BSides Munich 2026

As cybersecurity professionals, we often hear the question after a vulnerability has been fixed:
„So… is the software secure now?” And the honest answer is: „No.”
Security is never done. there is no final state of certainty, no permanent green checkmark. While this is normal in our field, it clashes with a fundamental psychological drive: the human need for cognitive closure, the desire for clear, definite answers and an end to uncertainty. The concept was first introduced by social psychologist Arie W. Kruglanski mid of the 1990 and describes how people cope with ambiguity, complexity, and open-ended situations.
Cybersecurity work is inherently ambiguous, probabilistic, and never truly finished. This talk explores what happens when human psychology meets a discipline that can never provide final closure.
The talk is structured into three main parts:

1. What is the Need for Cognitive Closure? (~12 min)
   In the first part, I introduce the psychological concept of cognitive closure:

• Definition of the Need for Cognitive Closure
• The two core mechanisms:
• Urgency tendency (the desire to reach an answer quickly)
• Permanence tendency (the desire to hold on to that answer)
• Introduction to the Need for Closure Scale and what characterizes individuals with high vs. low need for closure
• How uncertainty, time pressure, and stress increase the desire for closure

This section provides the psychological foundation necessary to understand later behavior in security contexts.

1. The Need for Closure in Cybersecurity Work (~18 min)
   In the second part, I apply the concept directly to the daily reality of software and security teams.
   Topics include:

• Why cybersecurity can never provide absolute certainty
• Typical moments that trigger the need for closure:
• „Are we secure now?”
• „Is this finding really relevant?”
• „Can we accept this risk and move on?”
• How high need for closure can influence behavior:
• Premature decisions („Let’s just close the ticket”)
• Overreliance on tools and checklists as psychological closure
• Discomfort with ongoing risk and uncertainty
• Positive effects of closure-seeking:
• Faster decision-making
• Desire for structure and clear processes
• Negative effects:
• Oversimplification of complex risks
• Resistance to new evidence
• „Security theater” as artificial closure

This section helps the audience recognize psychological patterns in their own teams and organizations.

1. Designing Security Work with Human Psychology in Mind (~15 min)
   In the final part, I present practical strategies to structure security work in ways that acknowledge the human need for closure instead of fighting it.
   Examples include:

• Framing security as risk reduction, not “secure vs. insecure”
• Using clear decision frameworks for risk acceptance
• Creating structured rituals (e.g., threat modeling sessions, security reviews) that provide healthy forms of closure
• Communicating uncertainty in a way that is psychologically manageable
• Building Security Champion programs that translate ongoing uncertainty into clear local ownership

Through real-world examples, I show how teams can move from chasing false certainty to developing resilience in the face of uncertainty.