Audience-Channel Matrix¶
Analysis tool — instantiates Deception Blowback Containment
Maps every intended and unintended receiver of a planted signal across each channel, then scores where it is most likely to be exposed, re-enter friendly systems, or be trusted by one's own side.
A deception only stays contained if you know where it can travel. Audience-Channel Matrix is the planning instrument that lays out, in a single grid, every receiver a planted signal could reach — the intended target and, crucially, the unintended friendly ones (allies, archives, dashboards, analytics models, partner feeds, new hires) — against every channel that could carry it, and scores each cell for how likely the signal is to be exposed there, loop back into friendly systems, or be acted on by one's own side. It is upstream of every other containment move: it restricts, corrects, and logs nothing itself. Its one job is to produce the map that tells the rest of the program where a boundary is even needed.
Example¶
A security team plans to scatter decoy credentials — honeytokens — across its network so that any intruder who uses one trips a silent alarm. Before deploying, they build an Audience-Channel Matrix. Down the side go the receivers: the external intruder (the intended dupe), the SOC analysts, the alerting pipeline, the anomaly-detection model, the threat-intelligence feed they share with two peer organizations, the backup archive, and next quarter's new hires reading the runbooks. Across the top go the channels: live alerts, tickets, logs, the shared intel feed, backups. Each cell gets a quick score for exposure, re-entry, and friendly reliance.
One cell lights up hot: a triggered honeytoken would flow into the shared intel feed and be ingested by a partner — and by their own anomaly model — as a genuine indicator of compromise. That single red cell is the finding. It tells them to mark the honeytoken's provenance and keep it out of the shared feed before a single decoy is planted — turning "who might see this?" from a hunch into a scored grid the rest of the program can act on.
How it works¶
- Cross-tabulate receivers against channels. Enumerate not just the intended target but every friendly party and system the signal could reach downstream — allies, archives, analytics, models, partners.
- Score each cell. Rate the intersections on a few axes — likelihood of exposure, of re-entry into friendly decision systems, of amplification, of friendly reliance — on a coarse scale.
- Read the heat map. The hot cells rank where containment effort must go; the tool's output is a prioritization, not a verdict.
Its defining limit: it identifies where a boundary is needed but imposes none — that is the job of the mechanisms downstream of it.
Tuning parameters¶
- Receiver granularity — individuals vs teams vs whole systems; finer lists surface hidden friendly receivers but bloat the grid.
- Channel-path depth — how many hops downstream you trace (immediate channel only, or archives → analytics → models → partners). Deeper tracing catches the sneaky re-entry loops but costs analysis time.
- Scoring axes and scale — which risks you score and how finely; a three-point scale is fast, a weighted score is more discriminating and more false-precise.
- Hot-cell threshold — how high a score triggers a mandated boundary; set it low and you over-contain, high and you miss a path.
- Refresh cadence — one-shot at planning vs re-scored as channels and partners change.
When it helps, and when it misleads¶
Its strength is that it forces into view the friendly receivers planning routinely forgets — the archive that will be mined years later, the model that will train on the log, the partner who shares your feed. It converts scattered worry about "where could this leak?" into a ranked, inspectable grid, and gives every downstream mechanism a defensible reason for where it draws its lines. Structured deception-planning practice treats mapping receivers and channels as a first-order step for exactly this reason.[n1]
Its failure mode is that the map is only as complete as the channels someone thought to list: the path that causes blowback is usually the one not on the grid, and a tidy matrix breeds false confidence that the blanks are safe rather than merely unexamined. Its classic misuse is inversion — repurposing the same receiver map to make the deception land harder on the adversary rather than to protect one's own side, quietly turning a containment tool into an offensive one. The discipline that guards against both is to red-team the matrix for missing receivers and channels, and to treat every blank cell as unknown, not clear.
How it implements the components¶
Audience-Channel Matrix fills only the mapping component — the one an analysis tool can produce:
audience_and_channel_path_map— the matrix is this map: the enumerated receivers-by-channels grid, scored for exposure and re-entry.
It does not draw the need-to-know boundary the map implies (that is Compartmented Briefing), record the artifact in a standing ledger (Deception Blowback Register), or watch for the signal's actual return over time (Re-Entry Red-Team Review) — it only produces the map those mechanisms act on.
Related¶
- Instantiates: Deception Blowback Containment — the matrix supplies the exposure map the rest of the containment depends on.
- Sibling mechanisms: Compartmented Briefing · Deception Blowback Register · Friendly Reliance Probe · Re-Entry Red-Team Review · Truth Anchor Memo · Synthetic or Exercise Marker
Editorial Notes¶
Form Classification¶
Form family: Analysis, Modeling & Optimization
Rationale: Maps every intended and unintended receiver of a planted signal across each channel, then scores where it is most likely to be exposed, re-enter friendly systems, or be trusted by one's own side, making its operative form a computation or analytic transformation that produces an inference, comparison, or optimized result.
Independent corroboration: The frozen evidence defines Audience-Channel Matrix as 'Maps every intended and unintended receiver of a planted signal across each channel, then scores where it is most likely to be exposed, re-enter friendly systems, or be trusted by one's own side', so its operative form is Analysis, Modeling & Optimization.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Security Studies & Intelligence Analysis
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Specialized
Rationale: Deception and intelligence operations map intended targets, friendly audiences, channels, and blowback before planting signals.
Related originating lineages:
- Communication & Media Studies — Audience segmentation and channel analysis explain exposure and re-entry routes.
- Military & Strategic Studies — Military deception doctrine contributes operational compartmentation and friendly-force protection.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Independent reviewer agreement; high confidence.
Notes¶
The matrix is a planning input, not a live control, and it goes stale the moment a new channel or partner appears. Its most dangerous output is a blank cell read as "safe"; treat blanks as unexamined and re-score when the channel landscape changes.
[n1] MITRE Engage is a public framework for planning adversary engagement, denial, and deception; mapping the audiences and channels an operation will touch is the kind of first-order planning step such frameworks call for — here turned toward containing friendly blowback rather than engaging an adversary. ↩