Knock, Knock: Who Is There? Distinguishing Cyber Expertise Levels Using Psychometric and Cognitive Traits

Cyberattacks are increasingly complex, requiring defenses that account for attacker behavior rather than relying solely on technical controls. This study examines whether psychometric traits can distinguish cyber expertise levels thereby setting the groundwork for cyberpsychology-informed defenses. Data from three adversarial-behavior experiments ( n = 571) included risk propensity, cognitive reflection, decision-making competence, personality, affect, and performance on a weighted Cyber ATT&CK Test. Results show statistical significance in classifying populations and moderate negative correlations between expertise, risk propensity, and negative emotionality among advanced practitioners. Regression models were unable to produce an expertise predictor; however, multiple classification models successfully achieved up to 84% Mean AUC-ROC determining experts versus non-experts. Findings indicate that while no single trait predicts expertise, combinations of cognitive and demographic features could reliably differentiate expert attackers. This work provides a foundation for future research linking cognitive traits to attacker bias susceptibility and developing tailored, deception-based cyber defenses.