Reference
Cognitive Security Taxonomy
A structured reference of 70 key concepts, techniques, and frameworks used in information operations analysis, FIMI detection, and narrative intelligence.
Foreign Information Manipulation and Interference — structured external attempts to distort public perception in a target country through coordinated inauthentic behavior.
The process of passing a false or distorted narrative through progressively more credible outlets until it loses its original attribution and appears organic.
The use of multiple accounts or pages acting in concert to artificially amplify content while misrepresenting their origin or coordination.
Manufacturing the appearance of grassroots public support for a position through coordinated but disguised effort.
A fake online identity created to manipulate discussions, amplify content, or impersonate different viewpoints from a single operator.
A set of automated or semi-automated accounts operated at scale to amplify content, simulate engagement, or flood a platform with volume.
An open-source structured framework for describing information operations using a MITRE ATT&CK-style taxonomy of tactics, techniques, and procedures.
A coordinated effort to influence, disrupt, or manipulate the information environment of a target audience, typically by a state or state-adjacent actor.
An effort to shift attitudes, beliefs, or behaviours of a target audience through information-based means, typically without disclosure of the true sponsor.
Warfare aimed at the cognitive domain — targeting the beliefs, reasoning processes, and decision-making capacity of individuals and populations rather than physical infrastructure.
The deliberate introduction of a new narrative frame into public discourse, typically through fringe channels, with the intention of mainstream uptake.
The stage of content spread where real, non-coordinated users pick up and further distribute a narrative that was initially injected by a coordinated network.
Individuals or organisations who unknowingly amplify influence operation content while believing they are acting independently.
AI-generated synthetic media — video, audio, or image — that convincingly depicts a real person saying or doing something they did not.
A propaganda technique characterised by high-volume, high-speed, multi-channel output of contradictory and false content designed to overwhelm rather than persuade.
An inoculation-based counter-influence method that exposes audiences to weakened forms of manipulation techniques before they encounter them in the wild.
The reactive correction of specific false claims after they have entered public circulation.
The aggregate of individuals, organisations, and systems that collect, process, disseminate, and act on information within a defined context.
The strategic use of competing narratives to shape how events are interpreted, to deny opponents' preferred framings, and to establish dominant explanatory frameworks.
Compromising material — real, fabricated, or selectively edited — used to discredit, blackmail, or coerce a target individual or organisation.
An operation combining cyberattack (to obtain material) with strategic publication of that material timed to cause maximum political damage.
An operation conducted under a fabricated identity to make the act appear to come from a different actor — typically to provoke retaliation against an innocent party.
Information, especially biased or misleading, used to promote a political cause or point of view — typically with institutional backing and without full transparency about the sponsor.
False information created and spread deliberately, with awareness of its falsity and intent to deceive.
False or inaccurate information spread without deliberate intent to deceive — error, misunderstanding, or honest but mistaken belief.
True information used with the intent to cause harm — real content weaponised through selective disclosure, timing, or framing.
The phenomenon whereby the same information produces different responses depending on how it is presented — the context, language, and emphasis used to package it.
The media's capacity to influence which topics the public considers important, independently of how those topics are covered.
An industrial-scale operation for creating, maintaining, and deploying large numbers of fake online identities for use in influence operations.
An institutionalised operation employing paid staff to conduct coordinated online influence activities at scale, typically on behalf of a state sponsor.
A narrative constructed to directly challenge and displace a harmful narrative by offering an alternative explanation or frame.
Purposeful communication designed to advance an organisation's mission — coordinated messaging across channels to achieve specific attitudinal or behavioural outcomes.
Planned operations to convey selected information to target audiences to influence their emotions, motives, reasoning, and ultimately behaviour — a military doctrine term.
The process of identifying the actor responsible for an information operation or cyberattack — technically, politically, and legally complex.
The cognitive state in which the volume of available information exceeds an individual's capacity to process it, degrading decision quality.
Overwhelming a platform, hashtag, or comment section with volume to suppress alternative voices or exhaust moderators.
The network of media outlets, platforms, producers, and audiences through which information circulates in a given political or social context.
Open-Source Intelligence — intelligence produced from publicly available information, including social media, news, official documents, and other non-classified sources.
The application of graph theory to map and analyse the structure of connections between accounts, content, or actors in an information environment.
An information operation specifically designed to degrade the target audience's capacity to know — not to change specific beliefs but to undermine the epistemic processes by which beliefs are formed.
A set of accounts or outlets that systematically boost each other's content to manufacture artificial reach and apparent consensus.
The exploitation of a platform's algorithmic, social, or technical systems to amplify content or suppress alternatives beyond what organic engagement would produce.
A social-psychological theory holding that exposure to weakened forms of persuasion attempts builds resistance to stronger versions of the same technique.
A systematic pattern of deviation from rational judgment — predictable errors in thinking exploited by influence operations to bypass critical evaluation.
The systematic monitoring of narrative emergence, spread, and evolution across platforms and time to detect influence operations and assess their reach.
The capacity to access, analyse, evaluate, and create media in a variety of forms — a foundational cognitive skill for navigating manipulated information environments.
Media outlets owned, funded, or editorially controlled by a government, used to project that government's preferred narratives domestically and internationally.
An individual, group, or organisation used by a state or other principal actor to conduct influence operations while maintaining deniability.
The network of Telegram channels and groups used as a primary distribution and coordination infrastructure for information operations, particularly in Eastern European conflict contexts.
Evidence-based knowledge about existing or emerging threats — who, what, why, and how — used to inform defensive and response decisions.
A conflict strategy combining conventional military force with irregular, cyber, and information operations to achieve strategic goals below the threshold of declared war.
The capacity of an individual, community, or institution to maintain accurate situational awareness and sound decision-making under sustained information operations attack.
Tactics, Techniques, and Procedures — the specific methods and operational patterns used by an actor to conduct information operations.
Actions designed to convey selected information to foreign audiences to influence their perceptions, attitudes, and ultimately decisions in ways favourable to the actor.
The protection of an organisation's information assets from compromise that could enable hack-and-leak or deceptive impersonation operations.
The rapid delegitimisation of a dominant narrative frame, creating an interpretive vacuum that competing narratives rush to fill.
The removal of accounts, pages, or content from a platform by the platform operator, typically for policy violations related to influence operations or harmful content.
The use of algorithms, automation, and big data to distribute politically biased or false information at scale.
The capacity to maintain mental health and functional judgment under sustained psychological pressure from hostile information environments.
The proportion of relevant, reliable information to irrelevant or unreliable content in a given information environment or analytical dataset.
An investigation conducted using only publicly available information, without access to classified material, proprietary databases, or non-public platform data.
The strategic choice between proactive inoculation against manipulation techniques (pre-bunking) and reactive correction of specific false claims (debunking).
The analytical method of tracking narrative or account activity across multiple platforms to reconstruct the full scope of an influence operation.
The documented ecosystem of state media, troll farms, covert channels, and proxy networks used by Russia to conduct FIMI operations targeting Western and post-Soviet audiences.
The structural capacity of a media ecosystem, institution, or society to absorb and recover from information operations attacks without lasting damage to epistemic function.
Any media content — text, image, audio, or video — generated by AI systems rather than directly captured or produced by human hand.
Moving information through a series of increasingly credible sources to obscure its original provenance and manufacture apparent legitimacy.
Media assets — videos, games, articles — specifically designed to expose audiences to weakened forms of manipulation techniques as an inoculation against future exposure.
The deliberate calibration of responses to information operations to avoid providing the adversary with amplification, legitimacy, or legal/political justification for escalation.