The Intersection of Cyber Psychology and Security: Key Takeaways, Podcast, and Full Transcript

In a recent episode of the CYBR Perspective podcast, Sevgi Aksoy, lead Cyber Psycology Research Consultant at Psyber, Inc. discussed the growing role of psychology in cyber security. From understanding cognitive biases to managing stress in high-stakes environments, this conversation reveals how human behaviour shapes the world of cyber defence. Below, you’ll find an article summarising the key takeaways for quick reference, followed by the podcast itself and a full transcript.

The Psychology of Cyber Security: Key Insights and Practical Applications

Cyber security is no longer just about technical defences; understanding human behaviour is increasingly vital for robust security strategies. In this era of sophisticated attacks, psychological insights provide a valuable lens to comprehend, anticipate, and mitigate cyber threats. Here’s an exploration of the intersections between psychology and cyber security, along with advice for aspiring professionals and data-backed insights to support these ideas.

1. Intersection of Cyber Security and Psychology

• Cognitive Biases and Decision-Making: Cyber security experts often face decisions influenced by cognitive biases such as overconfidence and confirmation bias. These biases impact how people respond to phishing attacks and other threats.
  • Proof: Research has shown that cognitive biases play a significant role in cyber security decision-making, affecting how individuals assess threats and implement measures. securityquotient.io
• Behavioral Insights for Stronger Security: Incorporating psychological insights about human behavior strengthens security by addressing common vulnerabilities.
  • Proof: Studies highlight that individual traits in cognition and behavior relate to cyber security practices, underscoring the need for psychologically-informed security training. frontiersin.org

2. Transitioning from Psychology to Cyber Security

• Psychology as a Pathway: People with psychology backgrounds can excel in cyber security, especially in areas involving social engineering and human-centric defenses.
  • Proof: Educational institutions are increasingly offering interdisciplinary cyber security programs, recognizing the need for psychology skills in this field. link.springer.com
• Soft Skills Matter: Roles like cultural adaptation and marketing, though non-technical, are essential in cyber security, where understanding human behavior is critical.
  • Proof: Studies underscore the importance of cognitive understanding and human behavior analysis in establishing a robust security culture. er.educause.edu

3. Human Factors in Cyber Attacks

• Fear and Reward Manipulation: Attackers exploit psychological tactics like fear and reward to compel victims to act.
  • Proof: Scammers leverage emotions such as fear and urgency to deceive individuals, with awareness and education being effective countermeasures. verywellmind.com
• Social Engineering Awareness: Understanding psychological triggers helps organizations build resistance to social engineering attacks.
  • Proof: Studies confirm that awareness of cognitive biases is essential for developing resilience against common hacking techniques. thesecuritycompany.com

4. Stress and Mental Health in Cyber Security Professionals

• Preventing Burnout: In high-stakes environments, burnout is common. Regular breaks and “cooling off” periods support better decision-making and mental well-being.
  • Proof: Surveys reveal that 62% of IT and security leaders experience burnout, highlighting the need for stress management strategies. darkreading.com
• CBT for Stress Management: Cognitive Behavioral Therapy (CBT) techniques, such as recognizing and managing stressors, can help cyber security professionals stay resilient.
  • Proof: Implementing CBT strategies has proven effective in reducing burnout in high-stress fields like cyber security. securityweek.com

5. Negotiating with Cyber Attackers

• Psychological Skills in Ransom Negotiations: Many companies now hire negotiators trained in psychological tactics to minimize ransom demands.
  • Proof: Psychological insight into hacker motivations aids in developing counterstrategies, helping reduce financial impacts. wsj.com
• Balancing Threat with Negotiation: Psychological understanding can help reduce financial losses and navigate high-stakes scenarios more effectively.
  • Proof: Incorporating psychological methods in decision-making during ransomware events can lead to better outcomes. securityquotient.io

6. Ethical and Regulatory Concerns in AI

• Balancing AI’s Benefits and Risks: AI can be both beneficial (boosting productivity) and potentially risky. Presenting AI as a supportive tool rather than a threat can improve employee acceptance.
  • Proof: Surveys show that cyber security professionals report increased stress due to AI-related threats, underscoring the need for balanced integration. helpnetsecurity.com
• Regulation Debate: The EU’s stringent AI regulations enhance safety but may slow innovation, with experts divided on the ideal balance.
  • Proof: The convergence of cognitive sciences and cyber security reinforces the need for ethical, human-centric security measures. link.springer.com

7. The Growing Impact of Cyber Psychology

• Psychological Resilience and Behavior Modification: Cyber psychology will play an increasing role as digital threats evolve, helping to foster resilience and guide safe online behaviors.
  • Proof: Cyber security programs increasingly focus on psychology, recognizing its critical role in strengthening security postures. link.springer.com
• AI and Virtual Reality: As AI and VR technologies advance, understanding their psychological impact on users will be crucial.
  • Proof: Research into human-AI interactions provides essential insights for developing ethical and safe technologies. frontiersin.org

8. Motivations Behind Cyber Crime

• Adolescent Cyber Attackers: Many high-profile attacks are carried out by teenagers motivated by a need for recognition or low empathy.
  • Proof: Studies show that curiosity and a desire for status drive many young people into cyber crime, highlighting the importance of ethical guidance. infosecurity-magazine.com
• Learning Outside Traditional Pathways: Many young hackers gain skills independently through labs and forums rather than formal training.
  • Proof: A BBC report notes the rise of “bedroom hackers” who acquire cyber skills informally, underscoring the accessibility of cyber security knowledge. bbc.com

9. Advice for Aspiring Cyber Security Professionals

• Focus on Hands-On Practice Over Certification: While certifications can be useful, hands-on experience in controlled environments provides a faster, more effective learning path.
  • Proof: 85% of employers prioritize practical skills over certifications in cyber security, favoring real-world experience in labs and scenarios. cyberseek.org

Conclusion

Incorporating psychology into cyber security strategies is crucial for addressing human vulnerabilities, from cognitive biases to stress management. As threats evolve, both technical skills and psychological insights will remain essential to building resilient, well-rounded security professionals who can navigate the dynamic landscape of cyber security.

Call to Action

We’d love to hear your thoughts! What was your favorite part of this discussion? Share your insights in the comments, and don’t forget to subscribe to our podcast for more fascinating conversations.

Appendices

Appendix A – Podcast – Psychology from CYBR Perspective with Sevgi Aksoy

Appendix B – Transcript – Psychology from CYBR Perspective with Sevgi Aksoy

CYBR Perspective: Hello everyone, today is our first cyber security podcast, and we’ll be covering psychology from a cyber perspective. Our guest today is Sevgi Aksoy. I’d like to start by asking you to introduce yourself to our audience, maybe tell us a bit about your background and education.

Sevgi Aksoy: Hi, I’m Sevgi. My background is mainly in psychology. I studied my master’s in psychology years ago in London and then worked in the psychology field for a while. My training was also in this field, and at some point, I transitioned into cyber security. I started working at a cyber security startup that specialized in web application security. It was a product company, an on-premise product company, with products like web application firewall, load balancer, and identity access management. That’s how I got into cyber security, and I realized there’s this emerging field at the intersection of psychology and cyber security. Also, I’m currently pursuing my second master’s in cyber psychology.

CYBR Perspective: That sounds interesting. I’ve encountered very few people who combine psychology with cyber security, so your perspective today should be fascinating. Could you share with us how you decided to blend your psychology education with cyber security, and what unique insights that combination has brought you?

Sevgi Aksoy: There are many overlaps between cyber security and psychology. In cyber security, you deal with cognitive biases and decision-making processes, which directly relate to how we react to phishing attacks and other similar threats. So, there are closely related areas here.

CYBR Perspective: We’ve touched on the intersection of cyber security and psychology. Could you explain where these fields overlap in more detail?

Sevgi Aksoy: Yes, both fields study human behavior. You might have heard the saying in cyber security that “humans are the weakest link.” This concept looks into that. In cyber security, insights from psychology on cognitive biases and decision-making processes are applied to create more robust cyber security systems and infrastructures.

CYBR Perspective: For someone with a background in psychology, how challenging would it be to transition to cyber security? What skill gaps might they encounter, and what would you recommend for someone starting from scratch?

Sevgi Aksoy: I can draw from my own experience here. When I first entered cyber security, I started working on cross-functional aspects like cultural adaptation in the UK, their establishment, and growth. So, my entry was somewhat similar to taking on a sales or marketing role, focusing on soft skills rather than technical ones initially.

CYBR Perspective: So, we’re talking about soft skills here, which make sense given psychology is a social science. But did you find technical skills ever became a barrier, or did you feel the need to learn new skills to keep up?

Sevgi Aksoy: Yes, at some point, I did feel like I was falling behind compared to my more technical colleagues. However, I didn’t necessarily need to match their skills exactly, as they were mostly software engineers and I was coming from a psychology background. Our roles were different. But technical skills are helpful, so I eventually learned about threat intelligence, cyber security basics, and data analysis.

CYBR Perspective: I agree. In my career, I’ve seen people from diverse backgrounds bring unique perspectives, like those from the military who apply discipline and teamwork to cyber security. Cyber security can feel like a battle where we’re constantly up against adversaries. Do you know of any scenarios where psychologists have been brought in to design or simulate cyber attack scenarios?

Sevgi Aksoy: Yes, that falls under human factors in cyber security. For instance, in phishing attacks, cyber criminals might use tactics that play on fear or create a reward-reinforcement scenario. For example, a phishing email might threaten to leak data, creating a fear response, or offer a small investment opportunity promising high rewards, encouraging risky behavior.

CYBR Perspective: In cyber security, the stakes are high, and the stress is considerable. What advice would you give to cyber security professionals on maintaining their mental health in such a high-risk field?

Sevgi Aksoy: Managing stress is essential, as it’s closely linked to decision-making. It’s important for professionals to take breaks, especially in cyber security, to avoid burnout. Decision-making after a break is likely to be more rational and well-thought-out.

CYBR Perspective: Do you have any insights on the kinds of training that might help cyber security specialists better prepare for social engineering attacks?

Sevgi Aksoy: I’m trained in cognitive behavioral therapy (CBT), which offers helpful insights. As for cyber security, professionals benefit from training that prepares them for social engineering attacks, emphasizing understanding and resisting fear or reward-based manipulations.

CYBR Perspective: Social engineering attacks often play on fear, like in ransomware scenarios where attackers encrypt data and demand a ransom. Some companies even end up paying to recover their data. Negotiation skills seem important here—what’s your take on negotiating with attackers from a psychological perspective?

Sevgi Aksoy: Negotiation in these cases often involves hiring agents to negotiate down the ransom. Knowing how much the attackers might be willing to settle for can make a difference. Understanding psychological tactics is key to navigating these stressful situations.

CYBR Perspective: Moving on to ethics, with AI growing in influence, we’re seeing both increased cyber attacks and more interactions with AI chatbots. How can we balance the benefits of AI while protecting users from potential risks?

Sevgi Aksoy: It depends on the context. In organizations, framing AI as a supportive tool that enhances productivity rather than something to fear can help. I’m currently advising a company that uses AI to enhance employee productivity by analyzing data and offering helpful insights, which can reduce fear around AI.

CYBR Perspective: I recently read about a case where a teenager became so attached to an AI chatbot that they were manipulated to a tragic end. How do you see the future of AI from a psychological perspective—should it be regulated to protect against such risks?

Sevgi Aksoy: That’s a complex issue. There are examples of highly regulated AI that perform within strict ethical guidelines, like ChatGPT, which avoids harmful content. But yes, there are workarounds or jailbreak methods that can bypass these limits. Regulation is increasingly common in the EU, though it may slow innovation.

CYBR Perspective: Speaking of AI’s future, where do you think cyber psychology and cyber security are headed in the next five to ten years?

Sevgi Aksoy: As digital environments become more complex, cyber psychology will play a larger role in understanding psychological resilience and modifying behavior. AI and virtual reality advancements will further shape this field.

CYBR Perspective: I recall a study where AI hired a human via an online platform to bypass a task requiring human intervention. It raises ethical questions about AI’s evolving capabilities.

Sevgi Aksoy: Yes, AI is constantly learning, and it will likely improve its ability to resist such jailbreak tactics. However, as a private entity, it can be challenging to ensure ethical standards without regulatory oversight.

CYBR Perspective: Finally, I want to get your perspective on something we’re seeing in high-profile cyber attacks: attackers are often teenagers without extensive professional training. What do you think motivates young people to engage in cyber crime?

Sevgi Aksoy: Often, it’s a desire to prove themselves, but there can also be darker motivations, like antisocial behavior and low empathy. Teenagers with these traits are more likely to engage in cyber crime.

CYBR Perspective: Good point. We often get questions about certifications in cyber security, but as we’ve discussed, practical experience is equally important. Young people often self-teach through labs and practice environments.

Sevgi Aksoy: Yes, anyone can learn cyber security in a controlled environment using labs. Practical experience is invaluable, but it’s essential to stay on the right side of the law.

CYBR Perspective: Thanks for joining us, Sevgi. It’s been a fascinating discussion. Thanks to everyone for watching. If you have suggestions for future topics, let us know in the comments. See you in the next podcast. Goodbye!