Four security domains
Beacon classifies on two axes. Tier answers when must this be fixed; domain answers who fixes it. Four domains is enough to route work to the right team without creating a taxonomy that needs its own documentation.
Assign the domain of the control that fixes the finding, not the domain of the symptom. An exposed database is a Network finding if the fix is a firewall rule and a Data finding if the fix is authentication.
Network
NETWhat can be reached, and from where?
The Network domain covers reachability: which services are exposed, to which networks, and what sits between an untrusted packet and a sensitive system. Most Tier 1 findings are network findings in disguise — a vulnerable service that nothing can route to is a very different problem from the same service on a public IP.
Identity & Access Management
IAMWho can act, and how strongly is that proven?
The Identity domain covers authentication strength, authorisation scope, and credential lifecycle. Identity is the modern perimeter: in cloud-first estates the majority of privilege-escalation paths are IAM misconfigurations rather than software vulnerabilities, and they carry no CVE to alert on.
Data Protection
DATWhat happens to the data if everything else fails?
The Data domain covers the controls that determine blast radius. Every other domain is about preventing access; this one is about limiting what access is worth. Encryption, classification, retention, and injection defence decide whether a compromise is an incident or a notifiable breach.
Processing Protection
PRCIs the compute that runs the business trustworthy and available?
The Processing domain covers the integrity and availability of compute: patch currency, workload and container hardening, build-pipeline trust, and resilience against disruption. It is where software supply chain and known-exploited vulnerabilities land.
Why four and not fourteen
Categorisation schemes fail by growing. Every additional domain creates a boundary case, and boundary cases create arguments that consume more time than the remediation would have. Four domains map cleanly onto how engineering organisations are actually structured, which means the domain assignment usually names a real team with a real backlog rather than a notional owner.