Cognitive Warfare Is Exploiting Polarisation. Here’s What Security Leaders Can Do About It.

By Dr Paul Wood

State-sponsored operations are no longer just stealing data or disrupting networks. They are degrading the way people think, and domestic polarisation is the attack surface.

When Russia’s Internet Research Agency ran its influence operations ahead of the 2016 US presidential election, it didn’t just promote one candidate over another. It ran Black Lives Matter pages and Blue Lives Matter pages simultaneously. The strategic objective was arguably less electoral than epistemic: degrading Americans’ ability to trust each other, their institutions and their shared sense of what’s true. By that measure, it was remarkably cost-effective.

This is cognitive warfare: the deliberate, state-directed exploitation of cognitive vulnerabilities to degrade a population’s capacity for rational collective decision-making. It is not propaganda in a digital wrapper. Propaganda tries to change what people believe. Cognitive warfare is more ambitious: it aims to degrade how people think. And the primary attack surface isn’t a network or a facility. It’s polarisation.

Understanding the Feedback Loop

The relationship between polarisation and cognitive warfare is a feedback loop, and security leaders need to understand its mechanics. Pre-existing social divisions (tribal identities, declining institutional trust, grievances that politics has failed to address) create structural fractures. Adversary operations then exploit those fractures through four primary techniques: injecting divisive narratives into already heated debates, exploiting platform algorithms to amplify emotionally charged content, fabricating the appearance of grassroots support for extreme positions and systematically delegitimising the institutions populations rely on for trustworthy information.

The result is deeper polarisation, which makes the next round of operations cheaper and more effective. The loop feeds itself. And the vulnerability is nonlinear: below a certain threshold of social trust, adversary interventions that would have bounced off a cohesive society instead produce cascading effects. I think of it as an immune system. A healthy society metabolises disinformation, while a polarised one amplifies it.

Three Adversaries, Three Strategies

Security professionals should understand that cognitive warfare is not a monolith. Russia, China and Iran each pursue distinct approaches shaped by their geopolitical positions, and the operational implications differ.

Russia is in the destabilisation business. Operating from a position of declining conventional military advantage, Moscow uses cognitive operations as an asymmetric tool to weaken adversary alliances and paralyse decision-making. The playbook is persistent: inject division, amplify grievances, erode trust. The 2024 Romanian presidential election, annulled after the constitutional court cited evidence of coordinated foreign interference via TikTok, illustrates how these operations can produce outsized effects in already-polarised environments, though the precise causal weight relative to domestic factors remains contested.

China takes a narrative-building rather than a disruptive approach. Beijing’s “Three Warfares” doctrine (psychological warfare, media warfare and legal warfare) represents a generational effort to reshape the international information environment in China’s favour. The targets extend well beyond Taiwan to include diaspora communities, Western academic institutions and international organisations. For security leaders managing global operations, this means that brand narratives, supply chain relationships and stakeholder perceptions in the Asia-Pacific region are all potential vectors.

Iran’s operations are more episodic and regionally focused, surging around flashpoint events. The sophistication is increasing, but the scale remains smaller. What all three share is that they exploit the same structural vulnerability: low institutional trust in target societies. Trust is the centre of gravity.

Why It Matters at the Organisational Level

Cognitive warfare may seem like a geopolitical abstraction, but its effects cascade into every domain security professionals manage. I see three operational implications.

Workforce vulnerability increases. Employees immersed in polarised information environments are more susceptible to social engineering, phishing and insider threat recruitment. The same cognitive biases that distort risk decision-making (confirmation bias, tribal reasoning, emotional rather than analytical processing) are precisely the mechanisms adversary operations exploit. An employee who has been primed by months of polarising content to distrust institutional authority is a softer target for social engineering than one who hasn’t.

Reputational risk escalates. Organisations that depend on public trust (financial institutions, healthcare systems, utilities, government agencies) are vulnerable to targeted disinformation campaigns that no cybersecurity investment can prevent. Deepfake technology and generative AI are lowering the cost of producing credible, contextually adapted attacks on organisational credibility. A fabricated video of a CEO making inflammatory statements during a period of social unrest is no longer a theoretical scenario.

Alliance and supply chain exposure grows. For organisations operating internationally, cognitive warfare’s effects on partner nations’ governance capacity and alliance cohesion create material risks. Polarised publics become susceptible to narratives that frame international partnerships as serving foreign rather than national interests, undermining the political foundations of cross-border cooperation.

Building Resilience: A Four-Pillar Approach

The temptation is to focus on detection: identifying and flagging adversary operations. That matters, but it addresses only the supply side. The more consequential challenge is reducing the demand: the organisational and societal vulnerabilities that give cognitive operations their purchase. Effective counter-strategy requires four pillars working together.

Invest in cognitive security. The Nordic and Baltic states offer the most developed models. Finland integrates media literacy across its education system and public institutions. Estonia has built rapid-response capabilities after years of Russian information operations. Sweden operates a dedicated psychological defence agency. Within organisations, this translates to embedding critical thinking and media literacy into security awareness programmes, treating cognitive resilience as seriously as cybersecurity hygiene.

Deploy prebunking at scale. A growing body of research, including recent meta-analyses pooling tens of thousands of participants, shows that pre-emptive exposure to weakened forms of manipulation techniques builds measurable resistance to subsequent manipulation, without making people cynical about reliable information. Several governments are already integrating these “inoculation” approaches into public communication. For security leaders, the practical application is workforce training that teaches employees to recognise manipulation techniques before they encounter them, rather than relying solely on content-based fact-checking after the fact.

Strengthen institutional credibility. Trust is the strategic centre of gravity. Organisations that have earned trust through transparency, accountability and consistent behaviour are harder to undermine. Those that haven’t are easy targets. Security leaders should advocate for organisational communication practices that build credibility reserves, because when a deepfake crisis hits, credibility is what determines whether stakeholders believe the organisation’s denial.

Prepare for AI-enabled escalation. Generative AI is lowering the barriers to credible cognitive operations. Deepfakes will become harder to detect. Organisations need detection capabilities, response protocols and crisis communication plans that account for sophisticated synthetic media. The World Economic Forum’s Global Risks Report 2026 ranks misinformation and disinformation second and societal polarisation third among global risks over the next two years, a clear signal of where the threat trajectory is heading.

Five Steps for Security Leaders

First, add cognitive warfare to your threat assessment. It belongs in risk registers alongside cyber threats and physical security risks, not siloed in a communications department.

Second, audit your organisation’s trust posture. Where are the credibility gaps an adversary could exploit? What narratives about your organisation already circulate in polarised online communities? Understand your exposure.

Third, extend security awareness training to include manipulation recognition. Programmes like prebunking (teaching people how manipulation works before they encounter it) have stronger evidence behind them than post-hoc fact-checking. Your workforce is the attack surface: train accordingly.

Fourth, develop synthetic media response protocols. Know who is authorised to confirm or deny organisational communications. Pre-position verification mechanisms. Run tabletop exercises for deepfake scenarios.

Fifth, collaborate across disciplines. Cognitive warfare doesn’t respect the boundaries between physical security, cybersecurity, communications and human resources. Enterprise security risk management frameworks should already emphasise convergence, and cognitive threats are one more reason it matters. Security leaders who can coordinate across these functions will be better positioned to identify and respond to operations that exploit organisational seams.

Cognitive warfare is not a distant geopolitical abstraction. It is a present-tense operational risk that targets the cognitive infrastructure on which every other security function depends. The organisations best positioned to withstand it will not be those with the most sophisticated detection technology. They will be those that invested in the institutional credibility, workforce resilience and cross-functional coordination that make manipulation recognisable for what it is.

ERG’s Human Factors Lab builds manipulation recognition into security awareness training, and ERG’s security culture work helps organisations make cognitive resilience part of how they operate.