Before you commit: The art and science of cyber decision‑making

Security culture rewards speed and decisiveness, but many of the most consequential failures stem not from acting too slowly, but from assuming visibility that was never confirmed. Analysts are trained to process what is present in data and tools: indicators, signatures, observable behaviours. Yet the most damaging analytical gaps occur not from misreading what is there, but rather blind trust and failing to recognise what is absent. What happens when you move too fast, jump to conclusions or see patterns everywhere but miss what is obvious? The question is not whether we can respond fast enough, but whether we know what we are responding to.

This fully analog, hands-on workshop focuses on the skills and capabilities required to counter these gaps. No laptops, no slides, no devices. Using physical media, charcoal, ink, and collage, and intentionally zero artistic capability required. 

Drawing on art pedagogy, intelligence tradecraft, criminology, psychology, and critical thinking methodology, this is an experiential approach on the foundational cognitive skills that underpin not just security analysis, but decision-making at every level: from the SOC floor to the boardroom. This is not a revolutionary new framework, these are foundational cognitive capabilities that can’t be taught in a lecture: structured observation, bias recognition, evidence-based reasoning under uncertainty, and disciplined communication of assessment.

Participants work through four progressive exercises, each targeting a distinct analytical skill ordered by complexity: recognising how context and assumptions shape conclusions from identical data; identifying what is missing rather than what is present; managing competing hypotheses under genuine ambiguity; and integrating all three skills in a collaborative assessment where no-one holds the complete picture.

No artistic ability is required. The exercises work precisely because participants are operating outside their domain of expertise, exposing default thinking patterns that remain invisible within familiar workflows. Participants leave with repeatable structured and practical techniques in operational, strategic, and leadership contexts applicable to any role, and transferable to strategic decision-making, risk communication, and board-level engagement.

• How to recognise how cognitive bias, contextual assumptions, and information sources shape analytical conclusions.
• Experience with negative space analysis: identifying risks, gaps, and threats defined by what is absent rather than what is present.
• Practical familiarity with Analysis of Competing Hypotheses (ACH) as a technique for managing ambiguity, resisting premature commitment, and producing defensible assessments under uncertainty.
• An intuitive understanding of the intelligence lifecycle.
• The cognitive discipline of productive scepticism by evaluating source reliability and maintaining analytical rigour without paralysing decision-making.

Critically, a concrete understanding that foundational human cognitive skills are the capabilities most resistant to AI displacement, and that investing in these skills is investing in the workforce capabilities that will remain relevant regardless of how technology evolves.