Cognitive Hygiene — Bias, Fatigue, and Structured Analysis

SOC work is cognitively demanding in a specific way: high volume, time pressure, and repetition. These conditions are a perfect breeding ground for cognitive bias — systematic errors in reasoning that happen reliably, predictably, and mostly invisibly. Understanding them is not motivational content. It is a security control.

The Biases That Hurt SOC Analysts Most

Confirmation Bias

You form a hypothesis after the first pivot (“probably a FP — the user is a developer and this is a known script”). Every subsequent piece of evidence gets filtered through that lens. Evidence that confirms the FP gets noted. Evidence that complicates it gets rationalized away.

The sign you’re experiencing confirmation bias: you’ve stopped looking for evidence that would change your mind.

Counter: Before finalizing any disposition, spend 60 seconds explicitly asking: “What would make me change my answer?” If you haven’t looked for it, look now.

Anchoring Bias

The alert headline says “Mimikatz detected.” You assume credential theft. But the process tree shows this is a legitimate security scanner testing detection coverage. The word “Mimikatz” anchors your interpretation even when the evidence points elsewhere.

Counter: Read the raw telemetry before you read the alert title. Form your hypothesis bottom-up from evidence, not top-down from the label.

Availability Bias

The last three real threats you found were ransomware precursors. Now every PowerShell alert feels like ransomware. You overweight the pattern you’ve seen most recently.

Counter: Use base rates, not recent memory. How often does this rule actually fire as a TP in your environment? Check the historical metrics.

Automation Bias

After 200 FPs from a particular rule, your brain learns that this rule = FP. You start closing it without reading the evidence. One day it fires on a real attack. You close it.

Structured Analytic Techniques

When the evidence is genuinely ambiguous — when you have indicators pointing both ways — structured techniques prevent bias from making the call for you.

Analysis of Competing Hypotheses (ACH)

Devil’s Advocate

Before closing as FP or Benign-TP, run this internal query: “What would I need to see to call this a TP?”

If your answer is “something I haven’t looked at yet” — look at it first.

If your answer is “evidence that would require the parent process, the hash, and the network traffic all to be lying” — that’s a defensible FP close.

Pre-mortem

For escalation decisions: “If this turns out to be a real attack that we missed, what would the post-mortem say we should have done differently?”

This isn’t about anxiety — it’s about identifying the pivots you’d regret not doing. If the pre-mortem surfaces a pivot you haven’t taken yet, take it now.

Alert Fatigue is a System Problem

Organizational mitigations:

• Rotation: avoid >4 consecutive hours of solo triage
• Peer review: partner on complex escalations
• Rule retirement: rules that sustain >90% FP for 4+ weeks should be suppressed pending tuning
• FP tagging: automated reporting of high-volume FP rules to DE team weekly