AI and decision-making in cyber crisis management: contributions, biases and limitations

The integration of artificial intelligence into cyber crisis management is often approached from the perspective of productivity: automating tasks, producing reports, accelerating the synthesis of information. These contributions are real, immediate, and already decisive.

But the value of AI may also lie elsewhere: in its ability to support humans at the moment when they are most vulnerable, namely when they must make decisions under stress, in uncertainty, and under time pressure. A closer look.

Crisis: a cognitively hostile environment

Cognitive sciences describe crisis situations as environments that are particularly unfavorable to decision quality. The factors are well known:

• time pressure,
• high volumes of information,
• weak signals drowned in noise,
• contradictions between sources,
• fatigue,
• emotional tension,
• multi-stakeholder complexity…

In cyber crisis management, a specific dimension is often added: information asymmetry between technical teams, decision-makers, legal experts and communication teams, making the situation even harder to stabilize.

Under these conditions, the main limitation is not the quantity of information available, but the human ability to process it. A high cognitive load mechanically leads to saturation phenomena, particularly among non-experts: difficulty prioritizing information, attentional drift resulting in a tendency to focus on salient elements at the expense of weak signals.

Moreover, these demanding situations can lead to a loss of perspective, impulsive decisions driven by intuition or, conversely, paralysis.

This increase in cognitive load can be understood through two concepts:

• first, intrinsic load, which refers to the inherent difficulty of the task itself. For example, deciphering a large and complex data table.
• second, extraneous load, which refers to interference in the environment in which the task is carried out. For example, a very high level of ambient noise.

The challenge, therefore, is not simply to move faster. It is to preserve the human ability to make sound decisions.

What high-risk industries teach us about decision-making under pressure

Crisis management is not the only field confronted with these constraints. Aviation, emergency medicine, the nuclear industry and certain military activities have long operated in environments where mistakes can be fatal. Their approach is instructive: in these sectors, the response has never been to replace humans with automation, but to build assistance systems that reduce cognitive load while maintaining responsibility and control.

Aviation checklists, the notion of a co-pilot, redundant controls, standardized communication procedures, expert systems, and simulation and training mechanisms are not gadgets. They are systems designed to compensate for predictable human limitations: metabolic and cognitive fatigue, stress, and cognitive biases.

Cyber crisis management is entering the same logic: it can no longer rely solely on the experience of key individuals, nor on systems heavily dependent on individual commitment. It must equip itself with tools capable of supporting humans precisely when their cognitive capacities are under strain.

Using AI as a cognitive co-pilot in cyber crisis management

Within this framework, generative AI is not a decision-maker. It can, however, become a cognitive co-pilot at three levels.

First, by structuring information. During a crisis, information arrives in waves: field reports, technical alerts, internal exchanges, external requests, inquiries from authorities, questions from the media. AI can help consolidate, reformulate, synthesize and prioritize these flows in order to refocus attention on what truly matters.

Second, by facilitating perspective. Crises follow behavioral patterns: phases, rhythms, recurring mistakes and structuring decisions. Properly integrated AI can recall precedents, highlight analogies, suggest possible scenarios of evolution, or help make implicit assumptions explicit.

Finally, by supporting the formulation of decisions. Not by deciding in place of humans, but by helping clearly formulate options, associated risks, trade-offs and consequences. In many crises, the error is not only technical: it is often linked to a poorly articulated, poorly formulated, poorly shared or poorly understood decision.

🔗 Read also: AI and cyber crisis management: a powerful lever… under strict conditions

Cognitive biases: a silent threat

In crisis contexts, cognitive biases represent a silent threat. Urgency, uncertainty and stress saturate the processing capacities of decision-makers, generating significant cognitive load, and sometimes cognitive overload.

Beyond their harmful effects on memory and attentional capacities, these situations encourage the use of mental shortcuts which, when they lead to errors, are referred to as cognitive biases.

For example, attentional fixation on a single stimulus or the exhaustion caused by repeated decision-making both facilitate cognitive biases. An individual may therefore favor information confirming an initial hypothesis (confirmation bias) or be excessively influenced by the way information is framed rather than by its substance (framing bias).

AI can help support decision-making by reducing informational overload and thereby mitigating some of these biases, introducing a form of counterbalance: reformulation, reminders of alternative hypotheses, or highlighting blind spots. But it does not eliminate bias: it shifts the risk.

Because another, more insidious bias then emerges: excessive trust in the tool itself.

The risk of automation bias: a cognitive dependency that must be controlled

Cognitive sciences have extensively documented “automation bias”: the more efficient an assistance system becomes, the more humans tend to implicitly delegate analysis, or even judgment, to it. This phenomenon is particularly dangerous because it is rarely conscious. Humans no longer decide “with” the tool: they decide “according to” the tool.

In cyber crisis management, this drift is critical. AI can produce a coherent synthesis… but a false one. A plausible correlation… but an incorrect one. A convincing recommendation… but one unsuited to the human, political or organizational context.

AI can therefore be a tool serving efficiency, but it can also become a factor of fragility if it is used as an implicit authority.

🔗 Read also: Resilience in the age of AI: the delicate art of balance

A fine balance: supporting without short-circuiting

The challenge, therefore, is to design AI integration as a structured interaction, not as delegation.

This requires a clear framework:

• AI produces syntheses, hypotheses and scenarios,
• humans validate, arbitrate and take responsibility,
• decisions remain explicit, traceable and discussable.

This controlled integration of AI into cyber crisis management should help create a calmer informational environment for decision-makers. It should be conceived as a collaboration with the machine that promotes cognitive offloading, without ever being considered a substitute for the expertise and experience of decision-makers.

It can make organizations faster, more resilient and more robust.

But it must not weaken what defines high-quality crisis management: intimate knowledge of the organization and its specificities, discernment, and responsibility.

FAQ: AI, cognitive load and decision-making in cyber crisis management