Throughout my career, I have had the opportunity to participate in a wide range of cyber exercises. Most recently, I took part in a large-scale multinational exercise. As a strong advocate of situation awareness, one design choice consistently stands out across these environments: time compression.

Within a limited exercise window, blue teams are exposed to a dense sequence of attacks, incidents, and coordination tasks — far more tightly packed than in real-world operations. The reason is practical: very few organizations can afford to run multi-week exercises. Compression is necessary.

The Challenge

Time compression comes with a cost—especially when viewed through the lens of developing situation awareness. When time is compressed, two recurring challenges emerge:

• Operational actions are not supported by a unified situation picture
  The cycles required to build a comprehensive situation picture are simply too slow, particularly when teams are dealing with multiple urgent issues simultaneously.

• Operational awareness and reporting drift apart
  Decision-making and reporting become separate activities. They are often weakly connected — or even contradictory.

Why Does This Happen?

A useful starting point is Mica Endsley’s model of situation awareness in dynamic systems, which I have referenced in several previous blogs. Endsley (1995) defines situation awareness as a three-level process:

1. Perception of relevant elements
2. Comprehension of their meaning
3. Projection of future states

In cyber operations, we often assume that improving visibility (Level 1) will naturally lead to better understanding (Level 2). In reality, this transition is fragile — and highly sensitive to cognitive load.

This is where Nelson Cowan provides critical insight.

Cowan (2000) demonstrates that the human focus of attention is limited to roughly 3–5 meaningful units (“chunks”) at a time. When the number of incoming stimuli exceeds this limit, the ability to process information meaningfully degrades rapidly. Time compression directly increases the rate of incoming stimuli, eventually leading to cognitive saturation.

In Endsley’s terms:

• Level 1 (perception) may still function — data is visible
• Level 2 (comprehension) collapses — meaning cannot be formed
• Level 3 (projection) becomes nearly impossible

In Cowan’s terms:

• The number of active elements exceeds the capacity of attention
• The system cannot maintain a coherent internal representation

Under high time compression, teams are forced — implicitly — to make a trade-off:

Either act fast, or understand deeply — but not both at the same time.

This is not a process failure. It is a cognitive constraint.

To cope, teams naturally reduce complexity:

• They narrow the time window they consider
• They focus on a subset of signals
• They ignore or postpone broader synthesis

In effect, they reduce the size of the “situation” to something that fits within human cognitive limits.

A Question for Exercise Design

First, it is important to remember that the goal of these exercises is not to avoid hitting a wall, but to understand how hard we will hit it. Pushing teams to their limits is intentional and necessary.

However, it would be interesting to explore whether reducing time compression by slightly extending the duration of exercises, could bring operational awareness and reporting closer together. Another option would be to introduce a more tightly integrated exercise track that explicitly incorporates strategic decision-making.

This could enable training for more prolonged, long-term conflict scenarios, rather than focusing solely on isolated critical incidents.

References

• Endsley, M. R. (1995). Toward a Theory of Situation Awareness in Dynamic Systems. Human Factors.

  https://doi.org/10.1518/001872095779049543

• Cowan, N. (2000). The Magical Number 4 in Short-Term Memory: A Reconsideration of Mental Storage Capacity. Behavioral and Brain Sciences.

  https://doi.org/10.1017/S0140525X01003922