The Psychology of Defensive Cyber Deception Technology Adoption Across IT and OT Environments

Abstract

Defensive cyber deception is often described as a technical capability, but its adoption depends on how people interpret an intentionally deceptive security practice. This paper reframes cyber deception adoption as a psychological and perceptual problem involving awareness, trust, risk appraisal, perceived control, ethical legitimacy, self-efficacy, and decision confidence. The study combines secondary quantitative analysis of an existing deidentified survey dataset from ICS/OT professionals with an integrative synthesis of cyber deception literature from IT, security operations center, and operational technology contexts. The quantitative analysis found that perception-based factors explained substantially more variance in adoption readiness and effective utilization than education, years of experience, or sector. Self-efficacy and direct experience were the strongest predictors, followed by instructional support, performance expectancy, and security trust. The literature synthesis showed that IT and SOC adoption concerns center on workflow fit, use-case clarity, analyst confidence, and signal trust, while OT adoption concerns center on safety, operational control, and perceived risk. The paper proposes a Defensive Cyber Deception Acceptance Model that positions category awareness, legitimacy appraisal, trust, perceived control, and decision confidence as the psychological pathway through which deception technology becomes acceptable in practice.