Cognitive Cybersecurity: Safeguarding Human & AI Reasoning

• Cognitive cybersecurity is a holistic approach that protects human perception and AI reasoning layers against adversarial manipulation and cognitive attacks.
• It employs quantitative metrics and system architectures to assess vulnerabilities in HCPS, disinformation campaigns, and AI systems.
• Defensive strategies include training protocols, explainable AI, and cognitive triggers that enhance decision-making integrity and operational resilience.

Cognitive cybersecurity is a security paradigm that treats human cognition and, increasingly, artificial reasoning processes as security-relevant system components and attack surfaces. In Human-Cyber-Physical Systems (HCPSs), it addresses attacks that exploit perception, attention, memory, mental operations, and behavior; in online information environments, it encompasses cyber cognitive attacks and disinformation-driven campaigns; and in AI systems, it extends to the protection of the reasoning layer from adversarial manipulation through legitimate inputs rather than technical compromise (Huang et al., 2023, Rushing et al., 17 Oct 2025, Aydin, 9 Aug 2025, Aydin, 19 Aug 2025). Across these formulations, cognitive cybersecurity is not presented as a replacement for technical controls, but as a complementary layer for protecting humans as “endpoints” in the decision chain, governing autonomy under uncertainty, and preserving reasoning quality, epistemic trust, and human agency in AI-mediated decisions (Rushing et al., 17 Oct 2025, Kojukhov et al., 12 Feb 2026, Aydin, 23 Jul 2025).

1. Definitions and domain boundaries

In one explicit formulation, cognitive security is “the practice of deploying people, policies, processes, and technologies to withstand cognitive attacks and defend essential HCPS components, including humans, critical system structures, services, and sensitive information” (Huang et al., 2023). The same source defines cognitive attacks as “a class of cyber-physical-human processes that manipulate the behaviors of human actors for malicious purposes … by exploiting their cognitive vulnerabilities,” thereby distinguishing cognitive security from cognitive reliability, which concerns continuity of operation under uncertainty, disturbance, and error rather than adversarial exploitation (Huang et al., 2023).

A closely related formulation defines cyber cognitive attacks as “online operations that target human minds’ subconsciousness, aiming to manipulate perceptions and beliefs, which may be weaponized and enhanced through technology and deceptive information, typically to affect individuals’ or broader populations’ decision-making and actions to gain advantages” (Rushing et al., 17 Oct 2025). That definition emphasizes online operations, malicious intent, information as a weapon, and subconscious targeting. An effective cyber cognitive attack is defined there as one that achieves the attacker’s objectives by reaching and exposing the target audience to selected messaging, “even for a split second,” which shifts the analytic focus from demonstrable persuasion to measurable exposure and engagement (Rushing et al., 17 Oct 2025).

The field also extends beyond human targets. “Cognitive Cybersecurity for Artificial Intelligence: Guardrail Engineering with CCS-7” defines cognitive cybersecurity for AI as the systematic identification, measurement, and mitigation of reasoning-level vulnerabilities in LLMs that parallel human cognitive weaknesses and can be exploited by adversarial prompts, misleading context, emotional framing, or information overload (Aydin, 9 Aug 2025). “CIA+TA Risk Assessment for AI Reasoning Vulnerabilities” further characterizes cognitive cybersecurity as a discipline complementing traditional cybersecurity and AI safety by addressing vulnerabilities where legitimate inputs corrupt reasoning while evading conventional controls (Aydin, 19 Aug 2025).

This domain boundary matters because social engineering research had already argued that cyberattacks are often psychological attacks on human cognition, exploiting weaknesses in perception, working memory, decision-making, and action (Rodriguez et al., 2020). Cognitive cybersecurity generalizes that insight into a broader program that includes disinformation campaigns, SOC decision support, cognitive digital twins, bias-informed deception, and AI reasoning security.

2. Attack surfaces, vulnerabilities, and threat models

A recurring claim across the literature is that cognition is vulnerable at multiple layers. In the HCPS formulation, perception is limited by temporal constraints and is susceptible to illusions and priming; attention is vulnerable to multitasking, high load, and vigilance decrement; memory is vulnerable to forgetting, suggestibility, and false-memory formation; and mental operations are vulnerable to biases such as anchoring, framing, optimism bias, authority effects, reciprocity, social proof, liking, scarcity, and commitment/consistency (Huang et al., 2023). The social-engineering literature organizes these same vulnerabilities around perception, working memory, decision making, and action, while also stressing the role of workload, acute stress, vigilance, personality, expertise, age, culture, and long-term memory in shaping susceptibility (Rodriguez et al., 2020).

In disinformation settings, the attack surface is the human behavioral response to online influence. The engagement framework of “Quantifying the Engagement Effectiveness of Cyber Cognitive Attacks” treats views, likes, comments, and shares as observable traces of exposure, endorsement, cognitive effort, and diffusion, with “behavioral depth” as the key concept: views indicate exposure; likes signal mild endorsement or attention; comments indicate cognitive effort; and shares combine high effort with high diffusion (Rushing et al., 17 Oct 2025). The same paper situates these attacks within cognitive warfare, hybrid warfare, information operations, PSYOPS, and grey-zone conflict (Rushing et al., 17 Oct 2025).

A second strand models the attacker’s own cognition as a vulnerability. PsybORG$^+$ embeds loss aversion, confirmation bias, base rate neglect, and sunk cost fallacy into a multi-agent cyber range, treating attacker behavior as the joint product of technical constraints and cognitive biases (Huang et al., 2024). Large-scale picoCTF analysis finds availability bias in “correct-content, wrong-format” flag submissions and sunk cost behavior in repeated attempts despite sharply declining success probabilities (Carreira et al., 7 Oct 2025). A controlled CTF study on web application security reports Satisfaction of Search (SoS) and Loss Aversion as experimentally relevant biases, with SoS producing a significant reduction in discovered flags (Yang et al., 17 May 2025). GAMBiT extends this into defensive engineering by embedding cognitive triggers for loss aversion, base-rate neglect, confirmation bias, sunk-cost fallacy, and availability bias into a simulated enterprise network (Beltz et al., 27 Nov 2025).

For AI systems, the CCS-7 taxonomy defines seven reasoning-level vulnerabilities: authority hallucination, context poisoning, goal misalignment loops, identity/role confusion, memory/source interference, cognitive-load overflow, and attention hijacking (Aydin, 9 Aug 2025). These are explicitly treated as behavioral analogies, not claims that models instantiate human cognitive mechanisms. The threat model is that crafted prompts or contextual manipulations alter the model’s reasoning using normal interfaces and authorized inputs, thereby bypassing conventional access and infrastructure controls (Aydin, 9 Aug 2025, Aydin, 19 Aug 2025).

3. Quantification, metrics, and empirical evaluation

One of the strongest themes in this literature is the demand for quantitative instruments. For disinformation-driven cognitive attacks, the proposed weighted interaction score is

$I = \sum_{j=1}^{n} w_j \cdot i_j$

where $i_j$ is the count of interaction type $j$, and $w_j$ is its weight. The engagement effectiveness of a campaign is then

$E = \frac{I}{t},$

with $t$ the number of attacker transmissions (Rushing et al., 17 Oct 2025). The paper uses $w_{\text{view}} = 0.1$, $w_{\text{like}} = 0.3$, $w_{\text{comment}} = 0.7$, and $I = \sum_{j=1}^{n} w_j \cdot i_j$0, and proposes a heuristic grading scale from $I = \sum_{j=1}^{n} w_j \cdot i_j$1 ($I = \sum_{j=1}^{n} w_j \cdot i_j$2–$I = \sum_{j=1}^{n} w_j \cdot i_j$3, “Failure”) to $I = \sum_{j=1}^{n} w_j \cdot i_j$4 ($I = \sum_{j=1}^{n} w_j \cdot i_j$5, “Viral”) (Rushing et al., 17 Oct 2025). The reported case studies include an Instagram post with $I = \sum_{j=1}^{n} w_j \cdot i_j$6 and grade $I = \sum_{j=1}^{n} w_j \cdot i_j$7, a YouTube account with $I = \sum_{j=1}^{n} w_j \cdot i_j$8 and grade $I = \sum_{j=1}^{n} w_j \cdot i_j$9, and a Facebook video post with $i_j$0 and grade $i_j$1 (Rushing et al., 17 Oct 2025).

For AI reasoning vulnerabilities, the CCS-7 framework defines the mitigation rate

$i_j$2

with $i_j$3 indicating mitigation and $i_j$4 indicating backfire (Aydin, 9 Aug 2025). Across 12,180 experiments on seven LLM architectures, some vulnerabilities were nearly binary-preventable—identity confusion mitigation ranged from $i_j$5 to $i_j$6—while others exhibited strong backfire, especially source interference, where some models showed negative $i_j$7 values and Mistral was reported to exhibit a 135% increase in vulnerability under TFVA-style prompting (Aydin, 9 Aug 2025). The same work benchmarked humans with a randomized controlled trial of $i_j$8, where the TFVA lesson improved overall cognitive security performance from $i_j$9 to $j$0, an absolute gain of $j$1, with $j$2 and Cohen’s $j$3 (Aydin, 9 Aug 2025).

A broader risk assessment is proposed in the CIA+TA framework, where inherent risk for vulnerability $j$4 is defined as

$j$5

with $j$6 exploitability, $j$7 impact, and $j$8 an architecture modifier (Aydin, 19 Aug 2025). Residual risk after mitigation is

$j$9

The paper reports strong architecture dependence and argues that identical defenses can produce effects ranging from a 96% reduction to a 135% amplification of vulnerabilities, making pre-deployment Cognitive Penetration Testing a governance requirement (Aydin, 19 Aug 2025).

Attacker cognition is also measured quantitatively. PsybORG$w_j$0 reports Bayesian inference accuracy of $w_j$1 for joint loss-aversion and confirmation-bias states, cross-entropy $w_j$2, and decision-tree classification accuracies of $w_j$3 for loss aversion, $w_j$4 for confirmation bias, and $w_j$5 for sunk cost fallacy (Huang et al., 2024). “Risk Psychology & Cyber-Attack Tactics” uses multilevel mixed-effects Poisson regression on 1,964 technique uses by 33 cybersecurity professionals and finds significant psychometric-by-technique interactions for ADMC_RC1, ADMC_RC2, CRT, and GRiPS, while expertise level and treatment condition do not significantly predict technique patterns (Kim et al., 23 Oct 2025).

4. Architectures and system representations

A substantial portion of the field focuses on system architectures that make cognition explicit. “Agentic AI for Cybersecurity” reconceptualizes the SOC as a distributed cognitive system composed of detection agents, hypothesis agents, context agents, explainability agents, governance agents, and meta-cognitive judgement agents (Kojukhov et al., 12 Feb 2026). Its central construct is the meta-cognitive judgement function, formally summarized as

$w_j$6

where evidence $w_j$7, hypotheses $w_j$8, context $w_j$9, explanations $E = \frac{I}{t},$0, and governance constraints $E = \frac{I}{t},$1 are integrated into a decision-readiness assessment $E = \frac{I}{t},$2 (Kojukhov et al., 12 Feb 2026). This architecture treats explainability and governance as first-class cognitive functions and frames autonomy as governable rather than maximized (Kojukhov et al., 12 Feb 2026).

A different architectural line is semantic and ontology-driven. “Cognitive Techniques for Early Detection of Cybersecurity Events” builds a knowledge graph over an extended Unified Cybersecurity Ontology, ingesting textual threat intelligence, sensor data, and analyst rules, and reasoning over kill-chain phases and attack patterns using OWL, SWRL, and graph-based representations (Narayanan et al., 2018). “Cybonto” extends this direction with a Human Digital Twin framework and an ontology containing 108 constructs and thousands of cognitive-related paths derived from 20 psychology theories, then analyzes these constructs with 20 network centrality algorithms (Nguyen, 2021). Its top 10 constructs—Behavior, Arousal, Goals, Perception, Self-efficacy, Circumstances, Evaluating, Behavior-Controllability, Knowledge, and Intentional Modality—are proposed as design targets for future digital cognitive architectures (Nguyen, 2021).

System-scientific treatments of cognitive security in HCPSs stress modular, multi-scale modeling of human, cyber, physical, and AI layers, and explicitly distinguish cognitive confidentiality, cognitive integrity, and cognitive availability from their classical cyber counterparts (Huang et al., 2023). A more operational distributed architecture appears in “Cognitive Threat Intelligence and Explainable Federated Security Analytics,” which combines Federated Learning, SHAP/LIME-based explainability, and local anomaly-detection models such as Random Forest, XGBoost, Autoencoder, and LSTM in distributed infrastructure systems (Rahman et al., 4 Jun 2026). There, only encrypted model parameters are shared and aggregated via FedAvg, while raw data remain local (Rahman et al., 4 Jun 2026).

5. Defensive methods, operational uses, and human-in-the-loop control

Defensive practice in cognitive cybersecurity spans training, interface design, deception, threat intelligence, and adaptive orchestration. On the human side, “Think First, Verify Always” (TFVA) defines a two-step protocol—independent reasoning before AI reliance, and independent verification before action—and grounds it in the AIJET principles of Awareness, Integrity, Judgment, Ethical Responsibility, and Transparency (Aydin, 23 Jul 2025). In a randomized controlled trial with 151 participants, a 3-minute intervention improved overall cognitive-security task performance by $E = \frac{I}{t},$3, with especially large relative gains in Ethical Responsibility $E = \frac{I}{t},$4 and Integrity $E = \frac{I}{t},$5 (Aydin, 23 Jul 2025). The paper recommends embedding TFVA as a standard prompt in GenAI platforms, replacing passive warnings with actionable protocols (Aydin, 23 Jul 2025).

On the content-analysis side, the engagement-effectiveness framework is proposed for continuous monitoring of suspected disinformation across public social media, with use cases in threat-intelligence dashboards, platform trust and safety pipelines, policy tracking, and impact evaluation of countermeasures such as fact-checking labels or downranking (Rushing et al., 17 Oct 2025). The same logic is extended in “Security Logs to ATT&CK Insights,” where LLMs segment Suricata IDS logs into behaviorally meaningful actions and map them to MITRE ATT&CK techniques, thereby creating a substrate for cognitive trait inference from telemetry rather than from post hoc narrative reports (Hans et al., 23 Oct 2025).

A more explicitly manipulative defensive approach appears in GAMBiT. It introduces cognitive triggers, which are technically plausible and psychologically specific environmental cues, and cognitive sensors, which infer latent bias states from behavioral traces, Suricata alerts, NetFlow, host logs, and LLM-derived MITRE ATT&CK Technique Signals (Beltz et al., 27 Nov 2025). Across three rounds of human-subject experiments ($E = \frac{I}{t},$6) in a simulated small-business network, trigger conditions significantly reduced mission progress and diverted actions off the true attack path; in one two-way ANOVA on attack-path command ratio, the main effect of group was $E = \frac{I}{t},$7, $E = \frac{I}{t},$8 (Beltz et al., 27 Nov 2025).

CTF-based research also motivates defender training and deception. The picoCTF study proposes a framework of bias triggers, behavioral sensors, and adaptive defenses to exploit availability bias and sunk cost fallacy, while the web-application CTF study argues that SoS can be used in honeypots and deceptive systems so that attackers stop after exploiting non-critical vulnerabilities, thereby buying time and protecting higher-value assets (Carreira et al., 7 Oct 2025, Yang et al., 17 May 2025). In parallel, “Learning to Defend by Attacking (and Vice-Versa)” shows that cognitively inspired agents based on Instance-Based Learning Theory and Theory of Mind can transfer learning across attacker and defender roles and outperform alternatives that ignore human biases (Malloy et al., 2023).

6. Limitations, controversies, and future directions

The field is explicit about its limits. The engagement-effectiveness model assumes that engagement correlates with cognitive impact, but it does not measure belief change or offline behavior directly; its weights are heuristic, it does not model unique users, and platform-visible interactions are incomplete and biased by platform affordances (Rushing et al., 17 Oct 2025). The agentic SOC architecture is conceptual rather than empirically validated at scale, and it leaves open how to formalize explanation adequacy, decision readiness, autonomy thresholds, and responsibility allocation when judgement fails (Kojukhov et al., 12 Feb 2026).

For AI reasoning security, the central controversy is architecture dependence. Guardrails effective for one model can fail or actively harm another, especially in source interference and attention hijacking, where negative mitigation coefficients indicate backfire (Aydin, 9 Aug 2025). This makes one-prompt-fits-all safety implausible and motivates capability-matched guardrails, architecture-aware testing, and mechanistic interpretability as future work (Aydin, 9 Aug 2025). The CIA+TA framework generalizes this concern by arguing that reasoning-capable AI requires governance over Trust and Autonomy in addition to classical CIA, but its quantitative coefficients still depend on published experiments rather than large-scale operational deployments (Aydin, 19 Aug 2025).

Human-centered sensing and profiling also raise privacy and civil-liberties questions. The disinformation metric relies on public data, but the paper notes concerns about privacy, chilling effects, and false positives when labeling content as cognitive attack (Rushing et al., 17 Oct 2025). Remote cognitive-observation approaches that infer cognitive-behavioral parameters from mouse and keyboard interaction are presented as supplementary tools for banking and trade systems, but they imply continuous behavioral profiling and would require careful treatment of consent, profiling risk, and governance (Orun et al., 2023). MORPHEUS, despite offering 50 factors, 295 interactions, and 99 psychometric instruments, is still a literature-synthesis framework rather than a unified validated model, and its authors emphasize cultural bias, static mappings, and the difficulty of turning such breadth into operational tooling (Desolda et al., 20 Dec 2025).

Future work is correspondingly broad. Proposed directions include longitudinal modeling of engagement $E = \frac{I}{t},$9, bot correction and user deduplication, network-topology integration, and cross-platform analysis for disinformation campaigns (Rushing et al., 17 Oct 2025); empirical validation of meta-cognitive judgement and secure supervision in adversarial multi-agent systems (Kojukhov et al., 12 Feb 2026); adaptive, architecture-aware guardrails and cross-architecture cognitive safety benchmarks for AI (Aydin, 9 Aug 2025); richer attacker cognitive models and real human-attacker validation for cyber-range simulations (Huang et al., 2024); and dynamic, personalized human-factor models that integrate psychometrics, telemetry, and intervention design (Desolda et al., 20 Dec 2025). Taken together, these directions indicate that cognitive cybersecurity is moving toward a quantitatively instrumented, architecture-aware, and system-level treatment of human and artificial reasoning as security-critical substrates rather than residual “human factors.”