Cognitive Digital Twin: Defender Simulation for Incident Response Optimization

J. McKenney

This is a standalone treatise in the Digital Twin working group, describing Layer 5 of the eight-layer Cyber Digital Twin architecture that the group's other treatises assume; it names no numbered series and no sibling beyond that shared architecture.

Licence: CC BY 4.0. 17 September 2026.

Executive Abstract#

Digital twins in industrial and data center environments model thermodynamics, fluid hydraulics, power, and network flows. During acute cyber-physical crises the point of failure is almost always the human decision-maker. Control room operators and SOC defenders face cognitive saturation that produces misdiagnosis, alert abandonment, and fatal decision latency.

This treatise formalizes the Cognitive Dimension of the Cyber Digital Twin (CDT). The Cyber Digital Twin is a multi-layer model spanning eight architectural staves: silicon, physical processes, software, threats, humans, telemetry, actuarial loss, and forecast. The cognitive dimension is not a standalone twin but Layer 5 (Human and Psychometric Dynamics), coupled into the physical, digital, and financial layers.

Grounded in Cognitive Load Theory, the Yerkes-Dodson arousal law, Klein's Recognition-Primed Decision model, OCEAN and DISC psychometric vectors, and Lacanian registers (Real, Symbolic, Imaginary), the model simulates stochastic incident trajectories to reveal where decision latency intersects physical limits: the 15-second thermal trip cliff in liquid-cooled facilities and the 4-second Joukowsky slugging shock in cryogenic compression.

Coupled through DEXPI 2.0 schematics (ISO 15926-4) and CycloneDX 1.6+ multi-BOM specifications, Layer 5 justifies hardwired SIL-3 interlocks that act before human cognitive collapse destroys equipment, establishing actuarial loss bounds under Lloyd's Market Bulletin Y5381.

Abstract#

A digital twin usually models the physical and digital layers of a facility: thermal loads, fluid flow, power, network traffic. This treatise adds the human operator, arguing that during a cyber-physical crisis the operator's cognition is often the actual point of failure, not the equipment. It models the operator with cognitive load theory, the Yerkes-Dodson law, and a Lacanian account of how the operator's mental model, the plant's physical state, and its instrumented signals come apart during a crisis. Simulated incident trajectories couple this human layer to the physical and financial models of the Cyber Digital Twin, identifying physical deadlines such as a fifteen-second thermal trip window that a human decision cannot beat, and supporting hardwired interlocks that act first. It computes the resulting reduction in expected annual loss, from $9,600,000 to $290,000.

1. Architectural Foundation#

The 8-Layer World Model of the Cyber Digital Twin

The Cyber Digital Twin models the complete operational universe of a critical infrastructure asset. It spans eight interconnected layers formalized as an eight-voice polyphonic score:

1.1 The Cognitive Dimension as an Integrated Layer#

The cognitive dimension cannot function as an isolated model. Separated from Layer 2 physical thermodynamics, human psychology becomes abstract speculation. Separated from Layer 5 psychometrics, physical engineering models unrealistically assume zero-latency, infallible operator responses.

In the Cyber Digital Twin, Layer 5 is continuously coupled to surrounding layers:

• Coupling with Layer 6 (Telemetry) & Layer 2 (Physical Process): Alarm floods in Layer 6 saturate operator working memory, triggering confirmation bias and panic overrides that drive physical equipment in Layer 2 past irreversible safety thresholds.
• Coupling with Layer 4 (Adversary Manifold): Adversary tactics exploit human cognitive blind spots and social engineering. Attacker operational tempo is calibrated to outpace human verification latency.
• Coupling with Layer 7 (Actuarial Outcomes): Human error probability and decision latency distributions directly determine Annualized Loss Expectancy (ALE) and Single Loss Expectancy (SLE) under insurance underwriting frameworks.

2. Lacanian Topology#

The Triadic Registers in Control Room Disruption

To understand why human operators fail during sophisticated cyber-physical interdictions, the CDT incorporates Jacques Lacan's topological model of human subjectivity: the Borromean knot of the Real, the Symbolic, and the Imaginary.

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 660" role="img" aria-labelledby="cdt-borromean-title cdt-borromean-desc" style="width:min(92vw, 760px);height:auto"> <title id="cdt-borromean-title">Lacanian control room topology: the Symbolic, the Imaginary and the Real drawn as a Borromean link</title> <desc id="cdt-borromean-desc">Three rings of equal size overlap in a triangular arrangement and are woven into a Borromean link. The upper ring is the Symbolic register: digital signifiers and encodings, namely telemetry streams, Modbus registers and the HMI. The lower left ring is the Imaginary register: the operator mental model, comprising ego defense, bias and comforting illusion. The lower right ring is the Real register: physical conservation laws, such as the silicon emergency shutdown trip at 94 degrees Celsius and Joukowsky shock above 520 bar. The weave runs in a cycle. At both of their crossings the Symbolic passes over the Real, the Real passes over the Imaginary, and the Imaginary passes over the Symbolic. Because each pair crosses with the same ring on top at both crossings, no two rings are linked to each other, so removing any single ring leaves the other two free of one another. The three are held together only as a set of three.</desc> <g fill="none" stroke-width="9" stroke-linecap="butt"> <path d="M 380.00 487.47 A 100.00 100.00 0 0 1 331.10 415.65 M 331.10 386.09 A 100.00 100.00 0 0 1 380.00 314.26 M 380.00 314.26 A 100.00 100.00 0 0 1 466.65 307.83 M 492.25 322.61 A 100.00 100.00 0 0 1 380.00 487.47" stroke="#9c6413"/> <path d="M 366.65 493.91 A 100.00 100.00 0 0 1 280.00 314.26 M 280.00 314.26 A 100.00 100.00 0 0 1 366.65 307.83 M 392.25 322.61 A 100.00 100.00 0 0 1 430.00 400.87 M 430.00 400.87 A 100.00 100.00 0 0 1 392.25 479.13" stroke="#1f7a66"/> <path d="M 480.00 314.26 A 100.00 100.00 0 0 1 442.25 392.53 M 416.65 407.31 A 100.00 100.00 0 0 1 330.00 400.87 M 330.00 400.87 A 100.00 100.00 0 0 1 281.10 329.05 M 281.10 299.48 A 100.00 100.00 0 0 1 480.00 314.26" stroke="#3f6cb8"/> </g> </svg>

The figure is a Borromean link, and the link is the content. No two of the three rings are fastened to each other: take any one of them away and the remaining two simply fall apart, having never been joined. The three hold only as a three. This is why the CDT does not model the registers as a chain in which one of them sits between the other two and passes reality along. A corruption of the Symbolic register, which is what false telemetry injected at Layer 6 amounts to, does not weaken one joint in a sequence. It releases the whole structure at once, and the Imaginary and the Real, which never had any direct hold on each other, come apart together.

2.1 The Three Registers Formalized for Critical Infrastructure#

1. The Symbolic Register (Signifiers and Syntax): The symbolic universe comprises the digital encodings that mediate reality to the outside world: network protocol packets, Modbus registers, SCADA HMI graphics, P&ID instrumentation tags, and alarm messages. The symbolic operates on language, discrete digits, and formal logic.
2. The Imaginary Register (Mental Schema and Ego Defense): The imaginary universe comprises the human operator's internal mental model, visual identification, and psychological sense of mastery. The operator looks at an HMI screen showing nominal cooling flow (38.5 L/min) and maintains the comforting cognitive illusion of a stable, well-behaved facility. The imaginary is the locus of confirmation bias, ego defense, and narrative rationalization.
3. The Real Register (The Traumatic Physical Law): The Real is that which resists symbolization absolutely. The Real is the unforgiving physical conservation laws of nature: the thermodynamics of heat transfer ($dT_j/dt = (P_{\text{die}} - \dot{Q}) / C_{\text{thermal}}$), the Joukowsky acoustic shock of liquid slugging ($\Delta P > 520\,\text{bar}$), and the phase changes of methane at $-162^\circ\text{C}$. The Real does not negotiate, does not parse network protocols, and does not care about operator beliefs.

2.2 The Cyber Interdiction as a Symbolic Severance#

When a sophisticated cyber adversary compromises Layer 3 firmware and injects false telemetry into Layer 6 (e.g. freezing temperature reporting at 25.0°C while modulating coolant valves closed), the adversary manipulates the Symbolic register.

The operator remains trapped in the Imaginary register: trusting the frozen HMI screen, rationalizing away secondary vibration warnings as transient sensor glitches, and maintaining the belief that the plant is safe.

The tragedy of industrial cyber-physical catastrophes occurs when the Real abruptly irrupts: physical silicon reaches its 94°C emergency shutdown trip and the trays go dark, or compressor cast-iron casings fracture under acoustic shock. The traumatic Real shatters the Imaginary illusion precisely because the Symbolic mediation was corrupted. The CDT Layer 5 model calculates the exact temporal duration of this symbolic-imaginary lag before the hardware protection acts on its own.

3. Mathematical Formulation of Defender Agent Dynamics#

In the Cyber Digital Twin, human defenders and operators are represented as autonomous agents defined by multidimensional state vectors:

Where:

• $\mathbf{S}_d$ is the static competence vector: technical certifications, years of domain tenure, protocol proficiency, and operational runbook familiarity.
• $\mathbf{P}_d$ is the psychometric baseline vector: Big Five / OCEAN personality dimensions and DISC behavioral quadrants.
• $\mathbf{X}_d(t) = \left( A_d(t), C_d(t), F_d(t), \tau_d(t) \right)$ represents dynamic cognitive state variables.
• $\mathbf{B}_d$ represents cognitive and group bias coefficients.

3.1 Dynamic Stress and the Yerkes-Dodson Arousal Law#

Cognitive arousal $A_d(t) \in [0, 1]$ is driven by incoming alarm frequency and incident severity:

Defender performance $\mathcal{P}_d(t)$ follows the Yerkes-Dodson inverted-U formulation, penalized by accumulated shift fatigue $F_d(t)$:

Where:

• $\eta \approx 1.25$ modulates the kurtosis of the optimal performance peak.
• $\xi \approx 0.45$ quantifies performance degradation caused by continuous operational shift duration.
• When $A_d(t) < 0.20$, the operator experiences hypo-arousal and inattentional blindness.
• When $A_d(t) \in [0.40, 0.65]$, the operator functions in the optimal problem-solving band.
• When $A_d(t) > 0.80$, the operator enters acute cognitive saturation, causing operational performance to degrade toward zero.

3.2 Cognitive Load Theory (Sweller Formulation)#

Total operational cognitive load $C_d(t)$ on the defender is decomposed into three additive components:

Where:

• $C_{\text{intrinsic}}$ is the structural complexity of the cyber-physical incident (e.g. concurrent secondary coolant leak and substation breaker trip).
• $C_{\text{germane}}$ is productive cognitive effort devoted to diagnosing root causes and constructing hypotheses.
• $C_{\text{extraneous}}$ is cognitive friction caused by poorly organized HMI interfaces, unsorted alarm cascades, and competing communications channels.

When total load exceeds working memory capacity ($C_d(t) > C_{\text{capacity}} \approx 7 \pm 2\text{ informational chunks}$), working memory collapses. The operator drops secondary alarms and fixates on a single indicator.

4. Psychometrics, Personality Profiles, and Group Dynamics#

4.1 The Big Five (OCEAN) Psychometric Vector#

Individual defender agents respond differently to identical physical alarms based on their psychometric profiles:

1. Neuroticism (Emotional Stability): Modulates sensitivity to stress spikes ($\alpha$). High-neuroticism agents experience faster arousal climbs ($dA/dt$) and earlier transitions into panic states.
2. Conscientiousness: Modulates adherence to established operating procedures and checklist discipline. High-conscientiousness operators rarely bypass safety steps, but may experience higher decision latency when procedures fail.
3. Openness to Experience: Modulates cognitive flexibility during novel, out-of-spec attack vectors where standard playbooks do not apply.
4. Agreeableness & Extraversion: Modulates communication velocity and team coordination during crisis triage.

4.2 Cognitive Biases Formulated in the CDT#

The CDT parameterizes five distinct cognitive and group biases:

1. Confirmation Bias: When an operator forms an initial hypothesis (e.g. "Sensor TT-101 has failed"), incoming evidence that contradicts the hypothesis is computationally down-weighted: $$w_{\text{contradictory}} = w_{\text{nominal}} \cdot (1 - \gamma_{\text{confirm}})$$ Where $\gamma_{\text{confirm}} \in [0.4, 0.8]$, causing defenders to dismiss true physical hazard alerts.
2. Authority Bias & Gradient Stagnation: In control rooms with rigid operational hierarchies, junior operators who notice anomalous physical readings fail to challenge senior supervisors, delaying emergency trip execution by $40\text{ to }180\,\text{seconds}$.
3. Alarm Fatigue and Normalization of Deviance: When false alarms exceed 100 per shift, operators develop reflexive alarm cancellation habits. The probability of acknowledging an alarm without inspecting its diagnostic source scales as: $$P_{\text{reflexive Ack}} = 1 - \exp\left( -\theta \cdot N_{\text{false alarms}} \right)$$
4. Groupthink and Collective Denial: Under high stress, team members reinforce mutual reassurance, collectively concluding that anomalous facility sounds or pressure surges are benign calibration artifacts.
5. Shift Handover Information Loss: During operational shift rotations, unrecorded anomalous trends lose context, creating a vulnerability window where attack propagation goes unobserved for the first 45 minutes of a new shift.

5. Decision Latency#

The Recognition-Primed Decision (RPD) Model

Under emergency operational conditions, operators do not compare options using utility tables; they execute Gary Klein's Recognition-Primed Decision (RPD) model:

When an adversary executes a novel cyber-physical attack that violates standard operational templates, pattern matching fails. The operator enters mental simulation mode, attempting to construct a plausible narrative.

We formulate the resulting decision latency $\tau_{\text{decision}}$ as a log-normal random variable:

Under high cognitive load ($C_d > 0.85$) and extreme arousal ($A_d > 0.90$), mean decision latency expands from a nominal $12.0\,\text{seconds}$ to over $65.0\,\text{seconds}$.

6. The 15-Second Thermal Trip Cliff: Where Human Latency Meets Physical Law#

In modern high-density data centers operating at $120\,\text{kW}$ per rack across a 100 MW campus, fluid stagnation causes silicon junction temperature $T_j(t)$ to rise rapidly:

Where:

• $P_{\text{die}} = 1{,}200\,\text{W}$ heat dissipation per accelerator package, the configurable maximum NVIDIA publishes for a GB200-class Blackwell GPU.
• $C_{\text{thermal}} = 800\,\text{J/K}$ thermal capacitance of the stagnant cold plate assembly, dominated by the coolant retained in the channels once flow stops.
• Heat flux is $75\,\text{W/cm}^2$ across the $1{,}600\,\text{mm}^2$ dual-die package.
• Operating pressure is $6.0\,\text{bar}$ with $122\,\text{L/min}$ PG25 coolant.

Table 6.1: Defender latency versus the hardware shutdown trip.

The physical reality of the 15-second thermal cliff proves that relying on human operators to execute emergency trips in modern high-density facilities is mathematically impossible. The Cyber Digital Twin demonstrates that human intervention must be decoupled from the primary physical trip loop through deterministic SIL-3 physical interlocks.

7. Systems Assurance: Engineering Remediations#

The Layer 5 cognitive modeling identifies the exact failure envelopes of human operators, directing three deterministic systems assurance remediations:

Table 7.1: Deterministic defensive architecture.

8. Actuarial Risk Engineering and Lloyd's Y5381 Compliance#

Integrating Layer 5 human dynamics into the Cyber Digital Twin transforms underwriting risk assessment under Lloyd's Market Bulletin Y5381:

Where:

• $C_{\text{replacement}}$ is the capital asset replacement cost ($14,400,000 per 120-rack hall).
• $\dot{L}_{\text{BI}}(t)$ is the business interruption loss rate ($24,000 per hour).
• $\Phi_{\text{regulatory}}$ is the statutory penalty under regulatory frameworks.

Deploying deterministic SIL-3 physical interlocks reduces the probability of human-induced thermal destruction $P_{\text{cognitive collapse}}$ from $0.42$ to $0.015$, mitigating annualized loss expectancy from $9,600,000 to $290,000 and delivering a modeled Return on Security Investment ($\text{ROSI} = 3{,}779\%$).

9. Conclusion#

The Human Node in the Universal World Model

The cognitive dimension is not a standalone product or twin; it is the human and psychometric layer (Layer 5) of the Cyber Digital Twin. By formalizing human cognition as a dynamic component of the universal cyber-physical state space; governed by cognitive load bounds, Yerkes-Dodson arousal dynamics, Klein RPD pattern matching, and Lacanian topological registers; the Cyber Digital Twin enables engineers to design critical facilities that remain safe not only against malicious software, but against the natural vulnerabilities of the human mind under crisis.

10. References#

The model applies Sweller's cognitive load theory, the Yerkes-Dodson arousal law, Klein's Recognition-Primed Decision model, the OCEAN and DISC psychometric frameworks, Lacan's Real/Symbolic/Imaginary registers, DEXPI 2.0, CycloneDX 1.6+, and Lloyd's Market Bulletin Y5381. The per-accelerator power figure in section 6 is NVIDIA Corporation's own published figure, given in its Datasheet for NVIDIA Blackwell Architecture, product datasheet.