It sounds like just "use lots of security," which can't be the whole idea.
Accepted answer
The principle is that **no single control should be the only thing standing between an attacker and the asset**. You assume each layer will eventually fail and design so that one failure isn't a breach.
For a web server, layers might run: network firewall → intrusion detection → patched OS → least-privilege service account → input validation → encrypted database → offline backups. An attacker past the firewall still hits a hardened OS; past that, an account that can't reach anything valuable.
The useful test is asking "what does failing *here* get them?" If any one answer is "everything," that control is a single point of failure and the depth is imaginary.
It pairs with **least privilege** (every account gets the minimum access it needs) — that's what limits the blast radius when a layer does fall.