Lion Cipher Lab
Analysis of Competing Hypotheses: was the outage an attack or a fault?
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The most expensive mistakes in security are not missed alerts — they are confident conclusions that were wrong. A team decides an outage 'was obviously an attack' and burns two days chasing a phantom adversary while the real cause, a botched config change, sits untouched. Or the reverse: they wave off a genuine intrusion as 'probably just a glitch' because the glitch explanation was more comfortable. The reason smart people make these errors has a name — confirmation bias — and it is not a lack of intelligence, it is how every human brain is wired: we latch onto the first plausible answer and…
What you'll learn
- running Analysis of Competing Hypotheses (ACH) end to end on a real question
- recognising and countering confirmation bias in your own reasoning
- listing mutually exclusive, collectively exhaustive hypotheses instead of jumping to one answer
- building an evidence-by-hypothesis matrix and scoring each cell for consistency
- judging the DIAGNOSTICITY of evidence — telling evidence that distinguishes hypotheses from evidence that does not
- reaching a defensible conclusion by DISPROVING hypotheses rather than confirming a favourite
- testing how sensitive a conclusion is to its few critical pieces of evidence
- writing up an assessment that discusses all the hypotheses, with confidence, not just the winner
Steps in this lab
- The words first: hypothesis, evidence, and confirmation bias
- The one idea that inverts your intuition: disconfirmation and diagnosticity
- The eight steps of ACH (your roadmap for the rest of the lab)
- The scenario: 47 minutes of darkness
- Steps 1 & 2: list every hypothesis, then the evidence
- Step 3: build the matrix and score each cell for consistency
- Step 4: find the diagnostic rows — and delete the non-diagnostic one
- Step 5: draw the conclusion by DISPROVING — count the inconsistencies
- Steps 6-8: sensitivity, honest reporting, and what to watch next
- Now do it yourself — and keep the habit