COGNITIVE SECURITY : AN EMPIRICAL ANALYSIS OF COGNITIVE BIASES AND THEIR IMPACT ON INCIDENT RESPONSE AMONG IT PROFESSIONALS IN SRI LANKA

This Master's thesis investigates how cognitive biases influence cybersecurity incident response decision-making among IT professionals in Sri Lanka. Drawing on interdisciplinary insights from cognitive psychology, cybersecurity, and human-computer interaction, the study identifies the prevalence and impact of biases such as confirmation, anchoring, availability, overconfidence, and hindsight during high-pressure decision-making. Using a survey aligned with the NIST Cybersecurity Framework and analyzed through exploratory factor analysis, clustering, and principal component analysis, the research reveals distinct cognitive responder archetypes and bias-moderating factors at individual and organizational levels. A key practical outcome of the study is the development of a policy handbook—The Cognitive Security Playbook—which provides actionable strategies to mitigate bias and improve decision quality in real-world IT environments. This work contributes a novel empirical and policy-oriented perspective to the emerging field of cognitive security.