The Risks We Remember: How Availability Bias Creates Blind Spots in Critical Infrastructure Security Decisions

Think about the security risks that come most readily to mind.

A major cyberattack in the news. A security incident your organisation spent months recovering from. A dramatic foreign interference case study presented at a conference.

Now consider a harder question: Are these the most material security risks facing your enterprise or simply the risks that are easiest to remember?

We are surrounded by information.

Threat intelligence. Government security advisories. Incident reports. Near misses. Audit findings. Risk registers. Board papers.

For Boards and executives responsible for critical infrastructure, the challenge is no longer simply obtaining information. It is deciding what is important, reliable and relevant – and what should influence the organisation’s assessment and management of security risk.

That challenge is amplified in the current environment of heightened uncertainty, where Boards and executives are often required to make consequential decisions before the picture is complete.

Our brains help us manage that volume by filtering information. We cannot give equal attention to everything, so we selectively notice some things and keep them in focus while others recede into the background.

Recent events, personal experiences and information that is vivid, emotionally significant or easy to remember tend to move to the front of our minds.

But what is easiest to remember can begin to feel more likely or important than the evidence supports, while unfamiliar or difficult-to-imagine risks can receive too little attention.

Behavioural science has a name for this: the availability heuristic – our tendency to judge how likely or common something is partly by how easily examples come to mind.

For critical infrastructure security, that matters because what captures our attention can influence what enters the risk register, what receives investment, what gets tested – and what remains in our blind spots.

What is the availability heuristic?

Psychologists Amos Tversky and Daniel Kahneman, in their 1974 paper Judgment under Uncertainty: Heuristics and Biases, described availability as one of the mental shortcuts people use when making judgements under uncertainty.

A mental shortcut is not necessarily a flaw. Availability can support reasonable judgement when ease of recall reflects actual frequency. The problem is that ease of recall is influenced by much more than frequency or likelihood.

Think about watching footage of a plane crash on social media. The recommendation algorithm may then show you more crashes, investigations and near misses, while routine flights take off and land safely every day with little attention. Flying can begin to feel more dangerous than it did before. Yet the underlying risk has not necessarily changed. What has changed is the information most readily available in your mind.

The same works in reverse. If we rarely encounter or hear about something, we may give it too little weight.

This can produce two different distortions:

• A risk can be overestimated because it is vivid, recent or easy to recall, making it appear more likely or more significant than the evidence supports.

• A risk can be underestimated because few examples come readily to mind, even though the underlying threat may still be credible and material.

This is the distinction between the availability heuristic and availability bias.

The availability heuristic is the mental shortcut. Availability bias arises when the ease, or difficulty, with which something comes to mind distorts our judgement relative to the evidence.

Put it this way: what is memorable is not necessarily what is material.

Why does this matter for critical infrastructure?

For critical infrastructure, security risk assessment turns information about threats, vulnerabilities and potential impacts into decisions about what is material, what needs to be controlled and where attention and resources should go.

Within a Critical Infrastructure Risk Management Program (CIRMP) required under the Security of Critical Infrastructure Act 2018, responsible entities must identify hazards that could create a material risk to its assets and operations and determine how those risks will be minimised or eliminated so far as reasonably practicable. In practice, that requires consideration across the all-hazards spectrum: cyber and information security, personnel, supply chain, and physical and natural hazards noting these cannot be considered in silos because they are often interconnected.

A sound assessment should draw on current threat and intelligence information, sector reporting, organisational incidents and near misses, changing vulnerabilities and dependencies, and evidence about control performance and assurance.

In an environment of heightened uncertainty, security risk assessments may need to be made with incomplete, uneven or outdated information – and what is familiar, recent or readily available can begin to fill the gaps.

In a 2024 review of a critical infrastructure risk assessment, Papamichael, Dimopoulos and Boustras identified the availability heuristic as a factor that can influence how practitioners judge the likelihood of events and, in turn, how risks are assessed.

A 2024 Norwegian maritime cybersecurity study of 293 offshore deck officers provides an applied example: experience of cyberattack, cybersecurity training and awareness of attacks affecting others were significant predictors of perceived OT cyber risk, which the authors suggest may partly reflect availability heuristic.

That is where availability becomes a security issue.

A formal risk management framework does not remove human judgement. It structures the process within which that judgement is exercised.

When events change what we see

Consider 9/11.

Terrorist attacks against aviation were not entirely unknown beforehand, but the attacks made the scale, plausibility and consequences impossible to ignore. That was not irrational: they provided powerful new evidence and exposed vulnerabilities.

They also show how a vivid event can change what seems possible, moving a threat from the edge of attention to its centre.

Cybersecurity provides a more contemporary example.

A major ransomware attack against critical infrastructure dominates the news. The obvious Board question is whether it could happen to us. It should be asked.

The problem begins when prominence substitutes for analysis of the organisation’s own exposure. Does it have the same vulnerabilities, threat pathways or dependencies? Has the underlying risk changed, or has one risk simply become easier to imagine?

Meanwhile, less visible risks – such as a disgruntled employee, a contractor with excessive access or a trusted worker whose behaviour has changed – may receive less scrutiny.

The power – and danger – of the case study

Tell a Board that a particular risk exists and it may become one item among many.

Tell the story of an organisation where that risk materialised – what happened, what was missed and what it cost – and people remember it.

That can expose a blind spot. But a compelling case study can also become too available, shaping how we think about risk even when another organisation’s circumstances are materially different.

The test is whether the circumstances that made it possible exist here and whether the evidence supports treating the risk as material.

So how do we reduce the blind spots?

Knowing that availability bias exists is useful. However, awareness alone is not enough.

The stronger safeguard is to build discipline into the security risk management process so that memory, familiarity and the latest headline do not do all the work.

1.      Broaden what enters the security risk assessment

Organisational experience matters, but it is only one source of evidence.

“No incidents here” may mean low exposure. However, it may also reflect limited detection, underreporting, effective controls, good fortune or simply that the event has not happened yet.

A sound threat picture should test internal experience against government threat information, sector intelligence, incidents and near misses elsewhere, changing vulnerabilities, supplier and dependency information, and evidence about whether controls are actually working.

An all hazards assessment should not rely on what people can readily bring to mind. It should deliberately test for credible threats that may be absent because they have not occurred within the organisation, are poorly reported or are unfamiliar to those conducting the assessment.

The purpose is not to populate the risk register with every imaginable scenario. It is to ensure familiarity does not determine, by default, what gets considered.

2.      Make the basis of judgement visible

For a material security risk, the rating should be supported by a clear view of the evidence, the assumptions being made, the information gaps and the level of confidence in the assessment.

This matters particularly after a highly visible incident, when attention can shift quickly. Has the threat, vulnerability or exposure changed, or has the incident simply made the risk more visible?

Five reports about the same widely publicised event are not necessarily five independent pieces of evidence. More information does not automatically produce a better assessment if its quality, relevance and independence are not tested.

For significant security risks, someone should test the assumptions, consider a credible alternative and ask whether recency, media attention or organisational history is carrying too much weight.

A multidisciplinary team does not automatically remove bias; the challenge still needs to be structured.

3.      Give Boards the reasoning, not just the rating

A heat map shows the conclusion.

It does not show the quality of the thinking that produced it.

For significant security risks, Boards should be able to see the principal evidence, material information gaps, key assumptions, uncertainty, reasons for changes in the assessment and evidence that the controls relied upon are actually operating and effective.

One question may be particularly useful: What has changed because the threat, vulnerability or exposure changed, and what changed because our attention did?

Seeing beyond what is easy to see

Security risk assessment sits at the heart of a CIRMP. Its outcomes shape what is treated as material, what is controlled, risks that are accepted, where attention and resources are directed – and what may remain overlooked.

The availability heuristic can influence how likelihood is judged and, in turn, how security risks are assessed and prioritised. It can also create blind spots, where credible threats receive too little attention because they are unfamiliar, less visible or harder to imagine.

In an environment of heightened uncertainty, a better understanding of the availability heuristic, and the biases to which it can lead, can help improve judgement and decision making.

However, awareness alone is not enough. A mature CIRMP should bring evidence, structure and challenge to the assessment process, helping expose material risks that familiarity and memory might otherwise leave outside the spotlight.