What Is Active Defence in Cyber Security?

What active defence means

The Australian Cyber Security Centre defines active defence as proactively implementing a spectrum of security measures to strengthen a network or system and make it more robust against attack. It separates active defence from passive defence, offensive cyber operations, and hacking back.¹

That definition is broad enough to cover different technologies and operating models, but the practical idea is straightforward:

Do not only wait for an attacker to create an obvious incident. Shape the environment so suspicious behaviour becomes visible earlier, then use that signal to support a controlled defensive response.

An active-defence control normally does at least one of four things:

1. Exposes behaviour that would otherwise be difficult to see.
2. Collects evidence about the interaction and its context.
3. Slows, redirects, or contains activity inside approved boundaries.
4. Improves response by sending a higher-confidence signal to the right people and tools.

The control is active because it deliberately changes what an adversary encounters or how the defender responds. It is still defence because its purpose is to protect the organisation, not to retaliate outside the environment.

Why the term causes confusion

“Active defence” is used differently across government, military, legal, and commercial contexts. Some definitions include limited offensive action or counterattack; others use the term for proactive defensive activity.¹

For cyber-security teams, two current government examples help establish a useful boundary:

• The ACSC says active defence strengthens a system proactively and is not synonymous with hacking back.¹
• The UK National Cyber Security Centre uses Active Cyber Defence for protective tools and services intended to reduce harm from cyber attacks, including automated protections delivered at scale.²

For FIRCY and this guide, active defence means defensive early warning and response enablement within an approved scope. It does not include unauthorised access to an attacker’s infrastructure.

Active, passive, and offensive activity

The categories are not a maturity ladder. A strong security program needs passive controls and active measures working together. The ACSC’s passive-defence definition includes logging, monitoring, firewalls, application hardening, patching, and antivirus.³ Active defence adds deliberate exposure and response; it does not make those foundations optional.

The active-defence loop

Active defence is better understood as a loop than as a single product:

1. Prepare: choose a risk, asset, identity, or attack path that matters.
2. Instrument: place a safe signal, decoy, rule, or control where suspicious activity can be observed.
3. Detect: capture interaction that should not occur during normal business activity.
4. Understand: enrich the event with identity, device, cloud, network, application, and threat-intelligence context.
5. Respond: notify, investigate, contain, redirect, block, or escalate through approved workflows.
6. Learn: use the evidence to improve detections, architecture, decoy placement, and incident playbooks.

This loop matters because a decoy without telemetry is just a fake object, and an alert without an owner is just another queue item.

MITRE Engage makes a similar point about adversary engagement. It treats cyber denial and deception as goal-driven activities supported by strategic planning and analysis, rather than a technology that can be deployed and forgotten.⁴

What active defence includes

There is no single required toolset. In an enterprise security program, active defence can include several related practices.

Cyber deception and controlled decoys

Cyber deception places believable but controlled objects where an attacker, compromised account, malicious insider, malware process, or automated tool may discover them.

Examples include:

• Decoy credentials and session tokens.
• Synthetic documents and sensitive-looking files.
• Decoy identities, personas, groups, and service accounts.
• Fake application routes, API references, and admin paths.
• Decoy cloud storage, export paths, and service references.
• Honeypots, honeynets, and decoy network services.

MITRE D3FEND defines a decoy object as something created and deployed to deceive attackers. Its guidance says these objects normally have no legitimate business purpose and that communication with them should be logged and analysed.⁵

That “no legitimate business purpose” property is what can make deception signals unusually specific. A failed login to a real account may be a user mistake. An attempt to use a credential that exists only as a monitored decoy has a much smaller set of benign explanations.

High-confidence early-warning signals

Active defence can instrument “should never happen” behaviour:

• A credential that should never authenticate is tested.
• A synthetic document is opened outside its expected context.
• A hidden application path is enumerated.
• A decoy identity is queried or used.
• A fake cloud export path is accessed.
• A decoy service receives an unexpected connection.

These signals can reveal reconnaissance, credential discovery, lateral movement, data-access intent, or misuse of a trusted identity before the same actor reaches a real high-value asset.

Contextual detection and threat intelligence

The interaction is only the starting point. A useful active-defence workflow adds context such as:

• Source IP address, ASN, location, and infrastructure history.
• Identity, session, role, and authentication details.
• Endpoint, cloud, application, and network events around the same time.
• The specific decoy and where it was placed.
• Related interactions with other controlled signals.
• Likely tactics, techniques, and investigation hypotheses.

This turns a raw tripwire into evidence that can support triage, hunting, incident response, and cyber threat intelligence.

Carefully governed response

Response can range from low-risk automation to disruptive containment.

Start with reversible, observable actions. Add disruptive automation only after signal quality, ownership, approvals, and rollback have been tested.

Practical active-defence examples

The common pattern is not “trick the attacker for as long as possible.” It is create a safe interaction that produces evidence early enough to change the outcome.

What active defence is not

It is not hack-back

Hacking back means accessing, disrupting, or damaging infrastructure believed to be associated with an attacker. Attribution is uncertain, infrastructure may belong to an innocent third party, and the activity can cross legal and operational boundaries.

Active defence does not require that behaviour. The ACSC explicitly states that active defence and hacking back should not be treated as interchangeable terms.¹

A useful test is:

Does the action protect or observe an environment you are authorised to defend, or does it access someone else’s system?

If it requires accessing external infrastructure without authority, it falls outside the definition used here.

It is not a replacement for foundational security

Active defence does not replace:

• Asset inventory and attack-surface management.
• Secure configuration and patching.
• Multi-factor authentication and identity governance.
• Endpoint, cloud, network, email, and application security.
• Vulnerability management and penetration testing.
• Central logging, SIEM, and incident response.
• Backups and recovery planning.

It adds another source of signal and another way to influence an attacker’s path.

It is not ungoverned surveillance

Controls that monitor employee, contractor, customer, or third-party behaviour need a documented defensive purpose, appropriate data handling, and review by the relevant security, legal, privacy, HR, and management stakeholders.

It is not “set and forget”

Decoys can become stale, normal automation can create unexpected triggers, and infrastructure changes can break telemetry. Active-defence controls need owners, inventories, tests, maintenance, and retirement dates.

Why teams use active defence

Earlier warning

Traditional detections often fire after an attacker has used a real account, reached a real system, or produced enough abnormal behaviour to cross a threshold. Active defence can create a signal at the discovery or validation stage.

Higher signal confidence

When an object has no legitimate purpose, interaction is easier to explain than a broad anomaly. That does not make every alert malicious, but it gives analysts a strong and specific investigation starting point.

Better investigation context

Unique decoys can identify where a credential, file, token, or service reference was found. That placement context can narrow the affected system, user, repository, document, or workflow.

Greater adversary cost

Deception can force an attacker to spend time validating what is real. MITRE Engage describes adversary engagement as using denial and deception to increase the cost and reduce the value of adversary operations.⁴

NIST’s cyber-resiliency guidance similarly discusses reducing adversary impact by impeding lateral movement, increasing adversary work factor, and reducing time on target.⁶

A clearer bridge to response

A specific signal with identity, asset, and source context is easier to route into a playbook than an unexplained anomaly. That can shorten the path from detection to investigation, containment, or recovery.

Limitations and risks

Active defence is useful, but it is not automatic proof of compromise and it is not risk-free.

Normal tools may touch the decoy

Search indexers, backup software, vulnerability scanners, data-loss-prevention tools, link preview services, security products, and administrators may interact with a decoy. Deployment planning should identify these sources before assigning severity.

Poorly designed decoys can create risk

A decoy should generate evidence, not access. It must not expose real customer data, production credentials, useful privileges, or a trust path into production.

Unrealistic decoys may be ignored

Believability comes from matching local naming, metadata, placement, and workflows. A generic decoy placed far away from likely attacker paths may add little value.

Automation can amplify a mistake

An incorrect signal is inconvenient when it creates a ticket. It can be disruptive when it automatically disables an executive account, blocks a business partner, or isolates a production system. Use confidence thresholds and proportional actions.

It still needs a strategy

The NCSC’s 2025 cyber-deception trials found that deception can provide value, but is not plug-and-play. The NCSC highlighted the need for the right data, context, strategy, maintenance, and safe configuration; otherwise a deployment can produce noise, miss threats, or introduce a false sense of security.⁷

Where active defence works well

Active defence is especially useful when a team can describe a behaviour that should rarely or never occur.

Good starting points include:

• Credential discovery: detect testing or reuse of decoy credentials.
• Identity misuse: reveal access to synthetic identities, roles, or privileged-looking paths.
• Lateral movement: detect enumeration of decoy systems, shares, services, or credentials.
• Cloud and SaaS reconnaissance: monitor decoy objects, applications, exports, and service references.
• Sensitive document access: reveal interaction with synthetic intellectual property, financial, customer, or operational material.
• Application probing: detect access to fake admin routes, APIs, records, or service endpoints.
• Internet-facing reconnaissance: collect early evidence from interaction with controlled services and pages.
• Threat-intelligence collection: observe source infrastructure, tooling, behaviour, and targeting around controlled signals.

The best first use case is normally narrow, tied to a real risk, and owned by a team that can investigate the alert.

How to start safely

1. Define one defensive objective

Choose the behaviour you need to reveal. “Detect use of a decoy cloud credential found in an internal repository” is testable. “Deploy active defence everywhere” is not.

2. Map the likely attacker path

Identify where an attacker, compromised account, insider, malware process, or automated agent would search before reaching the real asset.

3. Select a safe signal

Use a decoy credential, file, identity, path, record, service, or policy trigger that has no legitimate production purpose and cannot grant meaningful access.

4. Confirm telemetry

Make sure the interaction produces enough evidence to answer:

• What was touched?
• Where was it placed?
• Which identity, device, session, or source was involved?
• What happened immediately before and after?

5. Build the response before deployment

Decide who receives the alert, how it is validated, what context is required, when it becomes an incident, and which containment actions are permitted.

6. Test benign and malicious-looking paths

Confirm the signal fires, the alert identifies the placement, legitimate automation is understood, and the response can be reversed.

7. Measure operational value

Useful measures include:

• Signal fidelity and explainability.
• Time from interaction to detection.
• Time from detection to useful triage.
• Investigation context supplied with the alert.
• Coverage of the selected attack path.
• False-positive sources and maintenance effort.
• Whether the alert changed a defensive decision or outcome.

For a fuller deployment exercise, use the cyber deception readiness checklist.

How FIRCY Sense uses active defence

FIRCY Sense uses cyber deception as a controlled early-warning layer. Decoys, lures, credentials, services, application paths, and other signals are placed where suspicious users or adversaries may interact with them. That interaction becomes evidence and context for investigation, threat intelligence, and response.

The operating pattern is:

1. Place a controlled signal near a relevant attacker path.
2. Detect suspicious interaction that should not occur in normal operations.
3. Add source, identity, infrastructure, behavioural, and historical context.
4. Deliver the finding into existing SIEM, SOAR, ticketing, collaboration, WAF, cloud, or custom workflows.
5. Support an analyst-guided or carefully automated defensive response.

FIRCY participated in the UK NCSC’s cyber-deception work under its Active Cyber Defence 2.0 programme. The NCSC listed FIRCY among the commercial providers that supported product trials and onboarding observations.⁷

Explore the FIRCY Sense platform, deception-generated threat intelligence, and security integrations for more detail.

A simple active-defence checklist

• We can name the risk or behaviour we want to expose.
• The activity stays inside systems and workflows we are authorised to protect.
• The decoy or control cannot grant useful production access.
• Normal users and automation should not trigger it routinely.
• Interaction produces reliable telemetry and placement context.
• Someone owns triage and escalation.
• Automated actions are proportional, approved, logged, and reversible.
• Legal, privacy, HR, and third-party considerations have been reviewed where relevant.
• The control complements rather than replaces foundational security.
• The deployment has a test, maintenance, and retirement plan.

Sources and further reading