Bias and noise in security risk assessments, an empirical study on the information position and confidence of security professionals

Journal article (2023)

Authors

J.J. de Wit Safety and Security Science - TPM
Wolter Pieters Radboud Universiteit Nijmegen
P.H.A.J.M. van Gelder Safety and Security Science - TPM
Research Group
Safety and Security Science (TPM) (TU Delft)
Copyright: © 2023 J.J. de Wit, Wolter Pieters, P.H.A.J.M. van Gelder
DOI
help_outline
https://doi.org/10.1057/s41284-023-00373-6
Noise Decision biases Confidence Conjunction fallacy Information position Security assessment
More Info
expand_more

Published Date

2023

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Technology, Policy and Management

Department

Values Technology and Innovation

Research Group

Safety and Security Science

Abstract

Professionals working in both the physical and cybersecurity domain need to assess and evaluate security risks. As information on risks in general and security risks in particular is often imperfect and intractable, these professionals are facing a challenge in judging both likelihood and consequences, but how much do their existing psychological biases play a role in these judgments? In this paper, we present new empirical evidence on the perception of the information position and confidence levels of security professionals, the influence of detailed information and the conjunction fallacy, and the level of noise in security assessments. This paper adds to the literature by examining, for the first time, risk assessments by professionals in realistic, real life, security cases. The results show clear indications for overconfidence, comparative ignorance, influence of the conjunction fallacy, and influence of individual experience on security decision making in the professional security domain. The observed phenomena might have far reaching effects on security risk management in organizations and society.