Team Cognition in Adversarial Cyber Operations: Effects of Collaboration on Deception Susceptibility and Exploit Behavior

Cyber-attacks are increasingly carried out by cooperative groups, while current models of cyber deception studies assume an individual actor who is making decisions independently of others. The present study explores the effect of collaboration on exploit behavior and susceptibility to deception in a highly deceptive cyber environment. Specifically, using the Team HackIT human-in-the-loop simulation system, 40 undergraduate computer science students were asked to perform cyber exploitation tasks within a ring topology network in which 75% of the computers were honeypots. The participants worked either in isolation or in collaboration with their partners through a real-time communication tool. It was found that working together substantially increased exploit behavior and honeypot interaction, although it did not help the participants differentiate between legitimate machines and deceptive assets. These results imply that collaborative cognition expands exploration behavior but does not affect discriminative abilities of the attackers under uncertainty.