Deciphering the Supply Chain Chessboard: The Science of Decision-Making in Risk Management

Humans make around 35,000 daily decisions, ranging from simple, routine choices to more complex, high-stakes ones (Pignatiello et al., 2020). In cybersecurity situations, decision-making accuracy is paramount, and emotions must be minimized to ensure objective choices are made (Korteling et al., 2023). Poor cybersecurity decision-making can have significant consequences, such as failure to protect sensitive data, prevent cyberattacks, or quickly respond to security incidents (Fischhoff & Broomell, 2020). The following qualitative study explored how these decision-making capabilities manifest in the cyber risk rating of third-party vendors, particularly under the influence of cognitive biases. The findings suggest that these cognitive biases can significantly impact the effectiveness of cybersecurity risk management. The study emphasizes the importance of addressing these biases to improve decision-making processes, suggesting that more objective and consistent evaluation methods could enhance the cybersecurity field's effectiveness and resilience.