Security Decision Psychology

5 automated security scanners

Intelligence Dismissal Patterns

Purpose: The Intelligence Dismissal Patterns Scanner is designed to analyze breach disclosure language and detect patterns that suggest selective evidence processing, confirmation bias in threat assessment, and ignored warnings. This tool helps organizations identify if they are downplaying threats, ignoring critical information, or dismissing warnings that could indicate deeper security issues.

What It Detects:

Blame Deflection Patterns: The scanner identifies phrases such as “nation-state actor,” “state-sponsored,” which may indicate external blame without evidence and terms like “highly sophisticated,” “unprecedented level,” or “zero-day exploit” used to mask basic vulnerabilities.
Passive Voice Usage: It detects sentences in the passive voice, such as “systems were accessed,” “data was compromised,” which avoid direct accountability. Additionally, descriptions that omit the actor responsible for the breach are noted.
Minimization of Impact: The scanner picks up statements like “limited number of records affected” or “no evidence of impact,” and phrases indicating precaution without concrete findings such as “out of an abundance of caution.”
Ignored Warnings and Precedents: It identifies prior warnings being dismissed with downplaying their significance, and recurrent issues not addressing underlying causes.
Confirmation Bias in Threat Assessment: The scanner highlights overemphasis on external threats while ignoring internal security failures, as well as selective evidence processing focusing only on favorable information.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com). This is the target website where breach disclosure statements are sought.
company_name (string): Company name for statement searching (e.g., “Acme Corporation”). This helps in identifying relevant breach disclosure statements specific to the company.

Business Impact: Identifying and addressing these dismissal patterns is crucial as they can lead to a false sense of security, inadequate preparation against potential threats, and hinder effective risk management. It directly impacts an organization’s ability to protect sensitive information and maintain trust with stakeholders.

Risk Levels:

Critical: Conditions that could result in immediate negative consequences on the organization’s operations or reputation, requiring urgent attention and potentially triggering legal or regulatory actions.
High: Conditions that pose significant risks but do not necessarily lead to critical outcomes immediately, such as substantial data breaches or major system failures.
Medium: Conditions that indicate moderate risk, which might require mitigation strategies but are less severe than those classified as high.
Low: Conditions with minimal impact on security posture, typically requiring routine monitoring and adjustments rather than immediate action.
Info: Informational findings that provide insights into potential issues without being critical or highly risky in nature.

Example Findings:

“The breach disclosure statement mentions a ‘highly sophisticated’ attack vector but does not specify the exact method used, which might indicate an attempt to downplay the actual level of threat.”
“A previous warning about a similar vulnerability was acknowledged but dismissed as having no direct impact on current systems, suggesting continued risk without proper mitigation.”

Risk Perception Distortion

Purpose: The Risk Perception Distortion Scanner is designed to analyze breach disclosure language and identify cognitive biases such as recency bias, availability heuristic, and overconfidence in controls. Its purpose is to help organizations understand how they might misrepresent security incidents to downplay risks or shift blame, thereby enhancing their ability to manage risk perception more effectively.

What It Detects:

Blame Deflection Patterns: The scanner detects patterns such as nation-state actor claims without evidence, sophisticated attack framing, third-party vendor blame, and rogue employee scapegoating.
Passive Voice Usage: It identifies phrases indicating passive voice usage which can obfuscate the severity of an incident.
Minimization of Impact: The scanner detects statements that minimize the extent or severity of the breach, potentially downplaying the seriousness of the risk.
Overconfidence in Controls: It flags claims of advanced detection capabilities without evidence and vague statements about security measures.
Recency Bias and Availability Heuristic: The scanner focuses on recent or highly publicized incidents over long-term trends and emphasizes specific, memorable events rather than comprehensive risk management.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com). This input helps in identifying the relevant breach disclosure statements from a company’s website.
company_name (string): Company name for statement searching (e.g., “Acme Corporation”). This input is used to structure the output file and contextually search for related information on the company’s site.

Business Impact: Understanding and managing risk perception is crucial for maintaining a robust security posture. Misrepresentation of risks can lead to inadequate allocation of resources, misallocation of trust, and potentially catastrophic consequences if not properly addressed. Detecting these biases early allows organizations to take proactive measures to mitigate potential threats more effectively.

Risk Levels:

Critical: The scanner identifies clear evidence of nation-state involvement without any supporting evidence or highly sophisticated attacks with no prior indications.
High: Sophisticated attacks are claimed, but there is a lack of detailed information or specific evidence pointing towards such an attack.
Medium: Statements that minimize the impact of the breach, suggesting limited consequences despite clear evidence to the contrary.
Low: Vague statements about security measures without concrete evidence supporting advanced detection capabilities.
Info: Passive voice usage in descriptions of incidents which does not clearly indicate the extent or nature of compromise.

If specific risk levels are not defined in the README, it can be inferred that critical and high risks would typically involve clear indicators of severe breaches with significant implications for an organization’s security posture.

Example Findings:

“The company claims to have been targeted by a nation-state actor but provides no evidence to substantiate this claim.”
“Despite the severity of the data breach, the statement minimizes its impact by focusing on limited user impact and quick resolution efforts.”

Executive Override Patterns

Purpose: The Executive Override Patterns Scanner is designed to analyze breach disclosure language and identify patterns that suggest poor security decision-making processes. It aims to detect indicators of crisis decision fatigue, authority-based overrides, incident response shortcuts, blame deflection, and technology failure emphasis, which can signal a lack of accountability, rushed responses, or over-reliance on certain individuals for decisions rather than thorough analysis.

What It Detects:

Crisis Decision Fatigue Indicators:
- Vague “unprecedented” claims without detailed context.
- Frequent use of “highly sophisticated” to justify quick actions.
- Presence of “zero-day exploit” mentions without CVE details.
- Repetitive use of “nation-state actor” or “state-sponsored” attributions.
Authority-Based Overrides:
- Statements indicating executive decision-making bypassing standard protocols.
- Language suggesting compliance with authority figures over security best practices.
- Phrases like “as directed by” without additional justification.
- Claims of “full cooperation” with authorities that lack substantive details.
Incident Response Shortcuts:
- Passive voice constructions indicating a lack of clear responsibility.
- Minimization language downplaying the impact.
- Vague terms like “out of an abundance of caution” without specific actions.
Blame Deflection Patterns:
- Nation-state actor claims without evidence.
- APT group name-dropping (e.g., Fancy Bear, Lazarus) without technical justification.
- Sophistication claims vs actual attack vectors.
- Vague “sophisticated” or “advanced” descriptors.
Technology Failure Emphasis:
- Product/vendor name prominence without configuration admission.
- Zero-day emphasis without CVE details.
- Technology stack blame without policy gap acknowledgment.
- Software flaw focus over broader security gaps.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps organizations identify potential security lapses and improve their decision-making processes in crisis situations. By detecting patterns of poor security practices, the organization can take proactive steps to enhance its cybersecurity posture and protect sensitive information from unauthorized access or breaches.

Risk Levels:

Critical: Findings that directly indicate a significant risk to organizational security, such as vague “unprecedented” claims without context or highly sophisticated justifications lacking detailed evidence.
High: Indicators of authority-based overrides or blame deflection without sufficient justification, potentially leading to over-reliance on specific individuals for decision-making.
Medium: Passive voice constructions in incident responses or minimization language that downplays the severity of an issue.
Low: Informational findings such as occasional use of vague descriptors or minor protocol violations that do not significantly impact security posture.
Info: Minimal or purely informational issues, unlikely to have a substantial effect on security outcomes.

Example Findings:

“The company claimed a zero-day exploit without providing any CVE details, indicating a lack of transparency and potential overconfidence in the severity of the threat.”
“Senior management overruled technical staff decisions multiple times during an incident response, relying heavily on executive authority rather than detailed analysis.”

Security Investment Biases

Purpose: The Security Investment Biases Scanner is designed to analyze breach disclosure language and identify cognitive biases such as loss aversion, sunk cost fallacy, and budget anchoring. These biases can lead organizations to underinvest in security measures, overestimate the effectiveness of existing controls, or fail to learn from past incidents.

What It Detects:

Loss Aversion Patterns: Detection of language that emphasizes avoiding losses rather than maximizing gains. Examples include “We must prevent any further damage” and “Our priority is minimizing financial loss.”
Sunk Cost Fallacy Indicators: Identification of phrases indicating continued investment despite negative outcomes, such as “We have already invested heavily in this technology” and “It would be wasteful to abandon our current approach.”
Budget Anchoring Signs: Recognition of language that suggests sticking to initial budget estimates regardless of changing circumstances, including “Our security budget is fixed at $X million for the year” and “Any additional spending requires approval from upper management.”
Minimization Language: Detection of attempts to downplay the severity or impact of a breach, such as “Only a limited number of records were affected” and “There is no evidence of unauthorized access.”
Blame Deflection Tactics: Identification of language that shifts responsibility away from internal failures, including phrases like “The attack was carried out by a sophisticated nation-state actor” and “A zero-day exploit was used.”

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps organizations recognize and mitigate cognitive biases that can lead to poor security investment decisions. By identifying these biases, organizations can make more informed decisions about where to allocate their security budgets and improve their overall security posture.

Risk Levels:

Critical: Conditions under which the severity of a finding is considered critical include when there is clear evidence of significant financial loss or exposure due to ineffective mitigation strategies influenced by cognitive biases.
High: Findings are classified as high risk when they indicate persistent bias patterns that hinder effective security strategy and planning, potentially leading to recurring issues despite increased investment in security measures.
Medium: Medium severity findings occur when there is a moderate level of influence from cognitive biases on decision-making processes, requiring attention for strategic adjustment but not necessarily immediate crisis management.
Low: Low severity findings are those that have minimal impact on security posture and can be addressed through ongoing education and awareness programs within the organization.
Info: Informational findings pertain to initial assessments or exploratory analyses where biases may initially manifest, typically requiring further investigation for deeper insights into organizational behavior.

If specific risk levels are not detailed in the README, they have been inferred based on the purpose of the scanner and its potential impact.

Example Findings:

The language used in a breach disclosure statement indicates a strong focus on preventing future damage rather than maximizing gains, indicative of loss aversion.
A company’s continued investment in an unproven security technology despite negative outcomes is a clear example of sunk cost fallacy.

SOC Cognitive Load Analysis

Purpose: The SOC Cognitive Load Analysis Scanner is designed to analyze breach disclosure language and identify signs of analyst fatigue, alert triage bias, and decision quality degradation. It detects blame deflection patterns such as nation-state actor claims, highly sophisticated attack descriptions, and zero-day exploit mentions without CVE details. Additionally, it identifies third-party blame patterns, employee scapegoating, passive voice usage, and minimization tactics in breach descriptions.

What It Detects:

Blame Deflection Patterns:
- Nation-state actor claims (e.g., “nation-state actor”, “state-sponsored”)
- Highly sophisticated attack descriptions (e.g., “highly sophisticated”, “unprecedented level”)
- Zero-day exploit mentions without CVE details (e.g., “zero-day”)
Third-Party Blame Patterns:
- Vendor/partner responsibility shifting (e.g., “third-party vendor”, “managed service provider”)
- Supply chain attack framing
Employee Scapegoating:
- Rogue employee or insider claims (e.g., “rogue employee”, “insider threat”)
Passive Voice Usage:
- Passive constructions in breach descriptions (e.g., “was accessed”, “were compromised”)
Minimization Tactics:
- Limited impact statements (e.g., “limited number of”, “no evidence of”)
- Out of an abundance of caution language (e.g., “out of an abundance of caution”, “potentially affected”)

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial for organizations as it helps in detecting potential biases and cognitive overload during breach analysis, which can lead to misjudgments and inadequate response strategies. It aids in maintaining a robust security posture by ensuring that all aspects of a breach are thoroughly examined and mitigated appropriately.

Risk Levels:

Critical: Conditions where the scanner identifies nation-state actor claims without proper mitigation or escalation protocols in place.
High: Conditions where highly sophisticated attacks are framed as limited incidents, potentially hiding larger threats.
Medium: Conditions where passive voice usage obscures clear responsibility narratives and minimization tactics downplay significant impacts.
Low: Informal language that does not significantly impact the clarity of breach responsibilities but may indicate a need for awareness training.
Info: Non-critical findings that do not directly affect security posture but can be useful for continuous improvement in documentation and response strategies.

Example Findings:

“The statement mentions ‘highly sophisticated’ attacks without clear evidence, suggesting potential cognitive bias.”
“A breach description uses passive voice to avoid direct responsibility claims, indicating a minimization tactic.”