Defensibility in the cyber domain - A interview study
Publish date: 2026-06-24
Report number: FOI-R--5854--SE
Pages: 38
Written in: Swedish
Keywords:
- defensibility
- defensive cyber operations
- DCO
- cyber domain
- cyber attack
Abstract
This study investigates properties which affect the defensibility of systems and platforms in the cyber domain. The research comprised a qualitative interview study where ten individuals with connections to the Swedish Armed Forces cyber defense and expert knowledge in the area of Defensive Cyber Operations (DCO) were selected as respondents. More specifically, the interviewees had hands on experience in at least one of the following operational areas: Sensor Analysis (SA), Deployed Actions (UV), Incident Response (IH) or Internal Countermeasures (MÅ). The collected data was evaluated through a thematic analysis, where the respondents' descriptions resulted in five overarching themes. The identified themes consist of system design with focus on defensibility mechanisms, terrain knowledge as a prerequisite for active defense, preparing defensive cyber operations through organisational understanding of defensibility, adapting the military context to integrate defensibility in the cyber domain and interaction between static protection andactive defense. The results of the study describe system attributes related to detection as enabling for DCO and enhancing for the defensibility of systems and platforms in the cyber domain. Furthermore, processes for requirement specifications of systems andplatformsinthecyberdomainmustbeadaptedinordertoprovidethe necessary defense measures and thus ensure balance between static protection and active defense. Lastly, the results indicate a need for organisational understanding of defensibility in order to provide operators with sufficient resources during DCO.