Connectedness influences operator load and oversight in cyber defense
Connectedness, Cognitive Load, and Human-AI Oversight in Cyber Operations
Human-Computer Interaction
Summary
Cybersecurity systems help humans spot threats by showing step-by-step reasons for alerts. But there are too many alerts coming in too fast for someone to check them all. The authors suggest using clues from the environment and communication links to guess how busy or stressed the human operator is. This helps decide when humans should review alerts, not just based on risk but also on the operator’s current ability to handle work. This method was designed for submarines but could apply wherever conditions affect human attention and connectedness.
What this means in practice
- •For submarine cyber defense teams: Use environmental and connectivity data to balance threat review workload with operator ability on underwater platforms.
- •For network security operators: Incorporate network and environmental factors to dynamically adjust human oversight of AI alerts based on operator cognitive load.
Authors
Nathan Conklin, Peng Gao, Chris North
Abstract
AI-assisted cyber situational awareness triggers machine-generated reasoning traces (step-by-step justifications for anomaly classifications) that a human operator is expected to review. Because cyber signals and their traces arrive faster than any operator can process, human review is the limiting constraint on oversight. The standard approach is to identify the riskiest cyber events for review using model-side signals such as confidence or uncertainty. That framing ignores the operator's cognitive capacity which varies sharply with the operational environment. We propose an alternative where the system's environmental and connectivity telemetry serves as an available, non-invasive proxy for operator load. That same telemetry determines whether the human-AI partnership can reach the broader collective for support. In a maritime platform, environmental and connectivity attributes including depth, number of active communications paths, density of the tracked contact picture, and operational tempo all carry this signal. Need for operator oversight becomes a decision that materializes as a combination of both risk and environment-derived operator capacity. We present a reference architecture for a connectedness-aware oversight engine, demonstrating everyday use cases alongside its intended incorporation into the submarine cyber-defense toolkit. Two themes emerge: 1) the operator's environmental state is itself a connectedness measurement, and 2) connectedness drives the cognitive load and defines a collective boundary in human-AI cyber operations.