The signal chain
Every action passes through a logging pipeline, parameterised by an experimental condition engine.Simulation engine
Realistic SOC tasks, alert triage and phishing detection, set in a fictional foyl SecIntel world.
Telemetry pipeline
Timestamped action stream, time-to-first-diagnostic, response time, and friction: hesitation, backtracking, context-switching.
Condition engine
Signal noise, time pressure, and framing, assigned between-subjects and overridable for directed runs.
What the instrument reads
Behavioural measures and validated instruments, per task and per condition.| Symbol | Measure | What it captures |
|---|---|---|
| d′ | Sensitivity | Discriminability of threat from benign, from hits and false alarms (signal-detection theory). |
| c | Criterion | Decision bias: how readily the analyst escalates, independent of sensitivity. |
| t₀ | Time-to-first-diagnostic | Latency from stimulus onset to the first committed decision. |
| ∫ | Friction | Hesitation, verdict backtracking, and context-switching across the task. |
| TLX | Workload | NASA-TLX subscales rated after each task. |
| SE | Self-efficacy | Short security self-efficacy scale, measured pre and post. |
Three dials, one participant
Randomised between-subjects. Override any dial with a URL parameter for a directed run.Configurable experimental toggles for manipulating environmental variables (signal-to-noise ratio, time pressure, and feedback mechanics) across control and treatment groups, with per-participant randomised assignment and deterministic, URL-addressable condition cells for reproducible human-subjects runs.
A session takes about 12 minutes and records no personal data.
A technical report on the instrument and pilot results is in preparation. Researchers can review the aggregate dashboard and study information.