Rethinking Security Metrics Through the Lens of Cognitive Load

When we talk about measuring security culture, we describe the positive impacts that people have on the security posture of the company. As security leaders, we’re asked to demonstrate that our initiatives like training, Security Champion programs, and SDL have clear benefits. But are we considering the cognitive cost of our programs? Every dashboard goal, every “shift left” security integration, and every expectation placed on engineering teams adds to their mental workload, and that load, when unmanaged, silently derails even the most well-intentioned efforts.

This talk presents practical examples for designing security culture metrics that are both impactful and human-aware. At the core is a behavioral science principle often overlooked in security design: cognitive load theory—and how this tool can be used to craft realistic metrics that take the human element into account.