Cognitive-Driven Cyber Defense Strategies

• Cognitive-Driven Defense is a paradigm that integrates human cognition models, such as instance-based learning and theory-of-mind, to predict adversary behavior.
• It leverages methodologies like bias modeling and deceptive tactics to influence attacker beliefs and shape adaptive defensive responses.
• CDD extends beyond traditional cyber defense by incorporating insights from human, AI, and physical systems to enable proactive, decision-centric interventions.

Searching arXiv for relevant papers on Cognitive-Driven Defense and closely related cognitive security/cyber defense work. Cognitive-Driven Defense (CDD) denotes a class of defense approaches in which cognition is treated as a first-class object of modeling, measurement, and intervention. In the cybersecurity literature represented here, CDD departs from purely rational, signature-based, or infrastructure-only defense by modeling attackers, defenders, or analysts as cognitively bounded agents; by inferring beliefs, intentions, and biases from behavior; and by shaping defensive action around decision processes rather than only observable technical events (Malloy et al., 2023). Closely related formulations appear under “cognitive security,” “cognitive cybersecurity,” and “cognitive secure communication,” all of which converge on the idea that defense should preserve or restore sound decision-making under adversarial pressure, and, in some cases, exploit adversarial cognition directly (Huang et al., 2023, Aydin, 19 Aug 2025, Rushing et al., 5 Mar 2026).

1. Definition and scope

CDD is most clearly defined by the proposition that defense should be improved by “explicitly incorporating human-like cognition” into adversarial settings, especially through instance-based learning (IBL), theory of mind (ToM), transfer learning, bias modeling, and decision-centric evaluation (Malloy et al., 2023). In this framing, a defender is not a purely rational optimizer. Rather, the defender is a cognitively bounded agent that learns from experience, predicts an opponent’s beliefs and actions, and transfers knowledge across attacker and defender roles (Malloy et al., 2023).

A broader systems formulation appears in work on cognitive security for Human-Cyber-Physical Systems (HCPSs), where cognition is both a critical asset and an attack surface. That work defines cognitive attacks as “a class of cyber-physical-human processes that manipulate the behaviors of human actors for malicious purposes” and cognitive security as “the practice of deploying people, policies, processes, and technologies to withstand cognitive attacks” (Huang et al., 2023). This suggests that CDD is not confined to one delivery medium or one adversarial workflow; it extends across human, cyber, physical, and AI-mediated processes whenever perception, attention, memory, judgment, or action are targets of contestation.

A more explicitly decision-centric variant defines cognitive warfare as “a sustained and adaptive contest over human decision-making in which adversaries seek relative advantage by shaping or disrupting perception, interpretation, judgment, and action over time” (Rushing et al., 5 Mar 2026). That formulation is highly compatible with CDD because it treats defensive success as preservation of decision quality, decision tempo, trust calibration, and action under contest, rather than as reach, engagement, or simple alert counts (Rushing et al., 5 Mar 2026).

The term should be distinguished from Cognitive-Driven Development, a software design technique concerned with limiting code complexity through Intrinsic Complexity Points (ICPs) in order to reduce developer cognitive load (Barbosa et al., 2022, Pinto et al., 2022, Ferreira et al., 2024). The acronym is the same, but the subject matter is different. In the defense literature summarized here, CDD refers to cognition-aware defense, not software readability or refactoring practice.

2. Core conceptual foundations

Several research lines supply the conceptual basis of CDD. One is cognitively realistic adversarial modeling. In “Learning to Defend by Attacking (and Vice-Versa),” the base mechanism is IBL, where memory is composed of instances $(s,a,x)$, with $s$ denoting state, $a$ action, and $x$ outcome, and decisions are made by computing expected utility through a blending or retrieval process (Malloy et al., 2023). The paper gives the action-value expression as

$V_{k,t} = \sum_{i=1}^{n_{k,t}p_{i,k,t} x_{i,k,t}$

and uses this as the cognitive substrate for experience reuse in cyber decisions (Malloy et al., 2023).

On top of IBL, ToM augments memory with predictions of hidden state features $h$ and opponent actions $o$, enabling an agent to reason not only from environmental observables but also from beliefs about what the adversary perceives and intends (Malloy et al., 2023). The opponent-prediction utility is written as

$O_{k,t} = \sum_{i=1}^{n_{k,t} p_{i,k,t} \mathbbm{1}_{i,k,t}$

where $\mathbbm{1}_{i,k,t}$ equals 1 when $k$ matches the opponent’s action $s$0; in zero-sum settings the identity function may be replaced with opponent utility (Malloy et al., 2023). This yields one of the central ideas of CDD: cognition is used not only to choose an action, but to infer the adversary’s likely perception and future move.

A second foundation is the treatment of bias and bounded rationality as exploitable variables. In “Bi-Level Game-Theoretic Planning of Cyber Deception for Cognitive Arbitrage,” cognitive vulnerabilities are explicitly divided between disparities in cognitive capability and biases such as rational inattention, confirmation bias, and base rate neglect (Yang et al., 5 Sep 2025). Defense, in that formulation, is successful when the defender uses deception to shape what the attacker believes about the system and maintains a “window of superiority” long enough to protect critical assets (Yang et al., 5 Sep 2025).

A third foundation is decision-centric human defense. Work on interactive machine learning in defense settings argues that human analysts must remain actively involved and that the analyst’s cognitive state—via self reporting, implicit cognitive feedback, and modeled cognitive feedback—should become a design variable in operational systems (Michael et al., 2020). This suggests that CDD can target not only attacker cognition but also defender cognition, especially workload, trust, usability, and adaptation to mission context (Michael et al., 2020).

A fourth foundation is reasoning-level security for AI systems. “CIA+TA Risk Assessment for AI Reasoning Vulnerabilities” defines cognitive cybersecurity as the protection of artificial reasoning processes from adversarial manipulation and extends the classical CIA triad with Trust and Autonomy (Aydin, 19 Aug 2025). That work treats “legitimate inputs” as a channel through which an attacker may corrupt reasoning while remaining within normal operational parameters, implying that CDD also applies when the defended decision-maker is an AI system rather than a human operator (Aydin, 19 Aug 2025).

3. Modeling paradigms and formal structures

The formal repertoire of CDD is heterogeneous, but several recurring structures are visible.

One paradigm is self-play and cross-role transfer. In Stackelberg security games, agents are trained in both attacker and defender roles, with the ToM model learning to predict the other agent’s behavior and to form a policy that transfers when the role changes (Malloy et al., 2023). The paper’s transfer-learning argument is that experience as an attacker should improve later defensive behavior, and vice versa, because both roles involve learning the same strategic environment from different perspectives (Malloy et al., 2023).

A second paradigm is partially observable strategic control with belief updates. In the bi-level cyber warfare game for cognitive arbitrage, the operational game under deception mode $s$1 is

$s$2

with defender and attacker policies conditioned asymmetrically on information (Yang et al., 5 Sep 2025). The attacker maintains a belief $s$3 over deception modes and updates it under Bayesian rationality via

$s$4

This makes the attacker’s belief state itself a defensive target (Yang et al., 5 Sep 2025).

The same paper models confirmation bias through a slower belief revision rule,

$s$5

and base rate neglect by removing the prior term from a Bayes-like update (Yang et al., 5 Sep 2025). These are direct examples of formalized cognitive bias inside a defense model.

A third paradigm is multi-agent decision-theoretic inference over latent attacker traits. In the ambiguity-aversion work, the defender’s inference engine is implemented in the GAMBIT PsychSim framework, based on a POMDP and ToM reasoning, and estimates a per-observation probability of ambiguity aversion from observed attacker actions (Carney et al., 8 Dec 2025). The paper characterizes the inference target conceptually as $s$6, where $s$7 is the latent cognitive trait and $s$8 the observation history (Carney et al., 8 Dec 2025).

A fourth paradigm is cognition-aware reinforcement learning. In cloud security, the CHT-DQN framework models the attacker as level-0 and the SOC analyst as level-1 under Cognitive Hierarchy Theory (Aref et al., 22 Feb 2025). The defender’s level-1 Q-function is

$s$9

and the transition probability integrates the attacker’s level-0 policy: $a$0 The resulting defense is anticipatory rather than purely reactive (Aref et al., 22 Feb 2025).

A fifth paradigm is reasoning-chain supervision for model defense. In jailbreak defense for LLMs, CDD is defined as reasoning about “meta-operations,” basic manipulations that conceal harmful intent (Pu et al., 5 Aug 2025). The supervised objective is

$a$1

where $a$2 is the prompt, $a$3 the structured reasoning chain, and $a$4 the safe response (Pu et al., 5 Aug 2025). An entropy-guided RL stage then encourages exploration over unseen manipulation types (Pu et al., 5 Aug 2025).

4. Sensing, inference, and cognitive telemetry

A defining feature of mature CDD formulations is the conversion of low-level evidence into estimates of adversarial cognition.

One route is telemetry-to-strategy lifting with LLMs. “Security Logs to ATT&CK Insights” shows a Suricata-only pipeline in which IDS log streams are first segmented into coherent behavioral action groups and then mapped, with retrieval-augmented reasoning, to MITRE ATT&CK techniques and cognitive signals such as loss aversion, risk tolerance, and goal persistence (Hans et al., 23 Oct 2025). The pipeline can be summarized as

$a$5

followed by

$a$6

The paper’s broader claim is that attacker behavior leaves traces in tool switching, protocol transitions, pivot behaviors, and phase transitions, and that these traces can support cognition-aware defense (Hans et al., 23 Oct 2025).

A related but more explicit cognitive-sensing architecture appears in GAMBiT. There, the CogVuln sensor takes Suricata alerts, NetFlow, host logs, and task context and outputs a probability distribution over five cognitive vulnerabilities: loss aversion, base-rate neglect, confirmation bias, sunk-cost fallacy, and availability bias (Beltz et al., 27 Nov 2025). The pipeline includes an LLM-based Attack Summarization Module, SME-informed contextual mapping, and a ToM defender agent in PsychSim (Beltz et al., 27 Nov 2025). The paper describes the output as a normalized probability distribution over bias states, which then supports counterfactual reasoning about the attacker’s likely response to future defensive actions (Beltz et al., 27 Nov 2025).

The ambiguity-aversion work extends this idea with multi-modal red-team data from the GAMBIT dataset, combining free-text OpNotes, Suricata or NetFlow logs, and ATT&CK-mapped action traces (Carney et al., 8 Dec 2025). It reports that the ambiguity-aversion model produced 237 high-confidence observations, about 15.0%, whereas the loss-aversion model produced 0 high-confidence observations, across 1,583 observations from 29 participants (Carney et al., 8 Dec 2025). This suggests that different cognitive traits may be more detectable at different points in the attack lifecycle.

CDD also applies to cognitive sensing of defenders and AI systems. Interactive machine learning for defense applications proposes self reporting, implicit cognitive feedback, and modeled cognitive feedback to infer workload, attention, fatigue, and engagement of analysts (Michael et al., 2020). Cognitive cybersecurity for AI systems measures exploitability, impact, and architecture dependence through

$a$7

with residual risk after mitigation defined as

$a$8

(Aydin, 19 Aug 2025). In that setting, cognitive telemetry is not about a human attacker but about architecture-sensitive reasoning failure modes under adversarial input (Aydin, 19 Aug 2025).

5. Defensive interventions and operational mechanisms

CDD is not merely descriptive. Its core premise is that inferred or modeled cognition should alter the defensive policy.

One prominent mechanism is deception targeted at attacker belief formation. In the cognitive-arbitrage game, deception is planned at strategic, operational, and tactical levels through honeypots, decoy files, fake data paths, and misinformation banners, with switching among deception modes used to preserve advantage across the attacker’s lifetime (Yang et al., 5 Sep 2025). The paper reports that strategically timed deception can turn a negative value for the attacker into a positive one during planning and achieve at least a 40% improvement in total rewards during execution (Yang et al., 5 Sep 2025).

GAMBiT makes this mechanism concrete through “cognitive triggers,” such as fake admin accounts, decoy files, proxy redirections, aliased commands, password-protected decoys, and salient filenames (Beltz et al., 27 Nov 2025). The design workflow identifies the target bias, attacker decision context, MITRE ATT&CK mapping, plausible artifact, expected behavioral indicators, and associated sensors (Beltz et al., 27 Nov 2025). This turns psychological bias activation into an engineered defensive surface.

Proactive anticipation of future attack-enabling technologies is another intervention class. “Towards Proactive Defense Against Cyber Cognitive Attacks” proposes a workflow of DI dataset collection, data preprocessing, modeling and prediction, and proactive defense design (Rushing et al., 17 Oct 2025). The paper defines DI-enabled cyber cognitive attacks as attacks that exploit disruptive innovations that “introduce new, expand existing, or automate methods for communications, data collection, social networking, or targeting” (Rushing et al., 17 Oct 2025). The practical workflow maps predicted disruptive innovations to historical DIs, then to attack TTPs, then to defensive TTPs in DISARM or MITRE ATT&CK (Rushing et al., 17 Oct 2025).

Reasoning-based defense for AI systems is another variant. In jailbreak defense, the intervention is to detect the prompt’s global structure, inspect suspicious local segments, identify meta-operations such as translation, reversal, scenario nesting, or attention hijacking, and respond safely (Pu et al., 5 Aug 2025). This replaces shallow pattern matching with reasoning over how harmful intent is concealed (Pu et al., 5 Aug 2025).

For analyst-facing systems, the intervention is workload regulation and cognitively congruent interaction. Interactive machine learning in defense emphasizes intuitive interfaces, online correction, and adaptation to the analyst’s operational capacity rather than only classifier accuracy (Michael et al., 2020). In a CDD interpretation, this is defensive hardening of the human-in-the-loop against overload, mistrust, or miscalibrated automation.

A more specialized communication-domain variant appears in satellite-terrestrial networks, where “cognitive secure communication” uses real-time sensing, multi-agent scheduling, GAN-generated adversarial occupancy matrices, and learning-aided power control to degrade eavesdropper inference while preserving reliability (Ling et al., 6 Jan 2026). A plausible implication is that CDD can be generalized beyond cyber intrusion and influence operations into communications systems whenever the adversary’s judgment process is explicitly targeted.

6. Evaluation criteria, empirical findings, and recurrent limitations

CDD research is notable for its emphasis on evaluation metrics that are decision-centric, strategy-centric, or behavior-centric rather than solely content-centric.

In Stackelberg security games, the principal metric is reward, with approximately 0.5 interpreted as the Nash-equilibrium reward for the default single-step game (Malloy et al., 2023). When IBL and ToM are matched symmetrically, the attacker obtains about 0.5 reward, but in cross-play an IBL attacker facing a ToM defender achieves only about 0.3, while a ToM attacker facing an IBL defender reaches roughly 0.8 (Malloy et al., 2023). These results are presented as evidence that ToM-style opponent prediction improves performance under the tested IBL decay and noise settings (Malloy et al., 2023).

In telemetry-based ATT&CK inference, the Suricata pipeline achieves especially strong performance on network-visible phases, including Reconnaissance: 96.8%, Execution: 90.9%, and Collection: 100%, while remaining weaker on Persistence: 0%, Exfiltration: 13.6%, Command and Control: 27.3%, Credential Access: 28.1%, Discovery: 25%, Lateral Movement: 36.4%, Initial Access: 40%, and Privilege Escalation: 45% (Hans et al., 23 Oct 2025). The paper interprets this not only as a classification result but as evidence that high-level attack structure can be recovered from telemetry alone where observability is sufficient (Hans et al., 23 Oct 2025).

GAMBiT evaluates mission progress, time wasted, deviation from the true attack path, and detectability (Beltz et al., 27 Nov 2025). It reports a significant mission-progress difference with Kruskal–Wallis p = 0.0495, a significant reduction in command concentration on the 13 critical VMs with F(1,35)=10.37, p=0.003, and greater Suricata alerting on it-ubuntu-1 with t = 2.25, p = 0.0381 (Beltz et al., 27 Nov 2025). The control mean for command concentration on the true attack path is 67.823% ± 12.692, versus 49.501% ± 24.256 for the trigger group (Beltz et al., 27 Nov 2025). These are direct operational indicators of attacker diversion and increased observability.

In ambiguity-aversion detection, the strongest signals appear in Discovery, whereas loss aversion peaks in Lateral Movement (Carney et al., 8 Dec 2025). This reinforces a recurrent theme in CDD: different cognitive traits become salient at different tactical stages.

In cloud defense, CHT-DQN is evaluated by data protection, action discrepancies, lower-bound analysis with increasing attack-graph complexity, and a human-in-the-loop study on Amazon Mechanical Turk (Aref et al., 22 Feb 2025). The human experiments involve 83 recruited, 80 completed, each playing 40 rounds on a 6-node attack graph, and show that transition-aware decision support improves alignment with adaptive attackers, though humans require far more time than automated policies (Aref et al., 22 Feb 2025).

In cognitive warfare analysis, the proposed indicators include decision latency, decision error, confidence and hesitation, trust calibration, shared situational awareness, interpretive coherence or divergence, recovery time, time-to-validate facts, number of decision reversals, deviation from pre-briefed thresholds, and operational pauses or misaligned actions (Rushing et al., 5 Mar 2026). This is perhaps the clearest statement that CDD effectiveness should be assessed by the integrity and tempo of the defended OODA loop, not by content moderation proxies alone (Rushing et al., 5 Mar 2026).

Despite these advances, the literature repeatedly identifies limitations. Formalisms are sometimes only partially developed, as in the Stackelberg IBL-ToM model (Malloy et al., 2023). Predictive methodologies for future disruptive innovations rely on small datasets and acknowledged subjectivity (Rushing et al., 17 Oct 2025). Cognitive sensors often require manual auditing or SME intervention, as in GAMBiT’s Attack Summarization Module (Beltz et al., 27 Nov 2025). Some models are exploratory and preliminary, as in ambiguity-aversion inference (Carney et al., 8 Dec 2025). Architecture dependence is severe in cognitive cybersecurity for AI systems, where the same mitigation can yield effects ranging from 96% reduction to 135% amplification of vulnerabilities (Aydin, 19 Aug 2025). A plausible implication is that CDD is best understood, at present, as a converging research program rather than a settled, uniform architecture.

7. Relation to adjacent fields and prospective directions

CDD overlaps with, but is not identical to, several neighboring domains. It intersects with cognitive security in HCPSs, which emphasizes cross-layer human-cyber-physical protection and reinterprets confidentiality, integrity, and availability in terms of the cognitive process itself (Huang et al., 2023). It intersects with cognitive warfare, which frames the contest as OODA disruption across acute and chronic horizons and introduces “cognitive superiority” as a measurable condition of decision advantage (Rushing et al., 5 Mar 2026). It intersects with cognitive cybersecurity for AI reasoning, which extends the security perimeter to inference processes and prescribes Cognitive Penetration Testing before deployment (Aydin, 19 Aug 2025). It also intersects with behaviorally adaptive defense, telemetry-based attacker modeling, and human-centered interactive machine learning (Hans et al., 23 Oct 2025, Michael et al., 2020).

Several prospective directions recur across the literature. One is closed-loop adaptation: sensing attacker cognition, choosing interventions, observing behavioral change, and iterating. GAMBiT presents this most explicitly but still notes that some surveillance sensors were not delivered as software and that several capabilities remained conceptual (Beltz et al., 27 Nov 2025). Another is richer observability: the Suricata-only pipeline proposes adding host telemetry, authentication traces, and system logs (Hans et al., 23 Oct 2025). A third is stronger experimental elicitation of specific biases, as in the call for ambiguity-explicit cyber ranges where uncertain choices carry tangible penalties (Carney et al., 8 Dec 2025). A fourth is architecture-specific governance for AI systems, where CPT is recommended before deployment because mitigation backfire is a real possibility (Aydin, 19 Aug 2025). A fifth is proactive anticipation of future technologies likely to be weaponized for cognitive attacks, rather than retrospective cataloguing of known tactics (Rushing et al., 17 Oct 2025).

Across these lines, the unifying proposition remains stable: defense is improved when it models and manages cognition directly. Sometimes that means predicting an attacker’s beliefs; sometimes it means preserving the analyst’s workload balance; sometimes it means hardening an AI system’s reasoning; sometimes it means measuring decision latency and interpretive coherence instead of message spread. Taken together, the literature indicates that CDD is best understood as a family of defense paradigms centered on cognition as a contested, measurable, and engineerable domain (Malloy et al., 2023, Rushing et al., 5 Mar 2026).