Can individual differences in cognitive capacity predict cybersecurity performance?

Cyber defense analysts work in highly demanding environments, making numerous critical decisions on the basis of complex information presented at a rapid rate. Individual differences in cognitive capacity may contribute significantly to cyber performance success but researchers have yet to definitively determine what cognitive functions play the most significant role in cybersecurity performance. To further understand the role of individual differences in attention and cognition that affect cyber performance in the cybersecurity domain, this exploratory study involved collecting measures of cognitive performance from 19 experienced cybersecurity analysts using three well-established measures designed for individual differences research. The individual differences were compared with behavioral performance (accuracy and response time) in a simulated incident detection system identified as ecologically valid in cybersecurity research. Results showed a significant relationship between incident detection performance and multiple cognitive variables. Specifically, analysts with higher working memory capacity performed more accurately and more quickly, while those that showed more evidence of distractibility performed less well. These findings suggest that easily obtained behavioral measures of attention control may be useful for: (a) identifying individuals who may be better suited to performing specific cognitive demands of incident detection tasks, and (b) informing system design to reduce demands on specific areas of cognitive processing to improve incident response decisions.