Cognitive traps in triage
Every phase of ASSURED assumes an analyst who reads evidence and updates on it. Under queue pressure, that is not the mind’s default. The default is a set of shortcuts that are fast, feel like reasoning, and fail in predictable directions: the wrong story gets picked early, or the right decision gets made late. This page names the eight traps that do the most damage in triage, gives each one a tell you can catch in your own work, and points at the device in the methodology built to counter it.
Traps, not character flaws
None of these are marks of a weak analyst. They are the standard operating behavior of any mind processing hundreds of similar-looking cases under time pressure, and experience alone does not remove them; it often deepens them, because experience supplies more patterns to match against. The counters below are structural for exactly that reason: a device you run every time beats a bias you promise to watch for.
Traps that pick the wrong story
Anchoring bites in Alert, carries everywhere
The trap: the first label you read becomes the reference point everything else adjusts around. An alert titled “Critical: credential dumping detected” is a rule author’s shorthand for what the logic tries to catch, but it lands as 90% of a verdict before a single field has been read, and every finding after it gets measured against that starting story.
The tell: your working hypothesis is the alert title with the punctuation changed, and your close note restates the rule name instead of the evidence.
The counter: the Alert phase exists to break the anchor: the alert is a claim to validate, not a verdict to confirm. Read the raw fields before the severity. The hypothesis ledger then forces at least one competing explanation to stay alive past the first impression.
Confirmation bias bites in Uncover
The trap: once a theory is on the table, queries get designed to prove it. Hits confirm the theory; empty results get explained away as logging gaps; the investigation becomes a search for support rather than a test.
The tell: every pivot you ran today returned “supporting” evidence, the evidence-against column of your ledger is empty, and you cannot name the result that would change your mind.
The counter: the ledger’s evidence-against column is not optional decoration; a hypothesis with an empty against-column has not been tested, only decorated. Ask the disconfirming question explicitly: what would this look like if it were benign, and did I run that query? Recording negative results is part of the timeline discipline, and the deeper tradition behind it is ACH, covered on Where ASSURED sits.
Tunnel vision and premature closure bites in Uncover and Risk
The trap: the first coherent story wins. Once the narrative feels complete, the remaining work quietly changes from investigating to decorating: new evidence that fits gets added, new evidence that does not fit gets classified as noise.
The tell: your timeline stopped growing an hour ago but your queries have not, and the last three anomalies you found were all filed as unrelated.
The counter: Uncover ends on stopping rules, not on narrative satisfaction: the phase closes when the questions are answered or the sources are exhausted, and “the story feels done” is neither. Evidence that does not fit the story goes in the ledger as a live hypothesis, not in the discard pile.
Availability bias bites in Subject and Risk
The trap: the most recent or most vivid case becomes the diagnosis for this one. After a month spent on a token-theft incident, every OAuth consent looks like AiTM; the memorable case outweighs the common one because it comes to mind faster, not because it is more likely.
The tell: your likelihood assessment cites a war story (“we saw exactly this in March”) instead of this case’s own evidence and base rates.
The counter: the Risk framework forces likelihood to be argued from the evidence in front of you, and behavioral baselines replace “what I remember” with “what this entity actually does”. The March case earns a line in the ledger as one hypothesis; it does not get to skip the queue.
Traps that mis-time the decision
Automation bias bites in every phase, sharpest with AI assistants
The trap: output that is fluent, complete, and confident reads as verified. A tool verdict, an enrichment score, or an AI-drafted summary gets signed because it looks finished, and looking finished is precisely what these systems are best at.
The tell: you cannot point to the raw field behind a claim you are about to sign. The draft existed, so the box got checked.
The counter: the verification discipline from AI-assisted triage: decoded strings get checked against the raw field, pivot hops against the actual lease and timestamp, rule summaries against the rule logic. The phase-gate signature means the analyst verified the draft, never merely that the draft existed.
The pattern reflex bites in Alert and the fast path
The trap: the 200th occurrence of an alert gets the 200th identical close. Alert Fatigue The desensitization of security analysts to alerts due to high volumes of notifications, potentially leading to missed critical threats. hardens “it is always the scanner” from an observation into a reflex, and the one time it is not the scanner, the reflex closes it anyway. Recognition replaces checking.
The tell: a close in seconds with no discriminator recorded, on an alert type whose benign rate you would quote as “basically 100%”.
The counter: the depth ladder makes the reflex safe instead of forbidding it: a Level 0 close is legitimate only when the pattern’s discriminators are checked and recorded, and the discriminator is exactly the field that separates the scanner from the attacker imitating it. Repetition itself is a finding: alert types that close benign every time are tuning and suppression work, not a personal endurance test.
Sunk cost bites in Risk and Escalation
The trap: three hours into an investigation, “benign” feels like admitting the three hours were wasted, so severity quietly inflates to justify the time. The inverse is just as common: escalating feels like admitting you could not close it, so the case stays open one more query at a time.
The tell: your verdict correlates with time spent rather than evidence found, or you notice you are relieved by an ambiguous result because it justifies continuing.
The counter: the escalation criteria are pre-committed answers, decided before any time was invested in this case, and the break-glass rule fires them from any phase the moment a criterion confirms. In the other direction, a benign close is not waste: the false-positive-as-finding doctrine means the three hours bought the SOC a better detection.
Deference bites in verdicts and documentation
The trap: a senior analyst’s offhand “probably the scanner again”, a vendor’s Critical badge, or a threat-intel feed’s score substitutes for the evidence. Authority and social proof are useful priors and terrible verdicts; both arrive with confidence uncorrelated to this case.
The tell: the close note cites a person or a product where it should cite a log line.
The counter: documentation standards require the record to stand alone: every claim carries how it is known, and confidence labels distinguish “confirmed in the log” from “reported by the tool” from “assumed”. A senior’s hunch is a hypothesis for the ledger, welcome there and only there, until the evidence promotes it.
Running the counters
Two habits make the counters real rather than aspirational. First, run them on your confident cases, not just your uncertain ones; the traps above are most dangerous precisely when the case feels obvious, because that feeling is what several of them produce. Second, use the worked examples as calibration: each chapter’s example includes “what a less experienced analyst could miss” callouts, and nearly every one of those misses is one of these eight traps wearing case-specific clothing.
Key Takeaway
The methodology’s devices are the debiasing layer: the hypothesis ledger counters anchoring and confirmation, the stopping rules counter tunnel vision, verification-before-signature counters automation bias, discriminators counter the pattern reflex, and pre-committed criteria counter sunk cost. They are not paperwork around the thinking; run every time, they are what keeps the thinking honest.