{"id":517418,"date":"2024-05-03T17:41:48","date_gmt":"2024-05-03T21:41:48","guid":{"rendered":"https:\/\/www.commvault.com\/?p=517418"},"modified":"2024-05-07T10:21:03","modified_gmt":"2024-05-07T14:21:03","slug":"understanding-action-bias-in-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity","title":{"rendered":"Understanding Action Bias in Cybersecurity\u00a0"},"content":{"rendered":"\n<p class=\"\">That insight struck a chord when I read the book earlier this year, and it\u2019s why I was excited when we booked Josiah Dykstra, Ph.D., the Director of Strategic Initiatives at\u00a0<a href=\"https:\/\/www.trailofbits.com\/\">Trail of Bits<\/a>, for\u00a0<a href=\"https:\/\/www.youtube.com\/playlist?list=PLVNsboCVPVWUhDuj6NRJa8dBCRKmC2UoH\">The Resilience Rundown podcast<\/a>\u00a0to discuss action bias and its impact on decision-making in cybersecurity incidents.\u00a0<\/p>\n\n\n\n<figure class=\"wp-block-embed aligncenter is-type-video is-provider-vidyard wp-block-embed-vidyard\"><div class=\"wp-block-embed__wrapper\">\n<script type=\"text\/javascript\" async src=\"https:\/\/play.vidyard.com\/embed\/v4.js\"><\/script><img decoding=\"async\"  style=\"width: 100%; margin: auto; display: block;\"  class=\"vidyard-player-embed\"  src=\"https:\/\/play.vidyard.com\/pHRRxCu5Ja6a6YcX746ipS.jpg\"  data-uuid=\"pHRRxCu5Ja6a6YcX746ipS\"  data-v=\"4\"  data-type=\"inline\"  data-width=\"500\"  data-height=\"281\"\/>\n<\/div><\/figure>\n\n\n\n<p class=\"has-text-align-center\"><strong>Subscribe:<\/strong>&nbsp;<a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/the-resilience-rundown\/id1730107130\">Apple Podcasts<\/a>&nbsp;|&nbsp;<a href=\"https:\/\/open.spotify.com\/show\/0fmWz1rrfSevoKH8xov0P5\">Spotify<\/a>&nbsp;|&nbsp;<a href=\"https:\/\/www.youtube.com\/playlist?list=PLVNsboCVPVWUhDuj6NRJa8dBCRKmC2UoH\">YouTube<\/a><\/p>\n\n\n\n<p class=\"\"><strong>Understanding Action Bias<\/strong><\/p>\n\n\n\n<p class=\"\">Action bias refers to the natural human inclination to take immediate action when faced with a threat or crisis. While this instinct can be helpful in certain situations, it also can lead to irrational decision-making and potentially worsen the problem at hand. In the context of cybersecurity, action bias can manifest in various ways, such as falling for phishing attacks that exploit the urgency to act or making hasty decisions during incident response.<\/p>\n\n\n\n<p class=\"\"><strong>Examples of Action Bias in Cybersecurity<\/strong><\/p>\n\n\n\n<p class=\"\">One common example of action bias in cybersecurity is phishing incidents. Attackers often leverage urgency and fear to manipulate individuals into taking immediate action, such as clicking on malicious links or sharing sensitive information. Even cybersecurity professionals can fall victim to action bias, making impulsive decisions during a breach or incident response that may have unintended consequences.<\/p>\n\n\n\n<p class=\"\"><strong>When \u2018Doing Nothing\u2019 is a Good Thing<\/strong><\/p>\n\n\n\n<p class=\"\">Dykstra discusses the concept of \u201cdoing nothing\u201d as a strategic choice in certain cybersecurity situations. He uses the example of professional soccer goalkeepers in penalty shots to illustrate this point. Research has shown that goalkeepers who choose not to jump or make a move during a penalty shot have a higher chance of blocking the shot. This strategic decision may appear counterintuitive to spectators who expect the goalkeeper to take action, but it is based on careful analysis and preparation.<\/p>\n\n\n\n<p class=\"\"><strong>Mitigating the Negative Effects of Action Bias<\/strong><\/p>\n\n\n\n<p class=\"\">To mitigate the negative effects of action bias in cybersecurity, organizations can adopt several strategies:<\/p>\n\n\n\n<p class=\"\">1. Preparation and rehearsal: Developing a comprehensive incident response plan and regularly rehearsing it can help teams respond effectively during a crisis. This preparation allows for strategic decision-making rather than impulsive reactions.<\/p>\n\n\n\n<p class=\"\">2. Patience and education: Recognizing that patience is a virtue in cybersecurity incidents is crucial. Educating stakeholders, including board members, shareholders, and executives, about the importance of strategic decision-making and the potential risks of hasty actions can help create a culture that values patience.<\/p>\n\n\n\n<p class=\"\">3. Slowing down: Slowing down does not mean delaying response time. Instead, it emphasizes the importance of conducting thorough preparation before an incident occurs. By investing time and effort into planning and training, organizations can ensure that their teams are equipped to make thoughtful decisions in real time.<\/p>\n\n\n\n<p class=\"\"><strong>Conclusion<\/strong><\/p>\n\n\n\n<p class=\"\">Action bias is a common cognitive bias that affects decision-making in cybersecurity incidents. By understanding the potential pitfalls of impulsive actions and implementing strategies to mitigate action bias, organizations can improve their incident response capabilities and minimize the risk of exacerbating cybersecurity threats. To learn more about action bias and its impact on cybersecurity, listen to the&nbsp;full episode of the Resilience Rundown podcast featuring Josiah Dykstra.&nbsp;<\/p>\n\n\n\n<p class=\"\">I highly recommend following&nbsp;<a href=\"https:\/\/www.linkedin.com\/in\/josiah-dykstra\/\">Josiah on LinkedIn<\/a>&nbsp;and consider reading his book,&nbsp;<a href=\"https:\/\/www.amazon.com\/Cybersecurity-Myths-Misconceptions-Avoiding-Pitfalls\/dp\/0137929234\">\u201cCybersecurity Myths and Misconceptions,\u201d<\/a>&nbsp;which delves into various biases and issues in the cybersecurity field.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the book,\u00a0\u201cThe Power of Moments,\u201d\u00a0the authors describe practicing as a way of preparing for possibly negative or confrontational moments, so people don\u2019t react poorly. Why? \u201cPractice quiets the anxiety that can cloud our mind in a tough moment. When we lack practice, our good intentions often falter,\u201d write Chip Heath and Dan Heath.<\/p>\n","protected":false},"author":154,"featured_media":517526,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_custom_css":"","_custom_js_footer":"","_page_background_color":"","_remove_from_search":false,"_dark_mode":false,"_light_footer_mode":false,"_sidebar_form":{"id":"","name":"","cta":"","redirect":""},"_alert_notification_bar":{"show":true,"bg_color":"","content":"","call_to_action_label":"","call_to_action_link":""},"_footer_cta":{"show":false,"title":"","subtitle":"","cta_text":"","cta_link":"","background":{"id":0,"url":""}},"_cmv_customer_logo":{"id":0,"url":""},"_jetpack_memberships_contains_paid_content":false,"i18n_hreflangs":"","footnotes":""},"categories":[975],"tags":[],"cmv_author":[1460],"class_list":{"0":"post-517418","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cybersecurity","8":"cmv_author-jason-meserve","9":"entry"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v23.0 (Yoast SEO v23.0) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Understanding Action Bias in Cybersecurity\u00a0<\/title>\n<meta name=\"description\" content=\"Action bias refers to the natural human inclination to take immediate action when faced with a threat or crisis. While this instinct can be helpful in certain situations, it also can lead to irrational decision-making and potentially worsen the problem at hand. In the context of cybersecurity, action bias can manifest in various ways, such as falling for phishing attacks that exploit the urgency to act or making hasty decisions during incident response.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Understanding Action Bias in Cybersecurity\u00a0\" \/>\n<meta property=\"og:description\" content=\"Action bias refers to the natural human inclination to take immediate action when faced with a threat or crisis. While this instinct can be helpful in certain situations, it also can lead to irrational decision-making and potentially worsen the problem at hand. In the context of cybersecurity, action bias can manifest in various ways, such as falling for phishing attacks that exploit the urgency to act or making hasty decisions during incident response.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity\" \/>\n<meta property=\"og:site_name\" content=\"Commvault - English - United States\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Commvault\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-05-03T21:41:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-05-07T14:21:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/05\/Action-Bias-Blog-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"klisun\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@commvault\" \/>\n<meta name=\"twitter:site\" content=\"@commvault\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"klisun\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Understanding Action Bias in Cybersecurity\u00a0","description":"Action bias refers to the natural human inclination to take immediate action when faced with a threat or crisis. While this instinct can be helpful in certain situations, it also can lead to irrational decision-making and potentially worsen the problem at hand. In the context of cybersecurity, action bias can manifest in various ways, such as falling for phishing attacks that exploit the urgency to act or making hasty decisions during incident response.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity","og_locale":"en_US","og_type":"article","og_title":"Understanding Action Bias in Cybersecurity\u00a0","og_description":"Action bias refers to the natural human inclination to take immediate action when faced with a threat or crisis. While this instinct can be helpful in certain situations, it also can lead to irrational decision-making and potentially worsen the problem at hand. In the context of cybersecurity, action bias can manifest in various ways, such as falling for phishing attacks that exploit the urgency to act or making hasty decisions during incident response.","og_url":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity","og_site_name":"Commvault - English - United States","article_publisher":"https:\/\/www.facebook.com\/Commvault\/","article_published_time":"2024-05-03T21:41:48+00:00","article_modified_time":"2024-05-07T14:21:03+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/05\/Action-Bias-Blog-1.png","type":"image\/png"}],"author":"klisun","twitter_card":"summary_large_image","twitter_creator":"@commvault","twitter_site":"@commvault","twitter_misc":{"Written by":"klisun","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity#article","isPartOf":{"@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity"},"author":{"name":"klisun","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/person\/7f6a20977c25a69a33bf93fa6949dca4"},"headline":"Understanding Action Bias in Cybersecurity\u00a0","datePublished":"2024-05-03T21:41:48+00:00","dateModified":"2024-05-07T14:21:03+00:00","mainEntityOfPage":{"@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity"},"wordCount":547,"publisher":{"@id":"https:\/\/commvault-new.go-vip.net\/#organization"},"image":{"@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity#primaryimage"},"thumbnailUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/05\/Action-Bias-Blog-1.png","articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity","url":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity","name":"Understanding Action Bias in Cybersecurity\u00a0","isPartOf":{"@id":"https:\/\/commvault-new.go-vip.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity#primaryimage"},"image":{"@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity#primaryimage"},"thumbnailUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/05\/Action-Bias-Blog-1.png","datePublished":"2024-05-03T21:41:48+00:00","dateModified":"2024-05-07T14:21:03+00:00","description":"Action bias refers to the natural human inclination to take immediate action when faced with a threat or crisis. While this instinct can be helpful in certain situations, it also can lead to irrational decision-making and potentially worsen the problem at hand. In the context of cybersecurity, action bias can manifest in various ways, such as falling for phishing attacks that exploit the urgency to act or making hasty decisions during incident response.","breadcrumb":{"@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity#primaryimage","url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/05\/Action-Bias-Blog-1.png","contentUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/05\/Action-Bias-Blog-1.png","width":1200,"height":628},{"@type":"BreadcrumbList","@id":"https:\/\/www.commvault.com\/blogs\/understanding-action-bias-in-cybersecurity#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.commvault.com\/"},{"@type":"ListItem","position":2,"name":"Understanding Action Bias in Cybersecurity\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/commvault-new.go-vip.net\/#website","url":"https:\/\/commvault-new.go-vip.net\/","name":"Commvault - English - United States","description":"","publisher":{"@id":"https:\/\/commvault-new.go-vip.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/commvault-new.go-vip.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/commvault-new.go-vip.net\/#organization","name":"Commvault","url":"https:\/\/commvault-new.go-vip.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/logo\/image\/","url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/03\/logo-commvault-horizontal.jpg?quality=80","contentUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/03\/logo-commvault-horizontal.jpg?quality=80","width":1200,"height":628,"caption":"Commvault"},"image":{"@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Commvault\/","https:\/\/x.com\/commvault","https:\/\/www.instagram.com\/commvault\/","https:\/\/www.linkedin.com\/company\/commvault","https:\/\/www.youtube.com\/user\/commvault","https:\/\/en.wikipedia.org\/wiki\/Commvault"]},{"@type":"Person","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/person\/7f6a20977c25a69a33bf93fa6949dca4","name":"klisun","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/fa72aa9788dcb3849ca2590b99e9ee5e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fa72aa9788dcb3849ca2590b99e9ee5e?s=96&d=mm&r=g","caption":"klisun"}}]}},"jetpack_featured_media_url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/05\/Action-Bias-Blog-1.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts\/517418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/users\/154"}],"replies":[{"embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/comments?post=517418"}],"version-history":[{"count":5,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts\/517418\/revisions"}],"predecessor-version":[{"id":517424,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts\/517418\/revisions\/517424"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/media\/517526"}],"wp:attachment":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/media?parent=517418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/categories?post=517418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/tags?post=517418"},{"taxonomy":"cmv_author","embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/cmv_author?post=517418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}