Cognitive Security and Social Engineering: A Systems-Based Approach

Matthew Canham and Ben Sawyer open by proposing a working definition of cognitive security, treating it as the protection of cognitive systems, which can be people, groups or automated decision-makers. They illustrate the idea with a thought experiment in which a discount campaign nudges many people to use power at the same time, pushing up peak demand on a grid. The point they stress is that influence over human behavior can produce physical effects, and that defenders watching for conventional indicators may never see the cause.

The middle of the talk lays out a model. They describe an induced covert effect, where an action in one domain travels through another and hides its origin from the target. They map human layers onto an extended OSI stack, with layer eight as social engineering, layer nine as organizational rules and layer ten as governmental policy. Tactical, operational and strategic levels describe how single engagements combine into campaigns and nation-state efforts. Sawyer then turns to AI, covering digital twins that act on a person's behalf, along with data poisoning, feedback manipulation and prompt-level tampering as new attack surfaces.

The closing takeaway is that organizations adopting language models inherit a shared vulnerability that is hard to see and can scale across many customers. In the question period, the speakers agreed that anthropology and other social sciences could help define the field. Listeners are pointed toward the cognitive security community for further discussion.