isolating an infected machine. Incident response plans are the procedural corrective control.

Deterrent and Compensating: The Specialists

Deterrent controls discourage attackers by increasing perceived risk (warning banners, security guard presence). Compensating controls are used when the primary control isn’t feasible—e.g., using network segmentation when you can’t patch a legacy system.

• ▪When selecting controls, ask: ‘What category gap does this fill?’
• ▪Compensating controls must be documented with a justification.
• ▪Combine deterrents with detective controls to catch those who ignore the warning.