{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T18:22:05Z","timestamp":1785435725970,"version":"3.56.0"},"reference-count":50,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2026,4,19]],"date-time":"2026-04-19T00:00:00Z","timestamp":1776556800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100005416","name":"Research Council of Norway","doi-asserted-by":"publisher","award":["333900"],"award-info":[{"award-number":["333900"]}],"id":[{"id":"10.13039\/501100005416","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100005416","name":"Research Council of Norway","doi-asserted-by":"publisher","award":["310105"],"award-info":[{"award-number":["310105"]}],"id":[{"id":"10.13039\/501100005416","id-type":"DOI","asserted-by":"publisher"}]},{"award":["333900"],"award-info":[{"award-number":["333900"]}],"id":[{"id":"https:\/\/ror.org\/00epmv149","id-type":"ROR","asserted-by":"publisher"}]},{"award":["310105"],"award-info":[{"award-number":["310105"]}],"id":[{"id":"https:\/\/ror.org\/00epmv149","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Situation Awareness (SA) of operators in Cyber Security (CS) has been assumed important for effective incident response in critical infrastructure. Many previous studies have proposed tools and methods to improve SA, but there is a general lack of empirical evidence on the impact of SA on performance in this domain. In this study, we present such empirical evidence from experiments done within the domain of critical infrastructure. Eleven professional CS operators from the power sector participated in a realistic simulated network-related incident response task. SA, experience, and performance were scored for each participant. SA was measured using the Situation Awareness Global Assessment Technique (SAGAT). Statistically significant results confirmed three hypotheses: Higher SA was correlated with higher performance, and longer experience as an operator was correlated with higher performance. Additionally, higher SA is predictive of higher performance independently of longer experience. Accordingly, initial empirical evidence supporting the conjecture that cyber-SA is positively associated with performance now exists. Implications include that further CS research aimed at tool development and operator training should use recognized SA measurements as demonstrated in this study. This study thus contributes to bridging the existing knowledge gap of cyber-SA.<\/jats:p>","DOI":"10.3390\/info17040385","type":"journal-article","created":{"date-parts":[[2026,4,20]],"date-time":"2026-04-20T08:24:23Z","timestamp":1776673463000},"page":"385","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Measuring the Awareness of Cyber Guardians, Situation Awareness Predicts Operator Performance"],"prefix":"10.3390","volume":"17","author":[{"given":"H\u00e5vard Jakobsen","family":"Ofte","sequence":"first","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology, 2802 Gj\u00f8vik, Norway"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2966-9683","authenticated-orcid":false,"given":"Sokratis","family":"Katsikas","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology, 2802 Gj\u00f8vik, Norway"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,4,19]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"4667","DOI":"10.1002\/sec.1657","article-title":"Human behaviour as an aspect of cybersecurity assurance","volume":"9","author":"Evans","year":"2016","journal-title":"Secur. Commun. Netw."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"104137","DOI":"10.1016\/j.cose.2024.104137","article-title":"Reducing the risk of social engineering attacks using SOAR measures in a real world environment: A case study","volume":"148","author":"Waelchli","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"102267","DOI":"10.1016\/j.cose.2021.102267","article-title":"Enhancing employees information security awareness in private and public organisations: A systematic literature review","volume":"106","author":"Khando","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"104421","DOI":"10.1016\/j.cose.2025.104421","article-title":"Frontline responders: Rethinking indicators of compromise for industrial control system security","volume":"154","author":"Asiri","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"100521","DOI":"10.1016\/j.ijcip.2022.100521","article-title":"APT attacks on industrial control systems: A tale of three incidents","volume":"37","author":"Kumar","year":"2022","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"100464","DOI":"10.1016\/j.ijcip.2021.100464","article-title":"Looking back to look forward: Lessons learnt from cyber-attacks on industrial control systems","volume":"35","author":"Miller","year":"2021","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"100701","DOI":"10.1016\/j.ijcip.2024.100701","article-title":"Cyber attacks on critical infrastructures and satellite communications","volume":"46","author":"Carlo","year":"2024","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"3253","DOI":"10.1007\/s10207-024-00872-6","article-title":"The awareness of operators: A goal-directed task analysis in SOCs for critical infrastructure","volume":"23","author":"Ofte","year":"2024","journal-title":"Int. J. Inf. Secur."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"697","DOI":"10.1108\/ICS-07-2020-0121","article-title":"Key competencies for critical infrastructure cyber-security: A systematic literature review","volume":"29","author":"Chowdhury","year":"2021","journal-title":"Inf. Comput. Secur."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"104524","DOI":"10.1016\/j.cose.2025.104524","article-title":"The human factor: Addressing computing risks for critical national infrastructure towards 2040","volume":"157","author":"Weir","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Rahman, T., Rohan, R., Pal, D., and Kanthamanon, P. (2021). Human factors in cybersecurity: A scoping review. Proceedings of the 12th International Conference on Advances in Information Technology, Bangkok, Thailand, 29 June\u20131 July 2021, ACM.","DOI":"10.1145\/3468784.3468789"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"449","DOI":"10.1080\/00140139.2017.1278796","article-title":"State-of-science: Situation awareness in individuals, teams and systems","volume":"60","author":"Stanton","year":"2017","journal-title":"Ergonomics"},{"key":"ref_13","first-page":"18","article-title":"Gaps and Opportunities in Situational Awareness for Cybersecurity","volume":"1","author":"Gutzwiller","year":"2020","journal-title":"Digit. Threat. Res. Pract."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"103069","DOI":"10.1016\/j.cose.2022.103069","article-title":"Understanding situation awareness in SOCs, a systematic literature review","volume":"126","author":"Ofte","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2014.06.008","article-title":"Cyber situational awareness\u2014A systematic review of the literature","volume":"46","author":"Franke","year":"2014","journal-title":"Comput. Secur."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Franke, U., Andreasson, A., Artman, H., Brynielsson, J., Varga, S., and Vilhelm, N. (2022). Cyber situational awareness issues and challenges. Cybersecurity and Cognitive Science, Elsevier.","DOI":"10.1016\/B978-0-323-90570-1.00015-2"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"215","DOI":"10.1145\/3565570","article-title":"Smart grid cyber-physical situational awareness of complex operational technology attacks: A review","volume":"55","author":"Nafees","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Endsley, M.R. (2017). Direct measurement of situation awareness: Validity and use of SAGAT. Situational Awareness, Routledge.","DOI":"10.4324\/9781315087924-9"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1518\/001872095779049543","article-title":"Toward a theory of situation awareness in dynamic systems","volume":"37","author":"Endsley","year":"1995","journal-title":"Hum. Factors J. Hum. Factors Ergon. Soc."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1177\/1555343415572631","article-title":"Situation awareness misconceptions and misunderstandings","volume":"9","author":"Endsley","year":"2015","journal-title":"J. Cogn. Eng. Decis. Mak."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"102401","DOI":"10.1016\/j.cose.2021.102401","article-title":"Impact of comprehensive information security awareness and cognitive characteristics on security incident management\u2014An empirical study","volume":"109","author":"Thangavelu","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"100755","DOI":"10.1016\/j.ijcip.2025.100755","article-title":"Situation Awareness for Cyber resilience: A review","volume":"49","author":"Bellini","year":"2025","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Jajodia, S., Liu, P., Swarup, V., and Wang, C. (2010). Cyber Situational Awareness, Springer.","DOI":"10.1007\/978-1-4419-0140-8"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"7","DOI":"10.1007\/978-3-319-11391-3_2","article-title":"Foundation and challenges","volume":"62","author":"Endsley","year":"2014","journal-title":"Cyber Def. Situational Aware."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1288","DOI":"10.1080\/00140130600612762","article-title":"Distributed situation awareness in dynamic systems: Theoretical development and application of an ergonomics methodology","volume":"49","author":"Stanton","year":"2006","journal-title":"Ergonomics"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Salmon, P.M., Stanton, N.A., Walker, G.H., and Jenkins, D.P. (2017). Distributed Situation Awareness: Theory, Measurement and Application to Teamwork, CRC Press.","DOI":"10.1201\/9781315577654"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Ofte, H.J., and Katsikas, S. (2024). Paralyzed or Compromised: A Case Study of Decisions in Cyber-Physical Systems. International Conference on Human-Computer Interaction, Springer.","DOI":"10.1007\/978-3-031-61382-1_9"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Endsley, M.R., and Jones, D.G. (2016). Designing for Situation Awareness: An Approach to User-Centered Design, CRC Press.","DOI":"10.1201\/b11371"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"124","DOI":"10.1177\/0018720819875376","article-title":"A systematic review and meta-analysis of direct objective measures of situation awareness: A comparison of SAGAT and SPAM","volume":"63","author":"Endsley","year":"2021","journal-title":"Hum. Factors"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"490","DOI":"10.1016\/j.ergon.2008.10.010","article-title":"Measuring Situation Awareness in complex systems: Comparison of measures study","volume":"39","author":"Salmon","year":"2009","journal-title":"Int. J. Ind. Ergon."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"225","DOI":"10.1016\/j.apergo.2005.02.001","article-title":"Situation awareness measurement: A review of applicability for C4i environments","volume":"37","author":"Salmon","year":"2006","journal-title":"Appl. Ergon."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Lif, P., Gran\u00e5sen, M., and Sommestad, T. (2017). Development and validation of technique to measure cyber situation awareness. Proceedings of the 2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA), London, UK, 19\u201320 June 2017, IEEE.","DOI":"10.1109\/CyberSA.2017.8073388"},{"key":"ref_33","unstructured":"Giacobe, N.A. (2013). Measuring the Effectiveness of Visual Analytics and Data Fusion Techniques on Situation Awareness in Cyber-security. [Ph.D. Thesis, The Pennsylvania State University]."},{"key":"ref_34","unstructured":"Connors, E., Jones, R., and Endsley, M. (2010). A Comprehensive Study of Requirements and Metrics for Cyber Defense Situation Awareness, SA Technologies. Inc."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Nikolov, G., Perez, A., and Mees, W. (2024). Evaluation of Cyber Situation Awareness-Theory, Techniques and Applications. Proceedings of the 19th International Conference on Availability, Reliability and Security, Vienna, Austria, 30 July\u20132 August 2024, ACM.","DOI":"10.1145\/3664476.3670921"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1007\/s10111-003-0136-9","article-title":"Human factors and folk models","volume":"6","author":"Dekker","year":"2004","journal-title":"Cogn. Technol. Work"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"221","DOI":"10.1080\/1463922X.2021.1921310","article-title":"The validity of situation awareness for performance: A meta-analysis","volume":"23","author":"Bakdash","year":"2022","journal-title":"Theor. Issues Ergon. Sci."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Endsley, M.R. (2021). Situation Awareness Measurement: How to Measure Situation Awareness in Individuals and Teams, Human Factors and Ergonomics Society.","DOI":"10.1002\/9781119636113.ch17"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Endsley, M.R., and Garland, D.J. (2000). Situation Awareness Analysis and Measurement, CRC Press.","DOI":"10.1201\/b12461"},{"key":"ref_40","unstructured":"Strater, L.D., and Bolstad, C.A. (2008). Simulation-Based Situation Awareness Training, Human Factors in Simulation and Training."},{"key":"ref_41","first-page":"22","article-title":"Assessing a Decision Support Tool for SOC Analysts","volume":"2","author":"Happa","year":"2021","journal-title":"Digit. Threat. Res. Pract."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Champion, M.A., Rajivan, P., Cooke, N.J., and Jariwala, S. (2012). Team-based cyber defense analysis. Proceedings of the 2012 IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2012, New Orleans, LA, USA, 6\u20138 March 2012, IEEE.","DOI":"10.1109\/CogSIMA.2012.6188386"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Endsley, M.R. (1988). Situation awareness global assessment technique (SAGAT). Proceedings of the IEEE 1988 National Aerospace and Electronics Conference, Dayton, OH, USA, 23\u201327 May 1988, IEEE.","DOI":"10.1109\/NAECON.1988.195097"},{"key":"ref_44","unstructured":"Howitt, D., and Cramer, D. (2020). Understanding Statistics in Psychology with SPSS, Pearson."},{"key":"ref_45","unstructured":"Garson, G.D. (2012). Testing Statistical Assumptions, Statistical Associates Publishing."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"135","DOI":"10.3923\/itj.2003.135.139","article-title":"Type I error rate and power of three normality tests","volume":"2","author":"Mendes","year":"2003","journal-title":"Pak. J. Inf. Technol."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Kr\u00e4mer, W. (2025). The Durbin-Watson Test. International Encyclopedia of Statistical Science, Springer.","DOI":"10.1007\/978-3-662-69359-9_688"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"709","DOI":"10.3758\/BF03192961","article-title":"Using heteroskedasticity-consistent standard error estimators in OLS regression: An introduction and software implementation","volume":"39","author":"Hayes","year":"2007","journal-title":"Behav. Res. Methods"},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Daoud, J.I. (2017). Multicollinearity and regression analysis. Journal of Physics: Conference Series, IOP Publishing.","DOI":"10.1088\/1742-6596\/949\/1\/012009"},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"1149","DOI":"10.3758\/BRM.41.4.1149","article-title":"Statistical power analyses using G*Power 3.1: Tests for correlation and regression analyses","volume":"41","author":"Faul","year":"2009","journal-title":"Behav. Res. Methods"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/4\/385\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,20]],"date-time":"2026-04-20T08:47:05Z","timestamp":1776674825000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/4\/385"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,19]]},"references-count":50,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2026,4]]}},"alternative-id":["info17040385"],"URL":"https:\/\/doi.org\/10.3390\/info17040385","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,19]]}}}