Cognitive Biases in Cyber Attacker Decision Making: Translating Behavioral Insights Into Cybersecurity

Cognitive biases shape human decision making, yet their role in cybersecurity remains under-explored. Notably, little research examines whether cyber attackers succumb to cognitive biases-an insight that could inform defense strategies. This study addresses this gap by testing whether traditional cognitive biases replicate in a cybersecurity context. We develop cybersecurity-specific versions of three biases: Availability (Frequency and Recall), Recency, and Loss Aversion (Endowment, Gain, and Loss Framing). A within-subjects experiment compared responses to bias problems in cybersecurity and non-security contexts. The results indicate a successful translation of Frequency, Recency, Endowment, and Loss Framing biases to cybersecurity. However, Recall and Gain Framing biases did not translate effectively. Interestingly, many participants who exhibited bias in the general context did not in the cybersecurity context. Individual-level analyses suggest that participants engage in more deliberate reasoning when faced with cybersecurity-related problems, whereas they rely more on intuition in general scenarios. These findings underscore the nuances of designing cybersecurity scenarios that use cognitive biases but suggest that designing cyber defenses according to cognitive biases can be a successful strategy.