When Assurance Distorts Judgment: How Cybersecurity Governance Shapes Expert Cognition Under Digital Uncertainty

<span>Organizations invest heavily in formal cybersecurity assurance mechanisms such as audits, compliance reviews, and structured reporting lines to reduce uncertainty and strengthen control. Yet it remains theoretically underexplored how these governance structures may inadvertently reshape executive risk cognition under persistent digital uncertainty. Moving beyond trait-based accounts of overconfidence and optimism, this study theorizes <i>assurance-induced cognitive distortion</i> as a governance-level mechanism through which formal assurance architectures attenuate experiential learning signals, elevate perceived control, and systematically miscalibrate executive judgment. Drawing on survey data from 144 CISOs, CIOs, and senior cyber leaders across medium-to-large organizations, complemented by exploratory expert interviews, we examine how variation in assurance intensity and governance design relates to confidence calibration and optimism in cyber-risk assessment. The findings indicate that audit-intensive environments and the absence of experiential simulations are associated with elevated overconfidence, whereas governance structures that position the CISO outside the IT function are associated with lower overconfidence. By identifying how cybersecurity governance architectures can unintentionally distort executive judgment, this study advances strategic information systems research by shifting attention from individual cognitive dispositions toward the structural design of assurance systems and their implications for adaptive cyber capability under digital uncertainty.</span>