Deploying Active Defence in a SOC: Analysts’ Perceptions of Cyber Deception
Andrew Reeves, Debi Ashenden · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · 2025
Security Operations Centres (SOCs) are pivotal in safeguarding an organisation's network infrastructure. While existing technologies focus on reactive measures, the emergence of deception tools presents an opportunity for a more proactive defence against cyber threats. Integrating such tools into SOCs, however, necessitates understanding their impact, value, and implementation challenges. To explore this, we conducted fifteen interviews with analysts from a leading SoC provider in Australia. Our thematic analysis revealed key insights: implementing cyber deception requires a shift in organisational risk tolerance, efficacy hinges on proper implementation, and it introduces new risks requiring strategic management. Analysts suggested that in-house SOCs or threat intelligence teams might be more suited for cyber deception deployment in a Managed Service Provider (MSP) SOC. This study sheds light on the implications of cyber deception for SOC operations. We conclude with recommendations to guide the integration of deception tools into SOCs.