Security Without a Single Point of Failure: How Momentus Technologies Approaches Defense in Depth

Every security program is tested the same way: a new vulnerability is disclosed, and the clock starts. How quickly can you tell whether you’re affected? How confident are you in the answer? And if you are affected, what stands between the flaw and your customers’ data?

Momentus Technologies designed our security program around those questions. At a high level, our approach is defense in depth. No single control is relied on to stop every threat. Each layer is designed so that if an attacker gets past one, the next is there to stop them, and the further they try to go, the harder it gets.

Five layers, working together

1. Enterprise-grade edge protection. All traffic to our applications passes through a global security network before it reaches us. That goes well beyond a traditional Web Application Firewall. It includes DDoS mitigation, bot management, and rate limiting, and it uses threat intelligence drawn from a large share of the world’s internet traffic. New attack patterns can be identified and blocked at the edge, often before they’re widely known, so the vast majority of malicious traffic never reaches our applications.
2. Secure-by-design infrastructure and code. If something does get past the edge, it runs into applications and infrastructure built with security from the start, not bolted on. Our cloud environment follows the principle of least privilege, with segmented environments, encryption of data in transit and at rest, and tightly controlled access. Even if one component were compromised, an attacker can’t freely move to others or reach customer data.
3. Continuous code scanning. We work to remove weaknesses before an attacker can find them. Our code is continuously scanned for vulnerabilities as it’s developed, deployed, and run. Automated checks cover our own code, the libraries and dependencies we rely on, and our infrastructure configurations. Issues are caught and fixed before they reach production, and when new vulnerabilities are disclosed, we can quickly identify whether, and where, we’re affected.
4. Real-time security observability. We keep constant watch across every layer, monitoring our entire cloud environment, including infrastructure, workloads, configurations, and identities. Newly disclosed vulnerabilities, misconfigurations, and suspicious activity are flagged as they emerge. Risks are prioritized by how exploitable they actually are, not just how severe they look on paper, so our team can act quickly and contain threats before they progress.
5. Regular penetration and security testing. We test the layers together. Independent security specialists regularly try to break into our applications the way a real attacker would, chaining techniques together to see how far they can get. That’s supplemented by our own ongoing internal testing. Findings are tracked, prioritized, and remediated, so each layer keeps getting stronger as the threat landscape evolves.

Why the layers matter more than any one of them

Many organizations invest seriously in security, and individual tools like a firewall, a scanner, or a monitoring platform are widely available. What matters is how the pieces fit together. Edge protection reduces what reaches us. Secure design limits what any one failure can do. Scanning and observability tell us what we’re exposed to, and testing tells us whether the whole system holds up. Each layer makes the others more effective, and that compounding effect is what we build for.

A recent example

When the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were disclosed, this approach let us answer the first question quickly. Momentus Enterprise and Elite are not affected because PHP is not used in the architecture, codebase, or supporting infrastructure of either product. No action is required from customers.

Our commitment

Security is never finished. Our security and engineering teams closely monitor industry disclosures and threat intelligence, and we remain committed to communicating promptly and transparently on any security matter that affects the people who rely on our products.

‍