Overcoming Cognitive Biases in Security Decision-Making
Introduction
Many security professionals assume they make better decisions than the average person, but studies indicate otherwise. Security leaders frequently succumb to the same biases as the general population, relying on instinct and past experiences rather than data and probabilities. These biases can significantly impact risk management and safety decisions. Cognitive biases—overconfidence, reliance on intuition, and subjective judgment—pose persistent challenges in achieving consistent risk identification. Overconfidence leads to quick, intuitive decisions (fast thinking) and more prone to biases. In contrast, slow, deliberate decision-making processes can help mitigate these biases by allowing more time to consider different perspectives and gather additional information. Awareness is the first step to correct this issue, and analysis of decision-making tools has unveiled many pitfalls.
Understanding Kahneman's Contribution
Daniel Kahneman's work on cognitive biases, particularly the concepts of fast and slow thinking, is crucial for understanding these issues. In his book Thinking, Fast and Slow, Kahneman describes two systems of thought:
System 1 (Fast Thinking): This system operates automatically and quickly, with little effort and no sense of voluntary control. It relies on intuition and past experiences, making it prone to biases. For example, a security professional might make a quick decision based on gut feeling without thoroughly analysing the situation.
System 2 (Slow Thinking): This system allocates attention to the effortful mental activities that demand it, including complex computations. It is deliberate and analytical, helping to mitigate the biases of System 1. When security professionals take the time to gather data and consider different perspectives, they are engaging System 2.
Kahneman's research highlights that while System 1 is necessary for efficiency and quick responses, it can lead to errors in judgment, especially in complex situations like security risk management. Engaging System 2 can help mitigate these errors by promoting more thorough and rational decision-making processes.
IDEA Protocol and Aggregation of Opinions
Using structured interview protocols like the IDEA protocol can help standardise the risk identification process. The IDEA protocol stands for "Investigate," "Discuss," "Estimate," and "Aggregate," and involves the following steps:
Investigate: Experts first investigate the questions and clarify their meanings. They then provide their private, individual best guess point estimates and associated credible intervals (Round 1).
Discuss: Experts receive feedback on their estimates relative to other experts. With a facilitator's assistance, they discuss the results, resolve different interpretations of the questions, cross-examine reasoning and evidence, and provide a second and final private estimate (Round 2).
Estimate: After discussing, experts refine their estimates based on the new understanding gained.
Aggregate: The individual estimates are combined using mathematical aggregation.
The purpose of the discussion is not to reach a consensus but to resolve linguistic ambiguity, promote critical thinking, and share evidence. This approach has been shown to improve response accuracy and is based on evidence that a single discussion stage within a standard Delphi process generates improvements in accuracy.
Case Study: Application of the IDEA Protocol and Delphi Technique
For example, a security team tasked with assessing the risks associated with a new facility can use the IDEA protocol to identify potential threats, vulnerabilities, and impacts systematically. They can then employ the Delphi technique to gather input from diverse experts, such as security professionals, local law enforcement, and community representatives. By combining these approaches, the team can develop a comprehensive risk assessment that reflects various perspectives and mitigates individual biases.
Consistent Risk Assessments Across Sites
For organisations with numerous assets or facilities, developing a standardised risk assessment for each type can help reduce variation. Here's a practical approach:
Identification Stage: Gather all stakeholders and analysts together. Identify assets, threats, and potential vulnerabilities (opportunities & hazards) in this stage. Apply a rating scale of 1 to 5 (5 being the highest) for each item within each category.
Initial Consensus on Risks: After establishing the context, gather all analysts and stakeholders to agree on the primary risks and develop a comprehensive list—Formalise risk statements (Consequence, Asset, Source, Event) for each identified risk. Aim to create a list of 30-50 risks. When all elements are added to a risk statement, the average values of your ratings from the identification stage can provide a priority list of risks.
Centralised Risk Assessment for Consistency: Write only ONE centralised risk assessment that can be applied across multiple sites with similar assets within your organisation. This centralised approach streamlines the risk assessment process and ensures all sites are evaluated using the same criteria.
Standardised Controls Assessment: Develop control assessments based on the risks established. Have the analysts conduct control assessments at each site based on an agreed-upon list. Adjust each site's risk ratings by evaluating the effectiveness of the controls in place against the defined list of risks. This means that the risk ratings at each site are adjusted according to how well the controls at that site mitigate the identified risks, ensuring consistency and accuracy across all sites.
This approach minimises biases, ensures comprehensive risk identification, and prioritises risks based on collective agreement using an Aggregation of Opinions method. It also saves time by reducing the number of security risk assessments needed.
The image depicts a security professional at a crossroads, faced with a choice between two paths. One path is well-worn, representing the quick, intuitive decisions of System 1 thinking. The other path is more obscured, symbolizing the deliberate, analytical approach of System 2 thinking.
Corrective Actions for Cognitive Biases
To further mitigate cognitive biases, consider implementing the following corrective actions:
Gather a Group: Multiple viewpoints and healthy debate can help identify cognitive missteps and uncover unorthodox solutions. Consider appointing a devil's advocate to challenge assumptions and point out potential pitfalls. For example, during a risk assessment meeting, assigning a team member to play the role of devil's advocate can help surface overlooked risks and challenge prevailing assumptions.
Slow Down: Fast thinking often relies on intuition rather than reason. If possible, plan to make decisions over longer periods to gather additional information and input. For instance, instead of making quick decisions based on initial impressions, schedule follow-up meetings to allow time for further data collection and analysis.
Aim for Options: Don't stop after identifying one strong contender to mitigate risk. Generate multiple options to force thorough evaluation. This approach encourages the exploration of alternative solutions and reduces the likelihood of settling on suboptimal choices. For example, when developing a risk mitigation plan, consider multiple strategies and evaluate their potential effectiveness before making a final decision.
Undercut Optimism: Use techniques like premortems to imagine future failures and identify potential issues. This helps prepare backup plans and highlights factors influencing success or failure. A premortem involves envisioning a scenario where a project has failed and then working backward to identify the causes. This technique can help identify potential risks that might not be evident in a forward-looking analysis.
The image depicts a security professional standing before an abstract, angular sculpture that represents the decision-making process. The sculpture is composed of intersecting planes and sharp edges, conveying a sense of complexity and multifaceted considerations.
Understanding Biases to Watch
Several cognitive biases can impact decision-making in risk management:
Certainty Effect: People prefer a certain outcome over a probable better outcome, even if the latter is statistically optimal. For example, security professionals might choose a known but less effective security measure over a potentially more effective one because it feels more certain.
Reflection Effect: When faced with potential losses, individuals often gamble for a larger loss rather than accept a smaller, certain loss. This can lead to riskier decisions in an attempt to avoid a definite loss.
Isolation Effect: Decision-makers tend to ignore earlier stages of decisions and focus only on the final stage, leading to suboptimal outcomes. For example, focusing solely on the final implementation of a security measure without considering the initial planning and intermediate steps can result in an incomplete or ineffective solution.
Nonlinear Preference Bias: Small probabilities are often overrated, which affects how resources are allocated to mitigate low-probability, high-impact events. Security professionals might allocate disproportionate resources to prevent unlikely events, such as terrorist attacks while neglecting more probable risks.
Conjunction Fallacy: More detailed scenarios are mistakenly considered more likely than simpler ones. For instance, believing a detailed narrative about a specific security threat is more likely than a general statement about security risks can lead to focusing on less likely scenarios.
Conclusion
Recognising and addressing cognitive biases is crucial for making more informed and effective security decisions. By implementing structured methodologies and corrective actions, organisations can enhance the accuracy and reliability of their risk assessments, ultimately improving safety and security. Awareness of cognitive biases and implementing structured methodologies like the IDEA protocol and Delphi technique can significantly enhance the accuracy and effectiveness of security decision-making processes. Through continuous improvement and the adoption of best practices, security professionals can mitigate the impact of biases and make more informed decisions that enhance the safety and security of their organisations.
Daniel Kahneman's work has highlighted the importance of recognising the "flaw in human judgment" and understanding that even seasoned professionals are susceptible to biases. By acknowledging what we don't know and acting on that awareness, security practitioners can become more reasoned in their decisions, leading to better risk management outcomes.
Jamie specialises in Physical Security Governance, Risk Management, and Compliance (GRC) for critical infrastructure and government entities. With over 15 years of experience, including service in the New Zealand Defence Force, he focuses on developing comprehensive physical security solutions that protect assets and ensure personnel safety. Jamie's expertise lies in translating complex security challenges into actionable strategies, emphasising informed decision-making through robust risk assessments. His mission is to elevate industry standards while aligning security measures with organisational objectives. A former professional rugby player, Jamie brings teamwork and adaptability to solving intricate security challenges.
