What sustained pressure does to operational performance
This matters because sustained pressure affects exactly the capabilities that incident response depends upon. Communication is one of the first places the strain becomes apparent, although not because people stop communicating – quite often the opposite happens and the volume of communication increases dramatically.
Meetings, briefings and updates multiply, with different stakeholders requiring different versions of the same information. Technical teams need one level of detail, executives another, while legal advisers, regulators, customers and communications teams may need something different again. Communication stops simply being the mechanism through which the work happens and becomes another substantial piece of work in its own right.
At the same time, fatigue can alter how people interpret each other. As tolerance reduces, a message that might ordinarily be read as neutral can feel critical or challenging, making small misunderstandings harder to resolve. Over time, this can make it more difficult to sustain the trust and candour needed for people to challenge assumptions.
During a complex incident, nobody has the complete picture. SOC teams, executives, communications, legal advisers and external partners may each hold different pieces of it. As information changes, different parts of the organisation can develop a different understanding of what is happening. The decisions they make may be perfectly reasonable based on the information they have, but those decisions are being made from different pictures.
The operational consequence is significant. More effort has to be diverted into rebuilding alignment and making sure people are working from a common understanding of what is happening. Even then, that shared understanding may begin to degrade again almost immediately.
All of this is happening while the hardest decisions still have to be made. Contain now or understand more first? Maintain the security control or keep the business operating? Escalate now or wait for more evidence?
Expertise does not remove these tensions – it enables people to manage them. The problem is that sustained pressure progressively consumes the cognitive capacity on which that judgement depends.
Building cognitive readiness
This is where I believe cybersecurity needs to broaden its concept of preparedness. Knowing what to do is essential, but it is not the same as having the capacity to do it effectively after days, weeks or even months of sustained pressure.
Cognitive readiness is the trained capacity to maintain operational effectiveness under those conditions: to think clearly when information is incomplete, make sound decisions as situations evolve, co-ordinate effectively when priorities compete and learn from experience in ways that improve future performance.
In practice, cognitive readiness can be considered through four interconnected areas:
• Regulating our response to pressure and maintaining effectiveness under sustained load.
• Thinking effectively and exercising sound judgement under uncertainty.
• Connecting and co-ordinating with others through trust and effective communication.
• Adapting through experience and turning that experience into learning that improves future performance.
At Mind Science, these four areas provide the structure we use to understand cognitive readiness in practice.
Crucially, these capabilities can be developed, but doing so requires more than another one-off training course. People need opportunities to practise under realistic pressure, with repeated opportunities to apply, reflect and refine. Development should be informed by behavioural assessment and remain close enough to operational reality for learning to transfer back into the job.
Behavioural assessment can also tell us more than whether someone makes the‘ right’ decision. Situational judgement approaches use realistic operational scenarios to examine the quality of people’ s judgements. Looking at confidence alongside those judgements can reveal something equally important: whether someone’ s level of confidence matches the quality of the decisions they make.
Developing individual capability is only part of the picture. Organisations also need to consider the working conditions that create or amplify sustained pressure in the first place. Cognitive readiness and good organisational design have to work together.
People need opportunities to practise under realistic pressure, with repeated opportunities to apply, reflect and refine.
WWW. INTELLIGENTCISO. COM 39