Speed Kills SOC Decision-Making. Deliberation Kills Operations. What To Do?

Cybersecurity is a balance of risks. Risks require trade-offs. An easy trade-off is: do we move as quickly as possible with an 80% solution with the known risk of having gone down the wrong path, or do we wait until we get to 99% certainty and then execute?

Bots move quickly and break things, you say. This requires speedy response. Yes, though the psychology of decision-making under time pressure is gloomy. We're veering into the Daniel Kahneman "Thinking, fast and slow" territory where speedy decision-making relies on what Kahneman referred to as "System 1" thinking where decisions made under time pressure engage heuristics. These are snap judgments based on pattern recognition, the goal being to conserve time and effort in making decisions in new instances that are -- maybe -- similar to previous instances. For example if you go to a new coffee shop and you like cortados, you might order a cortado w/o reading the menu. There is no need to think about it.

The problem with System 1 thinking is that heuristics, which are meant to speed you through your day with minimal effort, are usually right for people with experience -- but otherwise they can be wrong or biased, and can lead to ongoing wrong decisions. The alternative is effortful processing known as "System 2" thinking. Seems like that's best, but it's effortful and slow. In fact you'd be exhausted if you made effortful decisions every day without relying on previous understanding.

If you rely on System 1 thinking in cybersecurity you might make too many mistakes by declaring "false alarms." But if you rely on System 2 thinking in cybersecurity you might miss too many threats because you took too much time, and by the time you responded the threats have escalated beyond your control. This is where the term 'paralysis by analysis' is apt.

There are ways out, but no one path is best.

The crew at McKinsey have published new materials on balancing cyber-defense speed with deliberation. The part that concerns us at Pythia Cyber in terms of behavioral cybersecurity is this, on "The architecture of organizational decision-making must be optimized for time pressure" -- quoting at length:

The third design imperative, and the most underestimated, is redesigning the decision-making architecture itself. The reality is that most organizations still manage cybersecurity through governance structures designed for a different era. There is a common belief that the risk of an unnecessary or poorly controlled change outweighs the risk of a slow one. Change advisory boards, security steering committees, cross-functional working groups, and escalation chains that cross several C-suite functions all instinctively buy into that premise. But when a vulnerability is exposed to fast-paced, AI-enabled active exploitation, delay becomes the bigger risk.

Leading organizations are redesigning organizational decision-making processes around a cross-functional response cell, which is a small, empowered team with a single decision-maker who holds CSO-delegated authority to override standard change management processes for confirmed active threats. The cell runs a daily triage cycle and owns a real-time vulnerability backlog. It has preauthorized playbooks for responses that it can execute without escalation. And it has an executive liaison who translates technical progress into board-level visibility every 24 hours. The roles are clearly defined, with decision authority explicitly assigned rather than diffused.

Interesting idea, more subtle than it looks. Conceptually, sure, we should be more flexible, and teamwork is better for most applications where diversity of thought and even work schedules contributes to mission success.

But before you go all in with a System 1 "heck yeah!" response, check the details carefully.

Here are implementation issues to be careful about in trying to approach this model.

1. The McKinsey approach emphasizes speed over deliberation. Here we go with System 1 thinking. The psychology of successful implementation requires repeated training of identification, protection, detect, response, and recovery scenarios. All of that happens within a governance framework. If that sounds like the NIST CSF, that's because it is. You will fail if you just rotate someone into a team, or you don't intentionally practice all (100%) of the process parts. Why? Because people don't just "know what to do" or rely on "muscle memory," and dealing with real-time cyberthreats is no time to be either deliberate or hasty.

2. Decide very far in advance whether those "preauthorized playbooks" are going to describe the event, triage it, or defeat it. The threat landscape is shifting so quickly that last week's "preauthorized playbook" may not be appropriate today. Maybe a better approach is to leverage the playbook to allow for "override standard change management processes" -- that is, the response and recovery phases that are cultural and resilient -- and not the initial phases, which might require more "frontier" knowledge. 

3. "Executive liaison" is a great idea. Make the security culture part of the company's way of thinking. At the same time, we all know as security professionals that the infrequency of reportable incidents may create a reporting ritual rather than an operational report.

4. That cross-functional response cell -- in the military or law enforcement or the IC we refer to those as 'fusion cells' -- just to ask, is that an ancillary duty or are members detailed full-time? If they are full-time members, what functions are you automating that these people are not performing while in the cell?

5. The saying is that "teamwork makes the dream work." What "single decision-maker who holds CSO-delegated authority to override standard change management processes for confirmed active threats" is working the third shift on New Year's Eve? Talk about "dream work," it is easy to imagine that senior personnel fitting McKinsey's description have opted out of the drudge time slots and are all cozy in bed. What then?

The subtle lesson of System 1 & System 2 thinking trade-offs is that these are not modalities in opposition. Ask yourself instead where heuristics make more sense, and where deliberate reasoning makes sense, within the same SOC ecosystem. You need rehearsed, preauthorized heuristics for response and recovery, and deliberate reasoning where a novel threat needs frontier knowledge. Those options have to be available for all members of the team, especially the newer personnel.

Integrating System 1 and System 2 approaches within a SOC fusion cell requires effort. It requires partnerships with operational units. Do not take shortcuts.

Ask us how you can align your SOC purpose with your business partners.

(image credit: AngMoKio, CC BY-SA 3.0 <https://creativecommons.org/licenses/by-sa/3.0>, via Wikimedia Commons)