Cybersecurity Coherence Reduces Cognitive Risk

This weekend I painted a plywood floor with bad paint.

Not mediocre paint. Bad paint.

The can had been sitting long enough that the contents had gone partly hard. The texture was closer to terracotta porridge than anything a paint manufacturer would want featured in an advertisement. I added water. I stirred. I added more water. I stirred again. Eventually enough of it became spreadable that I could persuade it onto the floor.

The floor itself was not exactly waiting for Architectural Digest.

It had once been covered with linoleum tiles. Dirt and dust had worked their way into the seams. The plywood showed old adhesive, wear, patches, scratches and the accumulated history of a space that had been used rather than curated.

The paint did not make any of that disappear.

It did something more interesting.

It made the floor read as one thing.

Before, my eye encountered dozens of little boundaries: tile ghosts, dark seams, raw wood, old glue, worn patches, places that looked dirty even when they were not, places that looked unfinished because they were unfinished. None of those details was individually important. Together they created a continuous low-grade message:

something here is unresolved.

After one ugly coat of terracotta, most of those signals collapsed into a single category.

Floor.

Understood.

The surface was still imperfect. In places it was visibly rough. The paint was not evenly beautiful. There were still corners to finish and furniture to move.

But the room became noticeably calmer.

That made me think about cybersecurity.

Because of course it did.

Every unresolved signal has a cost

Security work is full of tiny unresolved things.

A dashboard shows one version number and the asset inventory shows another.
A policy says one team owns a service, while the ticket queue routes incidents to someone else.
A repository README says a system is current while the actual production environment moved six months ago.
A privileged account exists because somebody once needed it and nobody is sure whether that need still exists.
A firewall rule has a comment from 2019 that says TEMP.
An alert is noisy enough that everybody ignores it, but not noisy enough that anyone feels comfortable disabling it.
A runbook contains five pages of instructions, two of which everyone knows are wrong, although nobody has yet removed them because they might still matter to somebody.

The organization keeps functioning.

Humans compensate.

That compensation is usually invisible because people are extraordinarily good at it. Experienced operators learn which dashboard to trust, which field is stale, which warning means nothing, which exception is real, which person actually owns the system, which process is written down, and which process really happens.

We call that "experience."

Some of it is experience.

Some of it is unpaid cognitive middleware.

The human brain is reconciling contradictions the system should have resolved itself.

That has a security cost.

Cognitive load is part of the attack surface

We tend to describe attack surfaces in technical terms: exposed services, identities, APIs, ports, dependencies, credentials, endpoints.

There is another attack surface that receives less architectural attention:

the amount of ambiguity a human operator must absorb before making a correct decision.

When everything is quiet, good people can compensate for enormous amounts of incoherence.

During an incident, that margin collapses.

Now the analyst is tired. The pager woke someone at 3:17 a.m. Three teams are talking at once. An attacker may still be active. The logs disagree. The current owner is on vacation. A cloud console shows one state, the SIEM shows another, and the incident commander has a spreadsheet that was copied from a spreadsheet that was correct last quarter.

At that moment, every unresolved signal becomes expensive.

Is this account expected?
Is this route supposed to exist?
Is this server still production?
Is this repository authoritative?
Does this person have permission to approve the change?
Did the agent recommend the action or actually execute it?
Was the control disabled deliberately or did it fail?

The problem is not simply that information is missing.

Often there is too much information, and the relationships among the pieces are unclear.

The operator must first construct a coherent model of reality before responding to the threat.

Attackers benefit from the delay.

Security debt often looks like visual clutter

A worn plywood floor is harmless. It can still teach something about how humans perceive systems.

Before painting, the floor contained many visible distinctions. Some were meaningful. Most were not.

The same thing happens in security environments.

A mature organization may have hundreds of distinctions that once carried meaning:

an old network segment created during an acquisition;
three identity groups that differ only because of historical naming;
separate repositories for systems that became one system years ago;
overlapping monitoring tools introduced by different teams;
policy documents that describe superseded operating models;
duplicate asset inventories whose disagreements are treated as normal;
temporary exceptions that became infrastructure.

The distinctions remain visible, so people keep spending attention on them.

This is one reason technical debt becomes cognitive debt.

The system is not merely harder to maintain. It is harder to understand correctly.

And understanding is a prerequisite for secure action.

Coherence is not neatness

There is a dangerous interpretation of this argument, so let me rule it out.

Coherence does not mean making everything uniform.

It does not mean centralizing every system, eliminating every exception, forcing every team onto one platform, or sanding away every local difference until the enterprise is aesthetically pleasing.

That would confuse tidiness with architecture.

A healthy forest is coherent and wildly non-uniform. A city is coherent while containing different buildings, neighborhoods, roads, people, and purposes. A resilient distributed system can contain many independent nodes and still have clear identity, routing, authority, and provenance.

Coherence means that the differences make sense.

The boundaries correspond to something real. The labels correspond to the things they describe. The authority model corresponds to who is actually allowed to decide. The repository marked current is actually current, or clearly says what superseded it. A route exists because traffic needs to flow there, not because nobody remembers why it was created.

The system can be complex without being contradictory.

That is the distinction.

The brain wants compression

One of the useful things human perception does is compression. We do not consciously process every board in a floor, every leaf on a tree or every brick in a wall. We identify stable patterns and treat them as objects.

Floor.
Tree.
Wall.

That saves attention for the things that change.

Operational systems should help us do the same thing.

If a security analyst must examine forty artifacts to determine which one is authoritative, the system has failed to compress its own state. If an executive needs three meetings to determine who can approve a deployment, the authority model has failed to compress itself.

If an AI agent receives six conflicting sources and is expected to infer which one reflects current reality, the organization has outsourced incoherence to probabilistic software.

That last case is becoming especially important.

AI makes incoherence more dangerous

People often imagine AI as a way to reduce complexity.

Sometimes it is.

But an AI system connected to contradictory institutional information can also become an extremely fast ambiguity amplifier. Suppose an agent can read your policy repository, ticket history, source code, asset inventory and internal documentation.

Wonderful.

Now suppose those sources disagree.

Which one is authoritative?
Which one is historical?
Which one contains a proposal rather than a decision?
Which runtime state supersedes repository metadata?
Which person has authority to approve action?
Which message was informational and which was an instruction?

A capable model can often guess.

That is precisely the problem.

The better it becomes at producing plausible interpretations, the easier it is for organizations to avoid repairing the underlying ambiguity.

We begin treating inference as governance.

That is not a sustainable security model.

The agent should not need to hallucinate institutional coherence on our behalf.

We should provide enough structure that it can distinguish observed fact from summary, current state from historical evidence, access from authority, recommendation from approval and delivery from permission to act.

In other words, the system should tell the agent which parts of the floor are actually different materials and which are merely old stains.

Coherence is a security control

We already know how to do much of this work.

The techniques are not exotic.

Give important systems clear owners.
Make authoritative sources identifiable.
Record supersession instead of leaving old documents looking current.
Separate observed runtime facts from repository descriptions.
Remove privileges whose purpose no longer exists.
Record why exceptions exist and revisit them.
Keep recommendation, approval, and execution distinct.
Preserve provenance so that people can see how a state came to exist.
Retire alerts that nobody will act on.
Make the real operating path match the documented operating path closely enough that new people do not require oral tradition to function.

None of these practices guarantees security.

They do something more foundational.

They reduce the amount of ambiguity an attacker can hide inside and the amount of reconciliation a defender must perform before acting.

That is real defensive value.

Do not polish what needs to be understood

The paint on my office floor is not perfect.

That is part of why I like the example.

The objective was never perfection.

If I had tried to produce a flawless finish, I would have needed to strip the entire floor, sand everything smooth, repair every defect, fill seams, prime properly, buy new paint and probably move every object out of the room for several days.

Maybe someday.

But that was not the useful intervention this weekend.

The useful intervention was to eliminate a large class of meaningless visual disagreement. The floor did not need to become perfect. It needed to become coherent enough that my brain could stop treating every square foot as a separate unresolved task.

Security programs could use more of that instinct.

Not every legacy system needs immediate replacement.
Not every inconsistency deserves a transformation program.
Not every rough edge is a vulnerability.

But when dozens of rough edges continually force humans to ask the same questions, reconcile the same contradictions, and remember the same undocumented exceptions, the accumulated cognitive load becomes operational risk.

Sometimes the right security project is not another control.

It is making the existing environment legible.

Finish the edges

I still have another round of painting to do.

The futon has to move. The card table has to move. I need to get under the desk and into the corners of the back room.

That is also where the remaining visual noise is concentrated.

Once the large field became coherent, the exceptions became easier to see.

That is another useful property of coherent systems.

An anomaly is more visible against a stable background.
A strange login is easier to notice when identity behavior is normally predictable.
A bad route is easier to recognize when network relationships are intentional.
An unauthorized change is easier to investigate when normal changes preserve provenance.
A contradictory policy stands out when old policies are clearly marked as superseded.

Coherence does not eliminate anomalies.

It gives anomalies contrast.

And contrast is one of the things defenders need most.

I am not suggesting that floor paint is therapy, or that cybersecurity can be solved with interior decorating. I am suggesting that humans live inside environments, physical and digital, and those environments constantly ask us to interpret them.

Some environments answer most of our questions before we have to ask.

Others make us solve the same puzzle every day.

The difference is not always sophistication. Sometimes it is simply coherence.