WHY WE DESIRE BENCHMARKINGTHE COGNITIVE/NEUROSCIENCE FOUNDATION

W

When a senior leader asks for Benchmarking or similar ‘positional’ data, the well-understood purpose is to inform the decision-makers’ overarching mental model of where the organization or firm stands in relation to an attack surface or competition in an ecosystem, thus influencing future decision-making.  Yet, this is just a visible manifestation of a complex Cognitive and Neuroscientific process that, if understood at the deepest levels, can highlight a path to numerous organizational and individual benefits. 

The desire for trustworthy benchmarking and similar positioning data intended to assess the firm’s ‘posture’ relative to other similar entities or dangers has remained an elusive and constant desire on the part of senior executives.  The overarching question usually is a permutation of: “As the CISO, I would like to know how we (the firm) compare along various dimensions of cyber security to our selected framework, peers, or in relation to the changing attack surface?”

The question appears straightforward and driven by a simple need, but it is neither.  In fact, it is an extremely difficult question to answer from a quantification and visualization standpoint due to the highly nuanced nature of every firm and the dynamic nature of the threat landscape.  In addition, the “simple need” is the visible manifestation of a series of complex processes in the brain which underpin the formation and updating of the brain’s internal models and predictions, which in time, heavily influence decision-making.  From a deeper level of understanding, these functions occur in the Neocortex, the Limbic System, Thalamus, and the Visual Cortex, all with inputs from the primary visual system (V1) and other brain regions.

What is scientifically interesting from a Cognition lens is the “why” behind the articulated question – “Why does the brain desire information from this specific framing perspective – E.G., data to entities, objects, or others in the ecosystem or a framework?” “Why does the brain desire to understand relative positioning?” “Is there a deeper reason the brain cares beyond the obvious determining immediate action steps?”

Developing access to Cognitive/Neuroscience expertise can help shape the firm’s Digital Transformation (DX) and inform UX/UI Design and even new models of Human/AI Complementarity.

A straightforward example would be designing the CISO’s metrics, measures, and visual analytics to dynamically and naturally answer benchmarking questions and subsequent action steps.

 Positioning & Ubiquitous Brain Functions:

Attempting to decode the visible manifestations of our problem identification and Situational Awareness/Understanding behavior (I.E., asking for benchmarking data), is no small order and requires contributions from numerous scientific fields. The danger lies in accepting well-intentioned and logical suppositions which are false. 

For this brief overview, I will limit the discussion to the human brain’s most visible component in this process, which handles higher-order functions, the Neocortex or more commonly referred to simply as “the Cortex.”  We can think of the Neocortex, the part of the brain from where cognition and perception are derived.  The Neocortex performs the higher-order functions that define us as humans, including analysis.  Determining relative positioning to other ‘things’ in an ecosystem is a function of the Cortex.  All this information is intended to inform our Internal Models of the world and create an endless series of Reference Frames and Predictions of what our world will manifest itself as and what it will do.  This can range from what a screwdriver will look and feel like to the effects on the enterprise risk ‘profile’ if a new technology is purchased and incorporated in relation to a changing threat landscape.  

Among the never-ending, ubiquitous functions undertaken by the brain is to constantly assess our environment through confirmation and errors in its predictions.  Part of this never-ending process is the desire to understand our positioning relative to all things, including real-world and man-made constructs, I.E., our CyberPhysical world. Thus, the visible manifestation of desiring Benchmarking data is a function of the Cortex’s desire to Understand through validating its mental models and reference frames.  Seemingly simple requests (which are often very difficult to answer) like “How do we compare to our industry peers concerning the implementing of a Cyber Security Framework?” can be correctly viewed as part of a complex and never-ending process deeply rooted in the Cognitive Neuroscience of Risky Decision-Making.   

Perception, Cognition & Understanding through Positioning:

Definitions:

·         Perception: the state of being or process of becoming aware of something through the senses

·         Cognition: the mental action or process of acquiring knowledge and understanding through thought, experience, and the senses

Until recently, scientists have pursued the studies of Perception and Cognition as distinct fields of study however new research is indicating that the delineation between the two scientific fields may be much less distinct than previously thought.[1]  Scientists are now pursuing an interdisciplinary approach to understanding the components and nexus of Perception and Cognition.  This is important as both are essential “how” and “what” we see, believe, and thus predict our world to be and behave like. Even though the brain doesn’t precisely know what it will find in its daily exploration of the world, it is endlessly learning, predicting, and validating its predictions as one of its defining functions. It does this even as we look at data on a dashboard. The brain predicts what it will see and deliberately searches for data points that validate those assumptions.  We know through research that data interrogation can vary widely from individual to individual, making generic dashboards far less effective than is often thought. Cognitive Neuroscience and Neuro Psychology can now facilitate the inclusion of personality traits – strengths and weaknesses at the individual level into a dashboard and UI design.  This holds tremendous promise as the design thinking has been predicated on Use Cases/Requirements derived from the user. This approach, while appearing sophisticated, suffers from the inherent flaw that what a user articulates is not what the brain will do at a later point.  The proof here is that many a dashboard has been designed for a  senior decision-maker through a rigorous design process only never to be accessed – not even once.

A secondary cognitive aspect to the desire to obtain ‘positioning data’ can also be rooted in the brain’s reward system.  When comparing something “owned” and another, mesolimbic dopamine pathways can be activated, creating the “pleasure/reward” response.  The inverse is also true when seeing positioning data that could potentially be very harmful.  Thomas Khun, in his seminal work on Paradigms, discovered that when data directly contradicts the user's mental model, they often refuse to acknowledge the data and ignore it completely.  Experiments since Khun’s discovery have confirmed his findings.

The Brain Wakes Up

Arguably the biggest trick the brain plays on us is to believe we are aware of our surroundings and well-engaged with the task at hand.  We walk through life and explore data in “auto-pilot” mode until the brain identifies a deviation from its predicted models, it then “awakens” and may move to act.  It is also believed that the brain’s fear center (the Amygdala) can be activated and prompt rapid and decisive decisions to rectify the situation if the danger is grave enough.  People in great danger often recall the event sequence scenario as if time slowed and the event is seen in slow motion.  This is a clear sign that the Amygdala is activated.

The final deep-rooted underpinning for ‘asks’ like Benchmarking data centers on how the brain learns.  Hebbian learning is a neuropsychological theory and is among the best learning theories at this deep level of analysis.   Hebbian learning is based on a simple rule of neurons firing and wiring together in a weighted manner in accordance with a stimulus.  Stated that if two neurons fire together, their bond becomes stronger. It is believed that Hebbian learning is involved in various cognitive tasks.

On a conscious level, an interesting learning method is what we all understand as true but often do not consciously recognize - Error-Based learning.  Error-Based learning occurs when there is a ‘delta’ between what we expected and what was seen.  The brain updates the formulation of its internal models to eliminate errors enabling us to adapt highly to new situations and navigate the future.  The desire for positional data to validate previous decisions and their anticipated outcomes (I.E., the incorporation of technology and a subsequent improvement in the firm’s cyber security posture) fits perfectly into this type of learning.

The final interesting point is that the brain learns through movement.  Our senses have been acutely attuned to learning as we move through the world.  Learning through movement doesn’t require us physically move – moving through a 3D world on a computer validates this statement. Time can even become a component in computer-based movement, with the brain perceiving important connections, correlations, and events within time sequences of game ‘patches’ and updates. Ask any teenagers who played a Massive Multiplayer Online (MMO) game what the differences between patches is and they can tell you.  Not necessarily to the “Nth” detail but the important changes and resulting impacts on gameplay. This is the brain demonstrating its immense flexibility and perhaps an opportunity for UX/UI design in the corporate world.

Conclusion

In conclusion, the manifested behaviors we often see from decision-makers on one level appear as simple asks. Still, upon deeper examination, we can see that the very structure and Cognitive functioning of the brain underpins them.  Future theoretical thinking in this realm can and should focus on creating new models of Human/AI Complementarity to help inform the various requests by decision-makers for positioning data in human-centric ways that address today’s multi-dimensional nature of data and the ways in which the brain learns, creates and validates mental models. It will be through new models of complementarity that are designed to engender trust and deliver information at the speed of relevance that will lead to improved decision-making at speed and scale.

[1]  A great and brief read on this changing field of study.  (https://www.psychologicalscience.org/observer/cognition-and-perception-is-there-really-a-distinction)