From Cyber Psychology to Intelligence Signals: A Framework to Support Security Decisions on State-Sponsored Transcontinental Attacks Within a Geopolitical Context

Abstract

This dissertation develops and evaluates the Weighted Indicator Scoring Matrix (WISM), a hybrid analytical framework designed to support anticipatory defender decisions in state-sponsored transcontinental cyber operations. The study addresses the limitations of technical-only attribution by integrating three dimensions of evidence: technical indicators, forensic cyber psychological indicators, and geopolitical indicators. Using a qualitative comparative case study design, the research examines Stuxnet, NotPetya, WannaCry, and Shamoon/Saudi Aramco as historically significant cyber operations linked to state or state-aligned actors. The methodology applies evidence-based scoring, source tier classification, and cross-case comparison to assess whether psychological and geopolitical signals can strengthen attribution confidence and improve defender readiness. The findings show that WISM adds value where technical evidence is incomplete, ambiguous, or deliberately obfuscated, especially by linking actor behaviour, strategic intent, timing, rivalry alignment, and signalling patterns. The dissertation contributes theoretically by extending forensic cyber psychology into defender-oriented cyber threat intelligence, methodologically by formalising multi-dimensional scoring, and practically by offering a structured decision-support process for security analysts and critical infrastructure defenders.