We base all of our research on a deep understanding of the needs and work patterns of the people who will be the beneficiaries of our work. We achieve this through a formal investigative process known as a Cognitive Task Analysis, or CTA: the study of an individual or team’s mental processing, activities, and communications within a specific work context. 

A CTA elicits information from individuals about the thought processes they use in the course of completing specific tasks. It involves both observing individuals as they go about their work, and asking directed questions about the way in which they approach the problems, how they decide what step to take next, and the challenging tasks of their work. Because the focus is on the cognitive processes, rather than the mechanics of how tasks are completed in the current environment, the results tend to be less affected by tool bias. The output of a CTA is a detailed description of the tasks that an individual or team performs, the data on which they operate, the decisions they make, and the processes and activities (cognitive, communicative, and physical) that they engage in to reach those decisions.

Case Study - VIAssist

An example of a CTA in action is our development of VIAssist, our Visual Assistant for Information Assurance Analysts. The design of VIAssist was based on a CTA of during which we interfaced with more than forty Computer Network Defense (CND) analysts involved in some aspect of network security. They varied in level of expertise from novice to expert and represented a variety of job titles and work roles.  We used a combination of four knowledge capture techniques: structured interviews, observations, review of critical incidents, and hypothetical scenario construction. This last technique involved working with analysts to flesh out an imaginary analysis case including typical offensive actions taken by a sophisticated attacker and defensive actions by the CND analyst. The exercise allowed analysts to reveal the kinds of information they seek from available data sources, knowledge of adversary operations and techniques, and types of connections that analysts make between seemingly disparate pieces of information.