Mental Toughness is a Key Factor in Cyberattack Resilience.
Introduction
In cyberwarfare, as in any conventional combat, the primary target is the mind of your adversary. The competitor having the mental strength and agility to break the will of their opponent is victorious. For this reason, strengthening the mental toughness of an organization, both as a whole and individually, must be a priority.
Mental toughness is an element of the human will that is inherently flawed. Even organizations with mature cybersecurity models can miss the importance of human nature or mistakenly see technology as a solution for human nature.
Many researchers have attributed mental toughness to be a significant influencing factor contributing to successful performance excellence, as well as a performance enhancer. While it can be influenced by external sources, to ultimately master the skill it must be taught. It takes years and a lot of experience to approach mastering mental toughness. The reality is no one will ever master mental toughness. It is not measured by the actions of the person, rather it is the reaction of the person or organization (i.e., resilience) which determines their mental toughness.
When we encounter stressful situations or are faced with any kind of adversity, the resultant outcome in terms of positive or negative emotional responses and the effects those responses have on our performance will be influenced by our ability to successfully manage internal and external demands. This refers to the ability to go beyond pure physical talent, skill and ability and tap into the mental side of performance enhancement and optimization.
Stress, such as that experienced in a cyberattack, is very powerful and it can negatively affect the body in a number of ways, including mental fatigue. Too often people overlook mental elements when faced with difficulty in performance or whenever faced with a situation that requires an enhanced level of performance.
The purpose of this two-part series is to provide a greater understanding of mental toughness, the journey to strengthening it in a person and/or organization, the type of training necessary to achieve improvement and the value to the organization in pursuing development in both the person and organization.
Challenge
Challenge is your drive and adaptability such that you are driven to be as good as you can be and achieve your personal best. It describes the extent to which the individual or organization will push back their boundaries, embrace change and accept risk. It is also about how they perceive all outcomes, good or bad. People with a growth mindset are more willing to take on challenging tasks, delve into a mistake, process it and correct it.
Mentally tough individuals improve an organization’s mental toughness and strengthen the ability to view the challenges, required changes and adversity of cyberwarfare as opportunities rather than the current perception of a threat to be feared.
• Learning from everything.
Learning from everything results in a mindset that creates an attitude of increased mindfulness and intentionality in the way an individual approaches challenges.
Persistent training inculcates an attitude, idea or habit such as the desired security behavior within the execution of the individual’s daily operational role.
• Stretching oneself.
You cannot succeed without making an effort to push out of your comfort zone for the purpose of learning to deal with crisis situations and the anxiety they produce. If actions are driven by fear, outcomes are neither optimal or sustainable.
You don’t learn to walk by following rules. You learn by doing and by falling over. Accept the challenges so that you may feel the exhilaration of victory. Always do more than is required of you, “good enough is never enough.”
“There are two primary choices in life: to accept conditions as they exist or accept responsibility for changing them.”[1] Exposing oneself to challenging experiences, through Deliberate Practice, must be the choice if we are to toughen a person’s or organization’s spirit to endure and succeed in becoming resilient.
Aspiration connects Challenges with Commitment. It is the ambition for achieving a desired future state and is typically subjective, unmeasurable, and intangible (i.e., a cyber defense that has no vulnerabilities). It is making your passion and your work one and the same and doing it with people with whom you want to achieve success.
Commitment
Commitment is being deeply involved in pursuing goals and striving to achieve them despite difficulties.
The strength of commitment will most often depend on the discipline of an individual. Mental toughness enables a person to be disciplined and persistent in their efforts to adhere to doctrine and principles even though there is a potentially easier, yet riskier, approach.
The leader’s discipline must be at a higher level if the individual and team discipline are to continue to improve.
Commitment involves being:
• Goal Oriented.
Goals involve making decisions on the right option to take which requires you to examine all options in a calm (controlled), composed (confident) and objective mindfulness.
Remain focused on the here and now and not allow your thoughts and emotions to be hijacked, in a manner that creates anxiety, by related events. By remaining mindful of the situation, you are able to direct your attention to making decisions that are adaptive and productive for the situation.
It is imperative that all decisions made are owned, remain within your control, and responsibility is taken by you for any and all decisions.
• Delivery Oriented.
Place attention on solving a problem rather than on the way you feel about the problem. Mentally tough people are more outcome focused and better at making things happen. You keep what you are doing under review and continually ask of yourself, “Are there other ways to bring about what is required?”
Delivery oriented people have a “stick with it” attitude and declare upfront to themselves and others their commitment. While you may not be able to silence your negative inner voice altogether, you lessen its effect by learning to identify and challenge it.
Mindset
In many real-life competitions such as cyberwarfare, frame of mind is extremely important.
There are two types of mindsets, a fixed mindset and a growth mindset. The differences between the mindsets come down to what a person believes about change.
A person who is stubborn can appear to be a rock mentally; seem to know what they want and how to get it. Such an individual will have an answer to every question, an opinion on every topic and an idea for every circumstance. On the surface, this may appear to be mental toughness, but how they respond when something goes awry is a more accurate indicator of their mindset.
They see themselves as a finished product whose base qualities such as intelligence are set in stone and the “what you have is all you are going to get” attitude weakens their mental toughness and limits their willingness to commit to the learning effort required to strengthen it. This attitude towards learning diminishes the ability to be adaptable to evolving conditions, such as those occurring in cyber defense, weakening both personal and organizational resilience.
With a fixed mindset, the person is not a work in progress, but in fact, is an impediment to progress. Individuals with this mindset expend significant effort to avoid challenges, quit when they don’t do well immediately or when obstacles are encountered, see effort as fruitless or worse and ignore useful feedback or criticism.
A growth mindset is a really difficult journey taken over a long period of time. People with this mindset believe that their current abilities can be improved with effort and that hard work pays off with sustainable success. Proponents of the growth mindset theory of development propose that individuals with a growth mindset will be more oriented toward self-improvement and more likely to persist in the face of challenges and failures. They will treat obstacles as opportunities to grow rather than signs of their abilities being inadequate. Self-efficacy is the foundation of the growth mindset necessary to strengthen mental toughness.
People with this mindset view an organization’s commitment to employee development as a demonstration of the appreciation of their value to the organization. Such an investment most often results in increased job satisfaction, greater morale and an increase in intrinsic motivation to build daily habits that enable them to overcome challenges and distractions over and over again.
The goal then, of a growth mindset relative to strengthening mental toughness, is to increase the individual’s ability to persevere and to sustain efforts towards a long-term goal (i.e., to stay passionate in the pursuit of a goal). Both perseverance and “grit” are critical to sustaining the journey towards self-improvement and the strengthening of mental toughness.
Perseverance is most often associated with the ability to maintain emotional control when performance and decision making, under stress, is required. As previously mentioned, the goal in any conflict is to break the opponent’s will to continue the engagement. The strength in the will of an individual to maintain a focus on the facts and/or problem solving of the challenging circumstances of the situation, while limiting the influence of the feelings the situation might arouse, will determine the success or failure of the response. It should not, however, be confused with emotional suppression.
Grit[2] is more often associated with long-term perseverance, such as the day-to-day mundane tasks that must be performed at a time when the stress level is minimal and it is human nature to become careless. The degree of discipline in an individual or the culture of an organization will be greatly impacted by the level of mastery of Grit.
Grit is needed when we least expect it and is necessary for us to keep our focus on our goals and control emotions that would alter that focus or cause us to quit. Any conflict can lead to one or more mental fatigue, emotional fatigue or decision fatigue. The negative impact on performance caused by these can be mitigated by strengthening grit.
Mental Toughness Training Environment
The Mental Toughness Training Environment is founded on the perspective that the individual and/or organization must get out of their comfort zone and operate in the Learning and Growth zone. (Figure 2)
It is human nature to follow simple reproducible patterns normally found in the individual’s Comfort Zone. In the comfort zone, the employee is working but not reaching or struggling. Too often individuals, as well as the organization, when operating in this zone, equate repeated training (practicing) in something already being performed well as satisfactory in meeting training requirements. This type of training does not lead to the individual being engaged and, therefore, not improving. There is a reluctance to change this pattern until the behavior becomes unproductive or an event that thrusts them into the Panic Zone occurs.
Such events occur much more frequently than organizations are willing to admit and shouldn’t be seen as occurring only when a cyberattack occurs. Projects requiring skills not yet identified or developed can put the individual in the Panic Zone. When thrust into this zone, necessary activities are tough to perform and the individual or team doesn’t even know how to approach them. This uncertainty leads to acting instinctively and is guided by emotion. These instinctive reactions are usually not adaptive and are based on a lack of appreciation for the true scale of the challenge to be addressed.
The journey to achieving mental toughness, performance improvement and avoiding the panic zone begins in the Learning Zone.
Surface level knowledge is developed in the Learning Zone. A baseline of the individual’s skills is established as well as an understanding of the minimally acceptable abilities required of their role in the organization’s operational environment. The question of “what” is answered.
Humans have evolved to make quick decisions, often based on patterns they have observed and learned. Consequently, training must begin with the “what” of desired behavior. An understanding of what is normal behavior for the individual in an environment or situation is the focus of the training. An understanding of the fundamentals and capabilities must occur before shifting the focus of training to improved performance.
Patterns are a part of life and human behavior, identifying those patterns leads to the recognition of new skills required to optimally perform in the environment or specific situation. The training in these new skills will cause new patterns of behavior to be developed, improve discipline within the execution of the behavior and strengthen confidence in the individual.
Improved performance in all skills occurs in the Growth Zone. A move from the Learning Zone into the Growth Zone is appropriate where the priority of the risk to the organization is high. In the Growth Zone, training targeting the understanding of the “how” to perform and the “why” it is important in the individual’s role are key points of emphasis if the desired mastery in performance of their responsibilities is to be realized.
The effort to improve performance in these capabilities must be regularly reinforced through the training conducted in the Growth Zone. If regular exercising is not enforced, the skill in these capabilities will fade in the individual and/or organization.
Employees want to understand what they are learning and why. They need to have context in which to place the coursework and be able to see how each path evolves and becomes part of a larger whole. Without context, it is difficult for learners to imagine a before and after and to understand the long-term value both for them and their employer that can be extracted from the effort.
In the Growth Zone training, intuition is further developed. Intuition is best used when a person has significant experience and knowledge that was introduced in the Learning Zone and has been further enforced. It guides a person’s subconscious thought processes resulting in an increased tempo in decision-making.
A third question to be answered for the employee is “how” the skills initially identified in the Learning Zones and worked on in the Growth Zone will be developed. The model of Deliberate practice will answer this question and mitigate the probability of the individual and/or the organization finding themselves in the Panic Zone.
Deliberate Practice Is Intentional Practice to Improve
Mental toughness can be achieved and enjoyed by all but it requires intentional practice. While it is a skill that can be learned, it is not easy to acquire which explains why so few people have it.
“Only three things happen naturally in organizations: friction, confusion and underperformance. Everything else requires leadership.”[3] Friction, confusion and underperformance are the hallmarks of far too many cyber defense models today.
For many reasons, there is a false comfort found in believing that knowing equals doing. Two of the main reasons for this faulty logic are the convenience of tradition in the current training process and the fact that it is much easier to present knowledge to a large group of people than it is to set up training scenarios under which the individual or organization develop skills through preparation, training and practice.
The mindless repetitions of “out-of-the-box” training used in the Comfort Zone does nothing to improve or even maintain existing skills and abilities. Little of it challenges a person or pushes them out of the Comfort Zone and, more importantly, can contribute to mistakes that transition them into the Panic Zone.
Scientific research shows that the quality of practice, preparation and training is just as important as the quantity. Scientists have posited that “expert level performance is primarily the result of expert level practice rather than innate talent”.
Deliberate practice is the process of implementing expert level practice and improving the quality of training in practice and preparation. It guides how you should approach your work or art to achieve maximum performance. It is a special type of practice that is purposeful and systematic, highly demanding mentally, requires focused attention and is conducted with the specific goal of improving performance in individual skills.
To gain skills rapidly or approach expert level status in the use of a skill, the individual must learn how to incorporate it into their life. The design of such a practice often falls under the control of a teacher (i.e., mentor). The mentor’s knowledge and ability to see the individual in ways they are unable to see themselves enables them to design the training regimen which is important in this training.
There are four essential components of deliberate practice, and when these conditions are met, the practice improves accuracy and speed of performance on cognitive, perceptual, and motor tasks. These essential components are:
- You must be motivated to attend to the task and exert effort to improve performance.
- The design of the task should take into account pre-existing knowledge such as that gained in the Learning Zone. In doing so, the task can be correctly understood after a brief period of instruction.
- The individual must receive immediate informative feedback and knowledge of the results of their performance. This is the responsibility of the mentor. By observing the individual’s behavior in practice, they are able to make them aware of where they are falling short.
- The individual must repeatedly perform the same task or similar tasks. In both training and testing, establish a small goal or challenge to test toughness. It is very important that groundbreaking, yet viable challenges, are set or the exercise is useless. Do this on a daily basis and the individual and organization will begin to notice that the test(s) become bigger and more challenging. The reason for this is because those small steps are becoming larger steps and your mental toughness is growing. Don’t stop, keep testing and challenging yourself. It is important to note that without adequate feedback, regarding performance, efficient learning is impossible and improvement will be minimal.
Because intuition can influence judgment through emotion and/or cognition, training should be performed through simulation exercises that challenge the individual’s ability to control emotions, make informed decisions supported by the information available and use the perspective they have gained from their life’s experiences and knowledge accumulated (i.e., mental models).
To best develop intuitive decision making, training scenarios should have unrealistically short times for a decision to be made. The situation should involve high stakes related to the action taken and the conditions[4] must be constantly changing. As the repetition of the scenarios is practiced, increasingly challenging conditions should be introduced.
When the topic of decision making is discussed in an organization, the focus on improving that ability is generally on designated leadership. In today’s operating environment, best described as a ‘fog of war’[5], decision making regarding security behavior is no longer just a leadership concern. This is especially relevant in the growing internet operating environment where the individual is often operating alone and has little to no immediate support in their decision making process.
A high degree of cognitive agility in decision making, across the organization, is a requirement for achieving a mature cyber model within the enterprise culture. Improving cognitive agility, in that decision making, requires a regular training cadence such as that of the deliberate practice model. This training and practice are performed in the Growth Zone and oriented to an individual’s role in the organization. The behavior reinforcement is based on doing something well rather than simply going through the motions, which results in a passing grade, so often emphasized in compliance training.
A point of attention is the understanding that, as skills performance is improved, it is quite natural to slip back into the Comfort Zone, providing the potential to become complacent and experience a return to the panic zone.
People do not decide their futures, they decide their habits and their habits decide their futures!
Conclusion
Competition, in any realm, is 85-90% a mental game. With a higher level of mental toughness, you are more likely to interpret, as a result of improved situational awareness, potentially stressful circumstances positively rather than negatively.
Mental toughness development, much like enterprise cybersecurity, is a journey and before an individual or an organization can run each needs to crawl. Every opportunity missed to strengthen the respective mindset is a step backward. Be on the lookout for ways that you are acting mentally weak throughout your day. Chances are your actions and reactions are habits that must be broken.
The level of mental toughness, both individual and organizational, will determine the effectiveness in performing the response and executing the behavior in accordance with the security leader’s intent and the situation.
Mental toughness is about resilience, commitment and determination to deliver a result. This trait is quiet, one could say passive, but it is deep-seated, relentless and comes from within. It serves to strengthen cyber crisis preparedness.
The resilience of an organization will be a product of the resilience of the people. Both must be committed to living in the Learning Zone and improving performance through deliberate practice in the growth zone.
The World Economic Forum, Global Risks Report 2022, attributed 95% of cybersecurity issues to human error. No degree of technological development or scientific calculation will overcome this human dimension. Much like a soldier, the focus of the discipline is on equipping the person with the skills, knowledge and weapons needed to limit the mistakes which are certain to occur. Any doctrine that attempts to reduce cybersecurity conflict to ratios of forces, controls and technology neglects the impact of human will on the conduct of the response and is therefore inherently flawed.
Combining the two elements of mental training and technical training increases the chances of a positive interpretation of circumstances that results in establishing consistent peak performance. The combination will open up an opportunity for superior and elite performance that otherwise was untapped, unheard of and somewhat unattainable. The individual and the organization will be breaking into unique realms of performance optimization and enhancement. Therefore, developing and furthermore maintaining mental toughness is imperative in today’s competitive world and the difference between success and failure may be determined by this sole factor.
“If you are going to win any battle, you have to do one thing. You have to make the mind run the body. Never let the body tell the mind what to do…”[6] Too many organizations are allowing the body and technology to tell the mind, the human factor, what to do.
A caution, however, is that mental toughness training can be overdone and become a weakness. Good judgment and restraint must be exercised in order to avoid ‘burnout’ or poor performance.
[1] Denis Waitley, American motivational speaker, writer and consultant.
[2] Grit connects the Emotional Control and Delivery Oriented element of Commitment providing the discipline to persevere, stay passionate, and gain resolve from previous success.
[3] Jinan Budge, Principal Analyst, Forrester Research
[4] Sun Tzu defines conditions as that which is beyond an individual’s control.
[5] The fog of war is the term that seeks to capture the uncertainty regarding one’s own capability, adversary capability, and adversary intent during an engagement, operation, or campaign.
[6] General George Patton