Thinking Outside the SOC: Structured Analytics for the Overloaded Cyber Analyst

The talk opens with a 2 AM incident in which a SOC alert about suspicious PowerShell grows into credential dumping, lateral movement and possible exfiltration. The speakers argue that threat intel, DFIR and hunting analysts all work under pressure and are prone to cognitive biases such as anchoring and confirmation bias, and that structured analytic techniques offer repeatable checks against them.

The presenters walk through key assumptions check, indicators and warnings, alternative futures analysis and analysis of competing hypotheses, the last scoring evidence against several hypotheses in a matrix. They link these methods to the intelligence cycle, MITRE ATT&CK and the Diamond Model, such as using competing hypotheses to test actor attribution. Three scenarios follow: a North Korean IT worker insider threat, a scenario-based estimate of Iranian cyber retaliation against US critical infrastructure, and a ransomware case where Scattered Spider and a Black Basta affiliate are weighed against each other.

The closing point is that these techniques do not remove uncertainty or time pressure, but a few hours of structured work can produce a documented rationale for leadership and sharpen where hunts should focus. In the Q&A, the presenters explained that likelihood figures in the scenario work are analyst judgement rather than calculated values, and that outputs can be a matrix or a short intel product with indicators for hunt teams.