Cybersecurity and Cognitive Security

When a spoofed email diverts a wire payment or opens the door to a breach, the case turns on human questions: which red flags a person in that seat could detect, what training and verification could have changed, and why one fraudulent message among hundreds got through. Dr. Sawyer’s experiment with Peter Hancock showed that phishing attacks succeed more often the rarer they are, research that won the Human Factors and Ergonomics Society’s Human Factors Prize.

The cases include business email compromise and wire-fraud losses disputed among companies, vendors, and banks, real estate closing fraud, data breach class actions that allege a failure to train, and security teams that missed the one real alert among many false alarms. Voice cloning and other AI tools now appear in fraudulent payment requests, which raises the same human questions in a new form.

His security research began as a Repperger Fellow and contractor with the Air Force’s 711th Human Performance Wing, studying cyber defenders. He has published on vigilance in cyber defense, the human factors of network defense, and the effects of training on detecting malicious email; studied, with NIST funding, what separates repeat phishing clickers from people who guard against attacks; and received an Air Force Office of Scientific Research Young Investigator award on trust in cybersecurity. He has twice been selected to present in the Briefings at Black Hat USA on how AI is used to manipulate people, and he chairs the Board of Directors of the Cognitive Security Institute, a nonprofit. The methods are simulated workplace email studies and vigilance testing.