Active Defense.

A defensive strategy that goes beyond passive monitoring to engage, mislead, and disrupt adversaries inside the defender's own network and assets. It belongs to the Defense & Operations category of cybersecurity.

A defensive strategy that goes beyond passive monitoring to engage, mislead, and disrupt adversaries inside the defender's own network and assets.

Active defense covers techniques that increase the cost and risk for attackers without crossing into illegal hack-back. It includes deception (honeypots, honeyfiles, decoy accounts), threat hunting, in-network engagement, tarpits, beacon-tainted documents, and intelligence gain/loss operations. The MITRE Engage framework formalised the discipline, replacing the older Shield project, and groups techniques such as collection, detection, disruption, reassurance, and motivation. Active defense is performed entirely on assets the defender owns or controls. It complements traditional detection and response by shaping attacker behaviour, generating high-quality telemetry, and producing actionable threat intelligence.

Defences for Active Defense typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Defensive cyber operations, Adversary engagement.