A Conceptual Framework for a Morphological Scenario Library and Playbook Mapping in Cognitive Warfare Defense

Abstract

Cognitive warfare is a hybrid threat that combines information manipulation with psychological influence, often amplified by digital platforms and synthetic media. Conventional cybersecurity tooling is optimized for technical intrusion and offers limited support for anticipating and responding to influence operations. This paper presents a conceptual framework that structures cognitive warfare threats with General Morphological Analysis (GMA) and links plausible configurations to indicator profiles and response playbooks. We first conduct a PRISMA-informed literature review (2018–2025) to derive a five-dimensional taxonomy (actor, tactic, medium, target, objective). We then apply cross-consistency assessment to remove implausible state-pair combinations and obtain a reduced library of internally consistent scenarios. To support analyst-guided triage, we outline an AI-enabled workflow that maps observable signals to taxonomy states, matches events to scenarios, and prioritizes responses via an auditable, policy-set risk score. Finally, we illustrate the framework on three publicly documented cases and show how each case maps to scenario vectors, indicators, and playbooks. No end-to-end system implementation or performance metrics are reported; the contribution is the structured scenario library and the traceable mapping from observations to response guidance.

1. Introduction

Cognitive warfare targets perception and decision-making by combining narrative manipulation with digital delivery and psychological techniques. Recent conflicts and political crises have shown how disinformation, coordinated propaganda [1], and synthetic media [2] can scale quickly and erode trust in institutions and information sources.

Existing cybersecurity systems are primarily designed to detect technical intrusion (e.g., malware or network attacks). They are less suited to influence operations, where the observable signals are often linguistic, behavioral, or socio-technical rather than purely technical. As a result, analysts often face fragmented signals and ad hoc response choices.

This study proposes a structured, non-quantified way to describe and explore cognitive warfare threat combinations. We use General Morphological Analysis (GMA) [3] to represent the threat space as a finite set of categorical dimensions and states. We then apply cross-consistency assessment (CCA) to filter combinations that are internally inconsistent or contextually implausible.

The framework is intended to support early warning and response planning, not to claim operational deployment readiness. In this paper, “prediction” refers to analyst-guided early warning based on scenario matching and risk prioritization from observable indicators, rather than probabilistic forecasting of downstream attitudes or behavior.

Our contributions are threefold. First, we synthesize recent research on cognitive warfare and influence operations into a five-dimensional taxonomy (actor, tactic, medium, target, objective). Second, we construct and refine a scenario library with CCA, yielding a transparent set of plausible configurations. Third, we outline how an AI-enabled workflow could map observations to taxonomy states, retrieve indicator profiles and response playbooks, and support prioritization with an auditable risk score [4].

Scope and boundaries are explicit. The focus is on influence operations and information manipulation in the digital information environment, including digital-to-offline delivery channels (e.g., telephony/robocalls or print distribution) when they are used to deliver or amplify narrative operations. Technical intrusion chains are not modeled except insofar as they enable or amplify influence activity.

2. Materials and Methods

2.1. Literature Survey and Threat Taxonomy

A structured literature review was conducted to capture the full spectrum of cognitive warfare threats. The review protocol specified the time window, source types, search terms, and screening criteria to support transparent and reproducible reporting. The review process was informed by PRISMA 2020 principles where applicable [5]. To support transparency, the search sources, full query strings, eligibility criteria, screening counts, and screening procedure are reported in Supplementary Table S1.

The domain-literature search was limited to 2018–2025 and to English-language peer-reviewed research and publicly released institutional reports. This linguistic restriction was applied because English serves as the primary lingua franca for NATO and allied cognitive warfare doctrines, ensuring terminological consistency across the analyzed corpus, although this excludes non-Western strategic perspectives. Search terms included ‘cognitive warfare’, ‘psychological warfare’, ‘information operations’, and ‘propaganda’. Foundational works outside the window were included only as conceptual anchors. Lasswell’s classic communication model (who, what, channel, whom, effect) was adopted as the organizing framework [6]. Table 1 summarizes the resulting taxonomy.

Table 1. Taxonomy of cognitive warfare threats.

Dimension	Representative Categories	Key Source
Actor	State actors, Non-state groups, Insiders, AI-assisted operator groups (attribution-unresolved)	[6]
Tactic	Disinformation, Propaganda, Social engineering, Deepfakes and synthetic media	[7]
Medium	Social media, Traditional media, Private messaging, In-person and offline dissemination	[8]
Target	General public, Military personnel, Leadership elites, Specific demographic communities	[9]
Objective	Polarization, Erosion of trust, Demoralization, Decision manipulation	[10]

Note: In-person and offline dissemination denotes physical-world and non-platform propagation mechanisms, including face-to-face communication, print distribution, and telephony-based broadcast channels such as robocalls.

This taxonomy is aligned with NATO Allied Command Transformation’s articulation of the cognitive warfare concept and its emphasis on cognitive effects as an operational concern [11].

2.2. Morphological Matrix Construction

Using the above taxonomy, a morphological analysis framework was developed for scenario modeling and systematic configuration of multidimensional problem spaces [3,12]. Each taxonomy dimension was defined as a parameter in a morphological matrix, and its categories were listed as the parameter’s possible values. This yielded a multi-dimensional matrix in which each row corresponds to a threat dimension, and each cell in that row is one of its categorical options. By selecting one category from each row, a unique combination is formed; each such combination represents a distinct hypothetical influence-operation scenario. The dimensions and states were iteratively refined through author review to improve plausibility and coverage.

Evidence base and study selection. We conducted a structured literature and institutional-report review to ground the state space and indicator families. Searches covered peer-reviewed databases and public institutional reports using pre-registered Boolean strings and eligibility criteria (Supplementary Table S1). In total, 782 database records and 41 public reports were identified; 163 duplicates were removed, yielding 660 unique records for title/abstract screening. We retrieved and assessed 124 full texts and included 46 studies in the qualitative synthesis for taxonomy construction and indicator/playbook extraction (Supplementary Table S1; Figure S1). Domain-literature screening was limited to 2018–2025 and English-language materials, while foundational method sources for GMA/CCA were permitted regardless of year or language (Supplementary Table S1). Figure 1 illustrates the morphological box (Zwicky box) used to represent the threat dimensions and states in the matrix.

Figure 1. Morphological box (Zwicky box) for cognitive warfare threat factors. Each row is a taxonomy dimension, and each cell is a discrete state; selecting one state from each row defines a scenario configuration.

2.3. Cross-Consistency Assessment (CCA)

After constructing the morphological matrix, we performed cross-consistency assessment (CCA) to filter out internally inconsistent or operationally implausible configurations. With D = 5 dimensions, there are D(D − 1)/2 = 10 distinct dimension pairs. Because each dimension has four states, each dimension pair yields 4 × 4 = 16 state-pairs; hence, a total of 10 × 16 = 160 pairwise compatibility relations were assessed. Seven state-pairs were coded as incompatible (M = 7) and are reported with rationales in Supplementary Table S2A.

Let Ω be the full configuration space. The unfiltered size is shown in Equation (1),

$$\left|\mathsf{\Omega }\right|=\prod _{d=1}^D\left|S_d\right|$$

(1)

where D is the number of dimensions and |S_d| is the number of states in dimension d. In this study, D = 5 and |S_d| = 4 for all d, so |Ω| = 4⁵ = 1024.

Each blocked state-pair i defines a violation set V_i ⊂ Ω that contains all configurations matching the two blocked states. For a single blocked pair, the isolated count is 4^D−2 = 4³ = 64, because two dimensions are fixed and the remaining D − 2 dimensions are free. Because blocked pairs can overlap, the total number of pruned configurations is the union size |⋃_i=1^M V_i| rather than the simple sum Σ|V_i|. We therefore compute the union size by exhaustive enumeration over Ω (Supplementary Table S2C). Under the blocked pairs listed in Supplementary Table S2A (M = 7), the overlap-aware union size is |⋃ V_i| = 331, yielding N = 1024 − 331 = 693 internally consistent candidate scenarios.

To assess robustness, we performed a sensitivity check by removing the most context-dependent constraint (P7: AI-assisted operator groups vs. traditional media) and recomputing the library size. Because of overlaps, removing P7 restores 39 configurations (Supplementary Table S2C), indicating that the scenario structure remains stable under this perturbation.

2.4. AI-Enabled Prediction and Response Integration

Based on the refined scenario library, this section describes a conceptual AI-enabled workflow for early warning and response planning. The scenario library acts as a transparent knowledge base: observable signals are mapped to taxonomy states, matched to plausible scenarios, and used to retrieve indicator profiles and response playbooks. This section specifies a concrete processing blueprint, but it does not report an implemented system or end-to-end performance.

Layer 1 inputs (OSINT/SOCMINT). The monitoring layer relies on sources that are publicly accessible or observable under applicable law and platform terms. Examples include public posts and comments from major social platforms, public channels in messaging services, open web forums and news sites, platform transparency reports and takedown disclosures, fact-check and verified-claim repositories, and public government or election advisories. For telephony-style incidents, relevant public artifacts can include complaint feeds, public enforcement notices, and (where available) carrier-provided metadata such as STIR/SHAKEN attestation fields. The goal is to keep the workflow auditable and reproducible.

Figure 2 summarizes the workflow from multi-source ingestion to feature extraction, scenario matching against the morphological scenario library, risk-based prioritization, and playbook surfacing for analyst review.

Figure 2. Conceptual AI-enabled prediction and response workflow. The system ingests multi-source data, extracts features (content, network, forensics), matches them against the morphological scenario library, and calculates risk scores to trigger response playbooks.

To avoid overreach, the workflow assumes data minimization, documented legal authority for any non-public access, and a human-in-the-loop decision point before any mitigation action is taken. The risk score is used for triage only and does not, by itself, justify enforcement or content removal.

2.4.1. Data Processing, Feature Engineering, and Scenario Matching

This subsection outlines the minimum processing and feature-engineering steps that can be implemented with standard methods. The aim is to make the proposed workflow specific and testable at the module level while keeping the overall contribution conceptual.

Ingestion. Inputs are represented as time-stamped items under a unified schema that records (1) content and modality (text, image, video, audio), (2) channel metadata (platform or channel type), (3) dissemination context (e.g., repost/forward relations, known coordination markers), and (4) target context when observable (e.g., public, community-bounded, military, leadership).

Normalization and windowing. Items are normalized into a comparable representation (tokenization/embedding for text; feature extraction for media; graph construction for network relations) and aggregated into analysis windows e. Window size is an operational parameter (e.g., hours or days) chosen to balance timeliness and evidence sufficiency.

Feature extraction. Three feature families are extracted and aligned with the modules in Figure 2.

Content features: representations of meaning and framing (e.g., embeddings), sentiment/affect signals, stance cues, and narrative-frame indicators that support clustering and comparison across posts and sources.

Network features: coordination signatures such as near-duplicate templates, synchronized timing, abnormal burst patterns, repeated link-sharing, and channel-graph structures (e.g., forwarding or repost chains) that suggest organized dissemination.

Forensic features: authenticity signals for synthetic or manipulated media (audio, video, image) and, where applicable, channel–metadata features that support provenance checks and incident verification.

Scenario matching. Extracted features are mapped onto the five taxonomy dimensions (actor, tactic, medium, target, objective). The resulting categorical vector is matched to the CCA-consistent scenario library. Matching returns the nearest scenario(s), the associated indicator profile, and the response playbook modules suitable for analyst review.

Risk scoring model. For each observation window e matched to a candidate scenario vector s, the system computes a composite score R(s,e) on [0, 1] as a weighted sum of five normalized components. We provide a worked numeric example for Case C3 in Supplementary Table S4C.

$$R\left(s,e\right)=\sum _{k=1}^5{w}_k\hspace{0.17em}{c}_k\left(s,e\right)$$

(2)

The components are defined as follows:

• c₁: Scenario-match confidence
• c₂: Estimated reach and velocity
• c₃: Coordination/Automation intensity
• c₄: Content-harm potential
• c₅: Target sensitivity
• Worked example (summary). Using policy-set weights w = (0.25, 0.20, 0.20, 0.20, 0.15) and component scores c = (0.82, 0.35, 0.55, 0.90, 0.80) for a C3-like window yields R = 0.685 (see Supplementary Table S4C for the full step-by-step calculation and component rules).

The weights satisfy the following equation:

$$\sum _{k=1}^5{w}_k=1,w_k\ge 0,k=1,\dots ,5$$

(3)

The score is used to rank items for analyst triage and to surface corresponding response playbooks. Because both false positives (unnecessary escalation) and false negatives (missed influence activity) are possible, the workflow keeps the component breakdown, records evidence supporting each component, and requires human review before action.

2.4.2. Verification and Evaluation Metrics

This study does not report end-to-end deployment performance. Instead, it defines evaluation targets that are feasible for future prototyping, including module-level tests and system-level checks for scenario matching and triage behavior.

Module-level evaluation. For content-analysis modules (e.g., sentiment/affect classifiers, stance detection, topic or narrative clustering), report standard classification metrics (precision, recall, F1) and calibration where probabilistic outputs are used. For media-forensics modules, report detection accuracy and robustness across manipulation types and compression or re-encoding conditions.

System-level evaluation. For scenario matching, report Top-1 and Top-k accuracy over scenario vectors and calibration of match confidence. For triage, report how often high-score alerts correspond to analyst-confirmed incidents (positive predictive value) and how often confirmed incidents are missed (miss rate), using a clearly defined adjudication protocol.

2.4.3. Weight Determination and Quantitative Standards for c_k

This subsection reduces two common sources of ambiguity in risk scoring: (1) how weights are set, and (2) how each component c_k(s,e) is mapped to [0, 1]. The concrete component rules and a worked example are provided in Supplementary Table S4A–C.

Quantitative standards for c_k. Each component is mapped to [0, 1] using a documented rule so that different analysts can reproduce the same score from the same evidence.

• c₁ Scenario-match confidence: calibrated match confidence from the scenario matcher (or normalized categorical agreement for a rule-based matcher).
• c₂ Reach and velocity: normalized dissemination magnitude and growth rate relative to channel baselines (e.g., post volume, share/forward rate, view proxies where available).
• c₃ Coordination/automation intensity: a composite of coordination indicators (template similarity, synchronization, account reuse, bot-likeness where applicable) and automation cues.
• c₄ Content-harm potential: a rubric-based score grounded in an explicit harm taxonomy relevant to influence operations (e.g., impersonation, incitement, electoral interference, coercive fraud).
• c₅ Target sensitivity: a rubric-based score based on the protectedness or criticality of the affected population and context (e.g., military units, election administration, emergency response).

Weight determination. Weights w_k are policy-set and can be elicited from domain experts, adjusted by operational context, and reviewed periodically. Keeping the component-level breakdown supports auditability and helps analysts challenge scores when the evidence is sparse or ambiguous.

2.5. Case-Based Instantiation Dataset and Coding Procedure

To bridge conceptual modeling and operational plausibility, a case-based instantiation was conducted using publicly available primary sources. Three cases were selected:

• (C1) IRA influence on Twitter (2016 U.S. election) [13].
• (C2) IS propaganda ecosystem on Telegram [14].
• (C3) AI-voice robocall incident targeting New Hampshire voters [15].

For each case, a structured evidence sheet was compiled (Supplementary Table S3). Each case was encoded into a 5-dimensional categorical scenario vector. To preserve the “one state per dimension” encoding rule, a single dominant state was assigned per dimension, while secondary attributes were recorded as annotations. To assess the reliability of the single-author coding, a two-pass test–retest was performed, yielding an overall agreement of 86.7% (Supplementary Table S3).

2.6. Reliability and Bias Mitigation in Case Coding

Because the three cases are used as auditable instantiations rather than a large-N coded dataset, we prioritized transparency and repeatability of labels. We used a fixed, pre-specified coding template (Supplementary Table S3A) and extracted descriptors from primary public sources (Supplementary Table S3B). To reduce single-pass subjectivity, we performed two-pass test–retest coding across three cases and five dimensions under the one-state-per-dimension rule; overall agreement was 86.7% (13/15 labels), with disagreements confined to the C3 Actor and Medium dimensions (Supplementary Table S3C). We resolved these disagreements using explicit reconciliation rules recorded in a resolution log (Supplementary Table S3D). This combination of fixed templates, source-auditable descriptors, and rule-based reconciliation is designed to make coding decisions inspectable and replicable, and it provides a clear protocol for future inter-coder reliability checks when scaling to larger corpora.

3. Results

3.1. Derived Scenario Archetypes

To make the matrix analytically tractable, similar configurations were grouped into scenario archetypes. Table 2 summarizes the four principal archetypes.

Table 2. Scenario archetypes derived from the refined morphological matrix.

Archetype ID	Dominant Actor Type	Dominant Tactic Family	Main Medium (s)	Primary Target (s)	Principal Objective (s)
A1	State actors	Disinformation, Propaganda	Social media, Traditional media	General public	Polarization, Erosion of trust
A2	Non-state groups	Propaganda, Social engineering	Private messaging, Social media	Specific demographic communities	Decision manipulation
A3	AI-assisted operator groups	Deepfakes and synthetic media	Social media; In-person/offline	Leadership elites, General public	Decision manipulation, Demoralization
A4	State actors	Disinformation, Propaganda	Multi-channel (Online + Offline)	General public	Erosion of trust

3.2. Cross-Consistency Refinement

CCA-based pruning was implemented by excluding every full configuration that contains any blocked state-pair listed in Supplementary Table S2A. Applying these constraints to the unfiltered configuration space |Ω| = 4⁵ = 1024 removed |⋃ V_i| = 331 configurations (computed by exhaustive enumeration; Supplementary Table S2C) and yielded N = 693 internally consistent candidate scenarios. This refined scenario library forms the basis for the archetype grouping in Table 2 and the subsequent case instantiation in Table 3.

Table 3. Case instantiation: single-state taxonomy vectors.

Case ID	Case Context	Scenario Vector (Actor, Tactic, Medium, Target, Objective)	Archetype Alignment
C1	IRA (2016)	(State actors, Disinformation, Social media, General public, Polarization)	A1
C2	ISIS (Telegram)	(Non-state groups, Propaganda, Private messaging, Specific communities, Decision manipulation)	A2
C3	Biden Robocalls	(Non-state groups, Deepfakes, In-person/offline, General public, Decision manipulation)	A3-like

Note: Case C3 is labeled “A3-like” because it matches the A3 mechanism (synthetic media), while differing in the dominant actor attribution.

3.3. Risk Scoring Instantiation Template

To illustrate how the risk scoring logic defined in Equation (2) is applied in an auditable workflow, we provide a case-level instantiation template for Case C3 (AI-voice robocall). In a deployed architecture, each component c_k(C3) is derived from normalized outputs of upstream modules. For example, c₁(C3) (match confidence) is derived from the confidence output of the modality-appropriate forensic detector for the observed medium (e.g., an audio authenticity or spoofing-detection score for voice calls). c₂(C3) (reach and velocity) is derived from dissemination volume and time-to-peak metrics normalized against historical baselines for the same channel. c₃(C3) (coordination and automation) is derived from indicators such as automated dialing infrastructure and repeated template patterns. c₄(C3) (content-harm potential) is derived from harm taxonomies (e.g., impersonation of a public figure and electoral interference). c₅(C3) (target sensitivity) is derived from the sensitivity of the affected population and timing (e.g., proximity to an election event). The auditable evidence sheet provides traceable descriptors for Case C3 (Supplementary Table S3B) that support component selection and analyst justification. Because this study does not collect private platform telemetry, we do not report point estimates for c_k(C3) in this paper. The case-level score is computed by applying Equation (2) subject to Equation (3), where each component c_k(C3) follows the quantitative standards defined in Section 2.4.3. Table 4 summarizes the case-derived indicator profiles and response playbook mapping.

Table 4. Case-derived indicator profiles and response playbook mapping.

Case ID	Key Indicators Extracted	Response Playbooks Surfaced
C1	Exposure scale: ~32 M users; skew toward partisans [13].	(1) Narrative monitoring; (2) Coordination detection; (3) Rapid verification.
C2	Join-link dissemination; interlinked channels [14].	(1) Metadata analysis; (2) Disruption actions; (3) Community interventions.
C3	Synthetic voice; caller-ID spoofing [15].	(1) Forensic verification; (2) Telecom traceback; (3) Public warning templates.

4. Discussion

4.1. Interpreting the Framework

The framework provides an intermediate level of abstraction between high-level cognitive warfare doctrine and individual case studies. It operationalizes concepts from NATO and academic literature into a machine-readable format. For instance, Archetype A3 aligns with findings that deepfakes increase uncertainty and reduce trust [16], necessitating distinct media-forensic defense levers.

However, the landscape is evolving rapidly. Sobb et al. [17] argue that modern threats emerge from complex cyber–physical–social systems (CPSS), where digital influence spills over into physical consequences. Our framework addresses this by incorporating the “In-person and offline dissemination” medium, but the rise in Generative AI (GenAI) poses new challenges. López-Borrull and Lopezosa [18] highlight that GenAI acts as a double-edged sword: it lowers the barrier for creating scalable disinformation while simultaneously offering new tools for detection. Our “AI-assisted operator groups” category (Table 1) specifically anticipates this shift, but future iterations of the model must account for the speed and volume of GenAI-driven campaigns.

4.2. Contribution to Scenario and Foresight Methods

The relationship between domain knowledge, the morphological scenario space, and AI functions is conceptualized as a three-tier structure. Figure 3 illustrates this layered integration, showing how expert-driven domain knowledge (Layer 1) is structured into a machine-readable scenario space (Layer 2), which then drives the AI-enabled monitoring and response functions (Layer 3).

Figure 3. Three-layer integration framework bridging domain knowledge, morphological structuring, and AI-enabled defense functions.

This layered perspective clarifies that domain experts primarily shape Layers 1 and 2, while data scientists implement Layer 3. This aligns with the call by Marsili [19] for a historically grounded yet technologically adaptive definition of cognitive warfare, ensuring that new tools (like our AI architecture) remain rooted in strategic understanding.

4.3. Policy, Operational and Ethical Implications

AI-enabled cognitive defense interacts with evolving regulatory frameworks. However, a critical structural weakness in current defense postures is the organizational separation of technical cybersecurity from psychological defense. Sobb et al. [17] define the need for “Responsible Resilience” in such systems—a capacity to absorb and recover from shocks.

The EU AI Act, for instance, introduces a risk-based classification of AI systems and explicitly designates certain manipulative uses as “unacceptable risk” [20]. Legal scholars argue that these provisions reflect an emerging commitment to protecting cognitive freedom [21]. Public-sector reviews also emphasize that radicalization prevention efforts require proportionate, context-sensitive interventions [22]. The proposed risk scores are designed to trigger human review rather than automated takedowns, ensuring accountability [23] and preserving democratic values [24] against the ‘militarization of the mind’ [8]. This human-centric approach is essential to avoid the ethical pitfalls of automated censorship while maintaining the speed required to counter AI-driven threats, as emphasized by Babaei et al. [25] in the context of deepfake detection evolution.

4.4. Limitations and Future Work

This study has several limitations. First, the “one state per dimension” rule of GMA is a simplification. Second, the framework is conceptual. Third, the coding was performed by a single author, though mitigated by test–retest validation. Finally, the taxonomy relies predominantly on English-language literature and Western doctrinal perspectives, potentially limiting its applicability to non-Western information environments [26]. Future work should focus on dynamic adaptation. As noted in recent studies on deepfake detection [25], adversaries continuously evolve their techniques to evade detection. Therefore, the static morphological matrix should evolve into a dynamic threat modeling system that updates its states and blocked pairs based on real-time threat intelligence. Further cross-cultural studies [27] are also needed to expand the taxonomy’s applicability.

First, the evidence base may reflect English-language and Western reporting and publication biases because domain screening prioritized 2018–2025 English sources (Supplementary Table S1). This can skew which actors, platforms, and doctrinal framings are more visible, and may under-represent regions where influence operations are documented in other languages or primarily via non-academic outlets. Second, the current morphology is intentionally bounded and therefore static at any single release: it provides a transparent state space for scenario generation and playbook mapping but does not by itself guarantee timely adaptation to emergent tactics, platforms, or norms. To mitigate this, the framework should be operated as a versioned library: periodic evidence refreshes, explicit change logs for added/removed states and constraints, and re-validation of pruned pairs against updated source corpora.

4.5. Human-in-the-Loop Triage: False Positives, False Negatives, and Mitigation

A scenario-driven early-warning system can fail in two directions. False positives arise when high-salience signals (for example, viral content, satire, or legitimate political messaging) are misclassified as influence operations, leading to wasted analyst attention or inappropriate escalation. False negatives arise when operations are low-volume, tightly targeted, or routed through channels with sparse observables, causing genuine manipulation attempts to be under-prioritized. To mitigate both, we treat scenario labels and indicators as decision-support rather than automated adjudication: (i) require auditable evidence snippets for each dominant label, (ii) separate “risk scoring for prioritization” from “ground-truth attribution,” (iii) maintain an analyst rationale log and periodic error review, and (iv) use conservative thresholds when observability is limited, prompting additional collection rather than confident dismissal.

5. Conclusions

This paper addressed the growing urgency of cognitive warfare by proposing a conceptual framework that bridges the gap between high-level military doctrine and technical cybersecurity operations. By applying GMA, the study derived a coherent library of 693 plausible threat scenarios and demonstrated the feasibility of an AI-enabled response system through case-based instantiation.

The key contribution of this work is the transition from reactive, siloed defense measures to a proactive, integrated resilience model. As demonstrated in the governance analysis and the three-layer integration model, effective defense requires not only advanced algorithms but also a structural transformation in how organizations perceive and manage cognitive threats. By integrating insights from cyber–physical–social systems and Gen AI impact studies, this framework offers a robust foundation for future cognitive SOCs (security operations centers).