Working memory is the short-term mental workspace people use to hold, compare, and manipulate information while completing a task. It is not long-term memory; it is the limited capacity system that lets you remember a password while typing it, track a sequence of steps, or compare two suspicious log messages.
In cybersecurity, working memory matters because many attacks exploit moments when attention is overloaded. Phishing, social engineering, and prompt manipulation often present many details at once so a user cannot easily verify them. Defenders also rely on working memory when triaging alerts, correlating indicators, and following incident-response steps under pressure. When that workspace is strained, people make more mistakes, miss warning signs, and accept bad output too quickly. Good security practices reduce the burden on working memory by using checklists, clear workflows, multi-factor verification, and tools that present key evidence in a structured way.