Defensibility in the cyber domain – A literature study

Authors:

  • Henrik Karlzén
  • Hannes Holm
  • Martin Karresand

Publish date: 2026-01-30

Report number: FOI-R--5850--SE

Pages: 43

Written in: Swedish

Keywords:

  • defensibility
  • cyber
  • cyber defence

Abstract

This report compiles research literature on protection and defence solutions that can affect the conditions for defence (defensibility) in the cyber domain. The report provides a first introduction to the relatively new topic of defensibility, by assessing how the researchers' solutions relate to defensibility. Since there are extremely many solutions, the report restricts its studies to solutions that use the terminology of the MITRE D3FEND framework. The vast majority of included research literature focuses on the framework's tactic of detection. This research mainly concerns network traffic analysis (77% of the papers), but also user behaviour analysis (7%), file analysis (6%) and others. The vast majority of the papers (85%) present solutions that are assessed to facilitate defensibility. Most of these are also focused on detection. The solutions that instead make defensibility more difficult, mostly concern isolation but also hardening, supplemented by detection and deception. Thus, defensibility seems to be facilitated primarily by detection, but is made more difficult by several different tactics. This also suggests that detection mainly increases defensibility, while architectural changes such as hardening and isolation are more likely to reduce defensibility. The papers themselves do not discuss the solutions' impact on defensibility. The reason for the lack of discussions suggests that those who propose technical solutions do not usually consider the role of the defender. However, some of the papers mention the human, and mainly how the solutions can provide visualisation of logs. To assess how applicable the researchers' solutions are in practice, the report also makes assessments of the solutions' maturity and quality. Assessments are also made of what type of input data the solutions use, primarily in terms of whether the data is from real systems. The vast majority of solutions produced by the research are at most prototypes in a lab environment (TRL 3-4). Only 16% of all papers were assessed to be of high quality. Of the 198 papers studied, 172 conduct some type of data collection. There are only 29 papers (15%) that use public datasets with data from real systems.