Abstract
Cognitive biases can influence the decision-making of board
members and CISOs responsible for managing cyber risks.
However, limited attention has been given to understanding how
these biases affect cybersecurity governance, specifically in the
communication of risks between CISOs and boards. This paper
aims to address this gap by identifying cognitive biases and
proposing how these biases influence communication and
strategic decision-making in cybersecurity governance. By further
examining their impact, we strive to uncover the mechanisms that
contribute to underestimations or distortions in risk perception,
which can compromise an organization’s ability to respond
effectively to cyber threats. This short paper provides three
exemplary biases expected to influence communication and
decision-making in cybersecurity governance. Following the
initial results, we propose a series of interviews with CISOs to
reveal the challenges they face when communicating cyber risks
to boards, focusing on how biases influence the decisions
regarding cybersecurity risks.
members and CISOs responsible for managing cyber risks.
However, limited attention has been given to understanding how
these biases affect cybersecurity governance, specifically in the
communication of risks between CISOs and boards. This paper
aims to address this gap by identifying cognitive biases and
proposing how these biases influence communication and
strategic decision-making in cybersecurity governance. By further
examining their impact, we strive to uncover the mechanisms that
contribute to underestimations or distortions in risk perception,
which can compromise an organization’s ability to respond
effectively to cyber threats. This short paper provides three
exemplary biases expected to influence communication and
decision-making in cybersecurity governance. Following the
initial results, we propose a series of interviews with CISOs to
reveal the challenges they face when communicating cyber risks
to boards, focusing on how biases influence the decisions
regarding cybersecurity risks.
| Original language | English |
|---|---|
| Title of host publication | 38th Bled eConference: Empowering Transformation |
| Subtitle of host publication | Shaping Digital Futures for All: Conference Proceedings |
| Editors | Andreja Pucihar, Mirjana Kljajic Borstnar, Roger W.H. Bons, Stasa Blatnik, Koen Smit, Marjeta Marolt, Matthias Glowatz |
| Publisher | University of Maribor Press |
| Pages | 737-744 |
| Number of pages | 8 |
| ISBN (Electronic) | 978-961-286-998-4 |
| DOIs | |
| Publication status | Published - 2025 |
Publication series
| Series | Bled eConference |
|---|---|
| Volume | 38 |