CNRS x Alcyconie study: cognitive psychology and cyber crisis management

A cyber crisis is not played out solely on technical ground. While the IT response is essential to contain the incident, the organization’s survival is decided elsewhere: around the crisis cell table.

It is there, in this high-pressure closed-door setting, that executives, legal directors, communication managers and technical experts must collaborate. They face a paradoxical situation: they must make strategic decisions with heavy consequences (halting production, going public, paying or refusing to pay a ransom), all within a constrained timeframe and on the basis of information that is often fragmented, technical and overwhelming in volume.

In this context of radical uncertainty, how does the individual process information? How can we ensure that certain factors do not bias judgment? It is to answer these questions that Nathan Vital, doctoral candidate at Alcyconie, is leading an unprecedented doctoral research project at the crossroads of cognitive psychology and cybersecurity.

Anonymous study – 12-minute duration

Contribute to the production of scientific knowledge

TAKE PART IN THE STUDY

1. Genesis of an encounter: from the field to the laboratory

This doctoral project was not built ex nihilo. It is the result of an encounter between two worlds that have everything to gain from collaborating: operational expertise and academic rigor.

It all began during the preparation of Nathan Vital‘s Master’s 2 internship. His research supervisor, Aline Chevalier (Professor of Cognitive Psychology and Ergonomics at the CLLE laboratory), was put in touch with Stéphanie Ledoux (CEO of Alcyconie) through a mutual connection. From the very first exchanges, a clear ambition emerged on the Alcyconie side: understanding, through a scientific lens, the decision-making of operators in real situations.

In the field, during the immersive crisis exercises organized by Alcyconie, experts were observing recurring phenomena: hasty decisions, fixations on technical details, or difficulties in communicating.

The intuition then emerged that psychological mechanisms were at work, which is why it became necessary to move from observation to scientific explanation. There was a genuine need to understand, through an experimental lens, what was really happening in the minds of decision-makers.

The finding: a scientific gap to fill

During this Master’s 2 internship, while familiarizing himself with the scientific literature, the doctoral candidate made a striking observation. There was an abundance of work on decision-making in crisis situations (humanitarian, nuclear, aeronautical, etc.). We knew, for example, how cognitive biases affected emergency physicians or pilots.

But paradoxically, cyber crisis management remained a blind spot in research. The specificities of this field (an intangible threat, strong technical complexity, extreme time pressure and systemic consequences) had not been studied through the lens of cognition.

It was from this observation that a shared conviction emerged between the laboratory and the company: there was an urgent need to develop a dedicated scientific approach to cyber crisis management.

2. The CIFRE thesis: a bridge between research and business

To bring this ambition to life, the CIFRE scheme (Convention Industrielle de Formation par la Recherche, an industrial research training agreement) offered by the ANRT (French National Association for Research and Technology) emerged as the obvious choice. This scheme allows the doctoral candidate to conduct research half-time in a public laboratory (here the CLLE laboratory, CNRS/Université de Toulouse Jean Jaurès) and half-time in a company, at Alcyconie. This project, now a winner of the France 2030 “Critical Cyber Innovations” call for projects, addresses a dual need:

1. Scientific: filling the data gap on the cognition of decision-making in cyber environments.
2. Societal: strengthening the resilience of French organizations (operators of vital importance, businesses, public authorities) by giving them keys to understanding so they can better defend themselves.

3. At the core: reasoning and situational awareness

The research project is built around a central question: when facing the unknown under pressure, how do we sort through information?

In a calmer situation, we have the time to analyze each piece of information. But a cyberattack reshuffles the cards: the flow of information becomes massive, contradictory, and time runs short. In this context, scientific literature tells us that humans switch into a different “operating mode”. To save time, our brain takes “cognitive shortcuts”.

Intuition versus analysis. This is the heart of the matter: the permanent tension between intuition (fast, automatic) and analysis (slower, more energy-consuming). While intuition is essential for reacting quickly, it can sometimes play tricks on us and distort the perception of reality.

The objective is to understand how these mechanisms influence situational awareness (the ability to understand what is really happening at any given moment). Do these intense situations help focus attention on the right elements, or on the contrary, do they trap the decision-maker in tunnel vision? It is precisely to measure these invisible phenomena, without preconceptions, that field data collection is necessary.

4. Take part in the ongoing national study

The project is currently in a pivotal phase: data collection for an initial study. After laying down the theoretical foundations, the goal is now to observe how these mechanisms are activated in professionals in real situations.

This is why a call for participation in a large-scale online study is being launched.

Your profile is of interest to us! Whether you are a CIO, CISO, member of executive leadership, legal counsel, HR professional or communications specialist, if you have ever been involved, closely or remotely, in cyber crisis management (whether real or during an exercise), your experience is valuable.

What does the study consist of? It is a secure online questionnaire (on the Qualtrics platform), lasting 12 minutes. You will be immersed in realistic crisis management scenarios. There are no “right” or “wrong” answers: the objective is simply to capture how you process information and make decisions in an uncertain context.

Why take part? Taking part means helping scientific research better understand the human behind the screen. It means contributing to making our organizations more resilient against the threat.

In return, a debrief webinar will be organized at the end of the study to share with participants the main trends observed (anonymized) and the key takeaways for their own practices.

Anonymous study – 12-minute duration

Contribute to the production of scientific knowledge

TAKE PART IN THE STUDY

Thank you for contributing to the production of scientific knowledge that will benefit the cyber field!

Study conducted by:

Nathan VITAL – PhD candidate in cognitive psychology – CIFRE doctoral fellow at Alcyconie