James Bone

Harvard University, Economics, Graduate Student

Columbia University, School of Professional Studies - Enterprise Risk management, Faculty Member

Followers

Following

Co-author

Public Views

James is lecturer-in-discipline ERM with Columbia University's School of Professional Studies, author of Cognitive Hack: The New Battleground in Cybersecurity and Enterprise Risk Management, creator of a Cognitive Risk Framework for Cybersecurity and Enterprise Risk Management, Executive Director of TheGRCBlueBook, online directory of risk technology and founder of Global Compliance Associates, LLC and Cognitive Risk and ERM Advisory firm. Member of Society for Risk Analysis, member of American Educational Research Association, member of RIMS, and member of Judgment and Decision-Making.
Phone: 401-451-8112
Address: 5 Grandstand Drive
Lincoln, Rhode Island 02865

less

InterestsView All (17)

Uploads

Papers by James Bone

An examination of the opportunities and challenges of Generative A.I. for use in Cybersecurity

ResearchGate, 2025

This study compares the use cases of Generative AI (GenAI) versus existing Security Operation Cen... more This study compares the use cases of Generative AI (GenAI) versus existing Security Operation Center ("SOC") capabilities and examines the risk of over reliance on GenAI to envision new models of assurance in information security defense strategies. In a preliminary review of the literature, and the hype surrounding Generative AI's use cases, the enthusiasm is palpable as expressed by the potential benefits of large language models. However, a more nuanced and sober analysis is appropriate in the early stage of evaluating Generative AI's contributions to enhanced cyber defensive strategies. There is little doubt that automating manual processes is welcomed in an environment where technical staff shortages add to the litany of hurdles in the implementation of robust cyber security. The potential benefits must be thoroughly evaluated against the risks of early-stage Generative AI and the potential for overreliance on automation relative to human assets. The purpose of this study to evaluate specific use cases of Generative AI in comparison to existing machine learning functionality combined with a more extensive review of the role of human assets in cyber-SOC operations to determine new cyber defense strategies leveraging automation to assist human assets more effectively. A recent July 2024 event involving CrowdStrike's major outage (the largest and most costly at $5 billion in IT history) effecting a broad swath of Microsoft customers, and the economy, is a clarion call to fully understand how and when to integrate automation with human assets more effectively.

Download

CrowdStrike: A Deeper Examination of the Root Cause of Error -Human Element

by James Bone and Anusha Atikukke

ResearchGate, 2025

Technology has enabled organizations to shorten the "time to market", from inception to execution... more Technology has enabled organizations to shorten the "time to market", from inception to execution, with digital tools. The premium on speed to market has created substantial value for successful new products allowing early adopters to gain market advantage before competitors adjust. However, this same advantage can become a hurdle if the product is not immediately successful or prone to technological glitches. This article will look into and beyond the technical issues involved in the CrowdStrike incident to evaluate management's decision-making under uncertainty. At the core of all organized endeavors is a set of decisions made by individuals at all levels of the organization. Seldom are these decisions formally guided even in the best run firms leading to miscommunication, confusion, counter-interpretation and ultimately errors in judgment. Competent leaders are given space to demonstrate their abilities to deliver results in a competitive marketplace. However, organizations seldom conduct in-depth analysis of decision-making.

Download

Cognitive Risks

Edpacs, Jun 3, 2021

ABSTRACT Decision science have begun to enter the lexicon of risk professionals as the concepts f... more ABSTRACT Decision science have begun to enter the lexicon of risk professionals as the concepts from Prospect Theory become popular in media outlets who increasingly warn about the risk of human biases. Decision-making under uncertainty, popularized by Dan Kahneman, Amos Tversky, Paul Slovic, Herbert Simon and other economists, is more than an examination of human biases. Prospect Theory is a reexamination of the theory of choice and the causes of violations of utility theory that has blossomed into a broad and diverse body of research in behavioral and cognitive science. This paper is an outline for a proposed draft of a cognitive risk framework that will be developed to incorporate behavioral and cognitive science into an enterprise risk framework for cybersecurity and enterprise risk governance. Herbert Simon coined the term “Bounded Rationality” in his seminal book of the same name. “Broadly stated, the task is to replace the global rationality of economic man with the kind of rational behavior that is compatible with the access to information and the computational capacities that are actually possessed by organisms, including man, in the kinds of environments in which such organisms exist” (Simon 1955a: 99). Before the development of modern of PCs and even more powerful machine learning algorithms, Simon foresaw the opportunity at the intersection of human decision-making and technology. Since Simon, other economists and researchers have broaden insights from a multidisciplinary offering of academic studies into applied behavioral science. Notwithstanding these advances, only a few scientists have developed decision science solutions at scale at the enterprise level. Machine learning and other forms of artificial intelligence will require new rules of engagement and governance controls to ensure that bias and ethical use standards have been put in place. Data, the newest commodity in all digital strategies, must be better organized and structured in organizations to allow for efficacious information workflows needed to power organizations to higher performance. And lastly, the role of humans working with and alongside machines as decision-support tools are in the early stage of deployment. The research for the book, Cognitive Risks, will examine the last frontier in risk management – the role of human actors in a business environment that is transitioning to digital products and services. A new level of awareness is needed in a digital environment that differs from the physical world. We know this because of the advent of misinformation that now permeates the Internet. Nation states and Dark Web criminals have weaponized trust in the Internet through misinformation campaigns in social media sites by using behavioral science, or more specifically, cognitive hacks to change our behavior when surfing the web. These attacks are low cost and very effective because most observers are not aware of cognitive risks. There are many variations of “cognitive hacks” and “cognitive risks” which will be explained in detail in the book. Dimitry Kiselev, director general of Russia’s state-controlled Rossiyua Segodnya media conglomerate, “Objectivity is a myth which is proposed and imposed on us.” Today, thanks to the Internet and social media, the manipulation of our perception of the world is taking place on previously unimaginable scales of time, space and intentionality. Cognitive hacks and cognitive risks are part of a new lexicon of risks we must learn. Cognitive risks are commonly referred to as heuristic behavior. Heuristics is any approach to problem solving or self-discovery that employs a practical method that is not guaranteed to be optimal, perfect, or rational, but is nevertheless sufficient for reaching an immediate, short-term goal or approximation. Where finding an optimal solution is impossible or impractical, heuristic methods can be used to speed up the process of finding a satisfactory solution. Heuristics can be mental shortcuts that ease the cognitive load of making a decision. Large swaths of the economy have already misjudged the potential, and the threats, of digital transformation. The questions explored in this paper and the subsequent book, Cognitive Risks, that will follow is why? Why do some leaders see opportunity when others only see problems? Why has the retail industry been blindsided by firms like Amazon, Google, Apple, and so many others? The research for the book will also include an exhaustive review of how applied behavioral science can be used to enhance organizational performance, risk management and cybersecurity in all organizations. Few, if any studies to date, have combined a multidisciplinary approach to enterprise risk management and organizational performance. This will be the first study that builds on a 2020 study of advancements in enterprise risk and board governance to provide a comprehensive analysis of methods and processes to apply behavioral science to address a…

Magical Thinking, Expectations, and Predictions

EDPACS

Cognitive Risk

The Biggest Gap in ERM Practice: The Human Element and the Science of Risk

SSRN Electronic Journal, 2021

Enterprise risk management frameworks (such as, COSO ERM, ISO 31000, and NIST&#39;s Cybersecu... more Enterprise risk management frameworks (such as, COSO ERM, ISO 31000, and NIST&#39;s Cybersecurity guidance) have one thing in common. Each of the traditional risk frameworks are based on guidance for establishing rudimentary foundations for the development of risk management programs. Along the way, the term &quot;guidance&quot; has been confused or substituted with &quot;standard(s)&quot; of risk practice and in many cases (especially for early adopters) is assumed to be the summation of a mature risk management program. The challenge traditional risk frameworks face is that the &quot;E&quot; in enterprise risk management is no longer applicable as the world transitions to Industry 4.0 and hybrid models of business and military operations. Technology has extended the walls of the enterprise to the cloud and a variety of third-party and tertiary vendors who do not maintain the same standards as self-contained organizations. Secondarily, but more importantly, none of the traditional risk frameworks include scientific rigor found in Prospect Theory, Decision Science, Behavioral Science, Cognitive Science, or the lesser sciences of Human Factor Analysis. The existing gaps in traditional risk frameworks expose organizations to greater risks at the same time of increasing technological complexity, higher rates of cyber threats and advancements in artificial intelligence which creates an inflection point in corporate governance writ large. This article proposes the need for additional rigor in traditional risk guidance or wholesale revisions to the concept of risk management practice in corporate governance.

Cognitive Hack: The New Battleground in Cybersecurity ... the Human Mind

Cognitive Risk Framework for Cybersecurity: Bounded Rationality

EDPACS, 2016

Cyber risk professionals face a formidable challenge in keeping pace with the asymmetric nature o... more Cyber risk professionals face a formidable challenge in keeping pace with the asymmetric nature of today's advanced threats in cyber security. Spending on cyber security has skyrocketed yet the threat continues to grow exponentially. This phenomenon is called the Cyber Paradox and describes what has become an entrenched battle for security professionals in defending against an increasingly sophisticated adversary that, to date, has adapted faster than defensive measures to prevent loss of data or access to sensitive information. Conventional security defenses have proven less than effective resulting in a virtual "Maginot's Line" of increased fortification by hardening the enterprise yet resulting in greater vulnerability to achieving the goals of defending the organization from cyber threats ("Maginot's Line", n.d.). This article reviews the causes of these misperceptions in security defense and explores research in decision science, intelligence and security informatics, machine learning, and the role of simplicity in shaping a cognitive risk framework. The findings conclude that the human-machine interaction is the greatest threat in cyber space yet very few, if any, security professionals are well versed in strategies to close this gap. The purpose of this article is to bring to light evolving new strategies with promising success and to reveal a few surprises in how simplicity is an under-appreciated strategy in cyber security. Complete text of "Cognitive Hack: The New Battleground in Cybersecurity … the Human Mind" is

Download

The Five Pillars of a Cognitive Risk Framework—Part II

EDPACS, 2016

The purpose of this study is to develop the first cognitive risk framework for cybersecurity to a... more The purpose of this study is to develop the first cognitive risk framework for cybersecurity to address two narrative arcs in cyber warfare: the rise of the "hacker" as an industry and the "cybersecurity paradox", namely why billions spent on cybersecurity fail to address semantic cyberattacks. Semantic cyberattacks, also known as social engineering, manipulates human users' perceptions and interpretation of computer-generated data to obtain non-public confidential data. The cyber battleground has shifted from an attack on hard assets to a much softer target: the human mind. If human behavior is the new and last "weakest link" in the cybersecurity armor, is it possible to build cognitive defenses at the intersection of human-machine interactions? The answer is yes, but the change that is needed requires a new way of thinking about security, data governance and strategy. The concepts referenced in the Cognitive Risk Framework for Cybersecurity (CRFC) are drawn from a large body of research in multidisciplinary topics. Cognitive risk management is a sister discipline of a parallel body of science called Cognitive Informatics Security or CogSec. It is also important to point out as the creator of the CRFC, the principles and practices prescribed herein are borrowed from cognitive informatics security, machine learning, artificial intelligence (AI), and behavioral and cognitive science, among just a few that are still evolving.

Download

The Future of Risk Management

Studies of board governance are extensive yet existing research offers limited insights into the ... more Studies of board governance are extensive yet existing research offers limited insights into the operations of the Audit Committee (Turley and Zaman, 2007). Existing research on Board Governance and Audit Committees focus on anecdotal attributes of the board such as board size, composition, and dual role of the CEO as chairman. Board performance is generally viewed in hindsight based on measures of financial performance, shareholder value and the ability to acquire debt at lower rates as implied factors that demonstrate good governance. Good risk management may be implied by these measures but is seldom evaluated in empirical studies of board governance. Researchers found that insurance company’s board risk committees were positively correlated with higher financial strength ratings and performance but only after the financial crisis of 2008. Prior to that period of time there was little to no correlation in performance between insurance companies and their board risk committee activities (Ames, Hines, &amp; Sankara 2018). Research on audit committees has conceptualized addressing agency risks with little empirical evidence to support correlations with enhanced financial performance. To a certain extent these studies have inevitably relied on relatively crude proxies, for example, the number and duration of meetings as indicators of how “active” an audit committee is (see for example, Abbott et al, 2004, Bedard et al, 2004, Krishnan, 2005). A separate study set out to investigate the relationship between attributes of corporate governance and performance of companies listed on the Ghanaian Stock Exchange (Kyereboah-Coleman, Adjasi &amp; Abor, 2006 – 2007). The study of corporate governance and firm performance of Ghanaian listed companies between 1998 – 2003 consisted primarily of a regression analysis to determine correlations between variables such as board size, debt financing, external directors and other factors with corporate performance. Much of the analysis is mixed or inconclusive. “Though it has been argued (Fama &amp; Jensen 1983, Baysinger and Butler 1985, Baysinger &amp; Hoskinsson, 1990, Baums 1994) that the effectiveness of a board depends on the optimal mix of inside and outside directions, there is little theory on the determinants of an optimal board composition (Hermalin &amp; Weisbach 2002).” The study also revealed a likely optimal board size range where mean ROA levels ranging from board size 8 to 11 are higher than overall mean ROA for the sample. This signals a range of optimum board size (8-11) feasible for good firm performance. A majority of the firms in the study also had a board structure that follows a two-tier structure [separate executive and non-executive boards]. Significantly, firm performance (using ROA or Size) is found to be better in firms with the two-tier board structure (Kyereboah-Coleman, Adjasi, Abor 2006 –2007). Although the researchers in this study found an “optimal” board size for good corporate performance researchers did not include exogenous factors such as candidate selection bias, economic business cycles, tempo of regulatory change or include an empirical analysis of risk processes used by the board(s) to achieve “good” corporate performance. Corporate governance involves responding to a range of internal factors as well as external stakeholders who bring influence on board performance. The limitations of this study demonstrate that a correlation of variables alone does not prove causation of performance. Additional research is needed to better define predictive measures of enhanced corporate governance and risk performance. These topics exceed the scope of this study however limited empirical research on board risk committees and the risk function presents an opportunity for further advancements in board governance and enterprise-wide risk management.

Cognitive Risk Framework for Cybersecurity : Redesigning Risk Management and Internal Controls Design

Cognition in Cybersecurity Situational Awareness

Cognition in Cybersecurity Situational Awareness, 2024

Download

Cognition in Cybersecurity Situational Awareness

Background Cybersecurity situational awareness has evolved from the principles of security defens... more Background Cybersecurity situational awareness has evolved from the principles of security defense using technological automation and graphical visualization interfaces to enhance user visibility into security operations and threat actor behavior, often after a breach has occurred. Cyber security vendors have responded in kind by developing innovative monitoring and detection endpoint sensors on security devices, enterprise networks, as well as cloud systems. Cyber threat actors have responded by developing new methods of stealth to avoid detection by leveraging autonomous bots to launch attacks on what is known as "soft targets", otherwise known as human actors. As a result, the rapid growth of cyber threats and data theft has grown exponentially in the face of billions of dollars spent to improve situational awareness. A paradox has emerged where increased spending on cybersecurity situational awareness has not mitigated the threats in cyberspace, known as the "cyber paradox". This article explores the role of human cognition in cyber security situational awareness. Cognition is the mental action or process of acquiring knowledge and understanding through thought, experience, and the senses. The processes to enhance cognition in understanding risks are not fully contemplated in traditional situational awareness design. This paper explores the gaps in existing situational awareness models to extend the role of cognition in cybersecurity situational awareness. Methods This paper intends to demonstrate the gaps in cognitive processes in cyber security situational awareness caused by an overly focused attention on technology solutions that distracts from awareness of a more persistent threat in cyber space …. the vulnerability of human cognition.[ 1 ] A literature review of situational awareness models broadly and cybersecurity situational awareness specifically will be conducted to examine gaps in cybersecurity situational awareness and the effects and impacts on cognition caused by artificial intelligence, autonomous bots, digital fakes, and the emergence of a virtual business environment are more recent phenomenon which has not been extensively studied to account for the growth and proliferation of cyber threats. This paper proposes that extensive research is needed on the effects of human cognition in the cyber sphere which is adversely affected by "cognitive hacks" across varied domains of operation. (Thompson. P. 2004) [ 2 ] Conclusions The human factors concepts presented in this article may foster interdisciplinary collaborations to yield new, sustainable solutions for enterprise risk management, cybersecurity, and vendor design in cybersecurity.

Download

Clinical evaluation of a lateral flow test for the detection of elevated fecal lactoferrin as an indicator of intestinal inflammation

Gastroenterology, 2003

Download

Fecal lactoferrin is a sensitive and specific marker for chronic inflammatory bowel diseases

Gastroenterology, 2001

Gastroenterology, Volume 120, Issue 5, Pages A276, April 2001, Authors:Sunanda Kane; William J. S... more

Cognitive Risks

EDPACS, 2023

Decision science have begun to enter the lexicon of risk professionals as the concepts from Prosp... more Decision science have begun to enter the lexicon of risk professionals as the concepts from Prospect Theory become popular in media outlets who increasingly warn about the risk of human biases. Decision-making under uncertainty, popularized by Dan Kahneman, Amos Tversky, Paul Slovic, Herbert Simon and other economists, is more than an examination of human biases. Prospect Theory is a reexamination of the theory of choice and the causes of violations of utility theory that has blossomed into a broad and diverse body of research in behavioral and cognitive science. This paper is an outline for a proposed draft of a cognitive risk framework that will be developed to incorporate behavioral and cognitive science into an enterprise risk framework for cybersecurity and enterprise risk governance. Herbert Simon coined the term “Bounded Rationality” in his seminal book of the same name. “Broadly stated, the task is to replace the global rationality of economic man with the kind of rational b...

Download

Magical Thinking, Expectations, and Predictions: Why risk is so hard to explain

Magical Thinking, Expectations, and Predictions, 2023

This article is about the psychology of risk. The psychology of risk borrows from Paul Slovic's P... more This article is about the psychology of risk. The psychology of risk borrows from Paul Slovic's Perceptions of Risk and explores why risk is so hard to discuss. 1 In general, discussions of risk have proven to be ineffective at influencing better behaviors. A part of the reason appears to be centered on how we discuss risks. Dan Kahneman and Amos Tversky's Prospect Theory articulated the difficulties even seasoned analysts have articulating risk. In order to improve risk practice, we need to understand the psychology of risk. Slovic suggests that risk is defined emotions or analysis. Kahneman and Tversky argue that heuristics and bias impact our ability to define risk and uncertainty. Not all researchers agree on these topics so how do we move forward? There are already too many definitions of risk to be effective at settling the debate. What may be needed is to step back and determine what is the goal of whatever endeavor is pursued and how do we mitigate the obstacles and optimize heuristics. This article attempts to frame the questions that we should be asking in order to find a better way forward in managing risks broadly.

Download

Assessment of Thermal Stress in Freshwater Crayfish (Euastacus spp. — Decapoda: Parastacidae): A Focus on Biochemical and Metabolic Indicators

There is a general consensus among scientists that climate change poses a severe threat to organi... more There is a general consensus among scientists that climate change poses a severe threat to organisms with little tolerance for higher temperatures than those in their current environmental niche. The effects of increased environmental temperature will be of significance in those organisms combining reduced thermal tolerance and limited mobility across the environment to allow shifts to more optimal habitat. The relict populations of the freshwater crayfish genus, Euastacus, in Queensland are generally restricted to cooler mountain-top streams and are at significant extinction risk due to these factors. While noted as threatened by increases in environmental temperature, key knowledge gaps exist regarding the thermal biology of these crayfish. This project sought to answer the underlying question; Are species of Euastacus in Queensland, some with severely restricted distributions, currently experiencing thermal stress in warmer parts of the year? It was anticipated that evidence of f...

Download

The overclassification of risk

The Case for Risk Optimization in ERM, 2023

The over-classification of risk has led to confusion in risk management and ultimately a generali... more The over-classification of risk has led to confusion in risk management and ultimately a generalization of what is determined to be a risk. The language of risk has been corrupted by public accounting firms lack rigorous training in risk nor understand the historical academic literature of risk. COSO ERM is the poster child for over-classification of risks which has caused distrust and damaged the credibility of ERM broadly. This paper is presented to make aware the over-classification of risk and to propose a new way forward for risk optimization in enterprise risk management.

Download

A Portfolio of Organizational Risks -Enterprise Risk Harry Markowitz's Portfolio Theory

A Portfolio of Organizational Risks, 2023

This ar(cle is not an academic analysis of enterprise risk. My intent to raise a simple ques(on: ... more This ar(cle is not an academic analysis of enterprise risk. My intent to raise a simple ques(on: Can Harry Markowitz's por?olio theory be used to enhance the fledgling discipline of enterprise risk management? I ask this ques(on for several reasons. Enterprise risk as we know it today is based, in part, on internal controls over financial repor(ng as its founda(on. This approach appears to be a backwards look into risk by assuming that internal controls have some cura(ve effects on risk and not a result of human decision making. If a control fails, we call it a risk. There is liJle evidence that this approach has resulted in effec(ve risk mi(ga(on but for almost 20 years this assump(on has been accepted as truth without evidence since the incep(on of the COSO ERM framework. Risks exist whether we have internal controls in place or not in the form of residual risks which are present in all organiza(ons. Residual risks, by defini(on, are never listed in any risk inventory or a Risk and Control Self-Assessment. Few risk professionals have a robust list of residual risks that are proac(vely addressed in a meaningful way. Most economists and thinkers in uncertainty understand that risks create opportunity when the proper alloca(on of resources and capital are applied appropriately in response to adverse events. We have failed students by not applying decades of mul(disciplinary research to address the por?olio of risks faced by all organiza(ons.

Download

James Bone

Uploads

Papers by James Bone

Log In