Notifications
Clear all
Topic starter
09/07/2026 12:36 pm
TL;DR: At Bsides Las Vegas, mental models such as OODA and Cynefin were argued to help security teams navigate AI risk by matching response style to context, avoiding overconfidence, and improving communication across complex environments, according to Knostic. The core lesson is that AI governance fails when teams treat one framework as universal and ignore the limits of their own model.
NHIMG editorial — based on content published by Knostic: mental models for AI and cybersecurity decision-making
Questions worth separating out
Q: How should security teams choose a mental model for AI risk decisions?
A: Start by matching the model to the problem state.
Q: Why do single frameworks fail in AI security governance?
A: Single frameworks fail when they are treated as universal rather than situational.
Q: How can teams tell whether a mental model is actually useful?
A: A useful model changes decisions and outcomes.
Practitioner guidance
- Classify AI risks before choosing controls Use a simple triage step to label each scenario as clear, complicated, complex, or chaotic before deciding on policy, escalation, or containment.
- Build OODA-based response loops for AI events Define who observes, who interprets, who decides, and who executes when copilots or AI search tools expose data.
- Test for model-induced blindness in governance reviews Ask whether the current framework explains the actual failure pattern or only the language of the failure.
What's in the full article
Knostic's full article covers the conceptual detail this post intentionally leaves at the framework level:
- Practical examples of how OODA and Cynefin can be applied to AI security decision-making
- Yu's discussion of model-induced blindness and the limitations of single-frame reasoning
- The article's broader thinking on combining mental models to improve clarity across security teams
- Additional event context from Bsides Las Vegas and the surrounding AI security conversation
👉 Read Knostic's analysis of mental models for AI and cybersecurity decision-making →
AI security mental models: what teams miss when one lens dominates?
Explore further
09/07/2026 12:41 pm
Single-framework governance is the wrong operating model for AI security. AI environments change too quickly for any one mental model to explain every failure mode or response path. OODA is useful for tempo, Cynefin is useful for uncertainty, but neither should be treated as a universal answer. The practitioner takeaway is to build a layered decision model, not a one-size-fits-all doctrine.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who is accountable when AI governance frameworks do not match reality?
A: Accountability sits with the teams that own the control design and the risk acceptance process, not with the framework itself. Governance leaders, security architects, and application owners should verify that the model matches actual system behavior and that exceptions are recorded when it does not.
👉 Read our full editorial: Mental models for AI security expose the limits of single-frame thinking
