Cognitive bias is a systematic pattern of thinking that distorts judgment. In cyber security, it matters because attackers rely on predictable human shortcuts, and defenders can make bad calls when those shortcuts go unchecked. A biased decision may look reasonable, but it can still rest on incomplete evidence, mistaken assumptions, or overconfidence.
Attackers exploit biases in phishing, pretexting, and social engineering by using urgency, authority, familiarity, or fear to push victims past verification. Defenders face the same problem through confirmation bias, where analysts favor evidence that fits an existing theory, and automation bias, where polished tool output is trusted too quickly. Good security practice reduces bias by requiring challenge, independent review, and evidence-based validation instead of relying on what merely sounds convincing.