Proactive vs Reactive: Three Decision Strategies in Cybersecurity

How to beat the attacker's advantage

Decision effectiveness over time for three strategies Three decay curves compared against a dashed minimum decision effectiveness line. Reactive Precision drops fastest and crosses the minimum first. Reactive Response drops more slowly and crosses it second. Proactive Defense starts highest and levels off above the minimum line without crossing it. Highereffectiveness Lowereffectiveness Decisioneffectiveness Fast decisions(short time) Slow decisions(long time) Time to decide Minimum decisioneffectiveness Recon andPreparation InitialCompromise Lateral Movement Objectives Attacker's advantage Proactive Defense Defender's battlefield Attacker's battlefield Reactive Precision reaches the threshold Death by Friction Time to DecideExceedsTime to Act Reactive Response (SOC) reaches the threshold Control passes to the attacker SOC Decision Window Defender can still influence the outcome Reactive Precision Reactive Response (SOC) Proactive Defense (CROC) Defender advantage Cyber resilienceCyber resilienceCyber resilience 1st hand-off: CROC decides Proactive takes over 2nd hand-off: SOC executes Pre-authorized response Continuous defense loop Learn & improve Proactive Defense (PD) EPD(t) = 0.30 + 0.60 e−6t Initial value (t = 0): 0.90 Decay rate (kPD): 6 Long-term value: 0.30 Maintains effectiveness over time, approaching the minimum decision effectiveness without crossing it. Reactive Response (SOC) ERR(t) = 0.70 e−5t Initial value (t = 0): 0.70 Decay rate (kRR): 5 (medium) Long-term value: 0 Effectiveness decreases as the SOC responds to incidents but loses impact over time. Reactive Precision (RP) ERP(t) = 1.00 e−12t Initial value (t = 0): 1.00 Decay rate (kRP): 12 (high) Long-term value: 0 Effectiveness drops quickly as new information becomes available. Generic Formula (Exponential Decay) E(t) = A e−kt E(t) = Effectiveness at time t A = Initial effectiveness (value at t = 0) k = Decay rate (how fast effectiveness decreases) t = Time to decide Effectiveness decreases exponentially over time. A higher decay rate (k) means a faster loss of effectiveness. Generic Formula (Exponential Decay) E(t) = A e−kt E(t) effectiveness · A initial value · k decay rate t time to decide
Figure 1. Decision effectiveness against time to decide for three strategies. Each curve decays over time; the dashed line marks the minimum effectiveness at which a decision can still change the outcome.

Use the arrow keys to move through the steps.

Article: Reactive Precision Crashes. Reactive Response Fails. Proactive Defense Wins., Juan Pablo Castro Vilaró. DOI: 10.13140/RG.2.2.12466.98244/1