From 8f3153c99b68416815ff3e6eb00f397c53e388a6 Mon Sep 17 00:00:00 2001
From: mblanke <mblanke@gmail.com>
Date: Wed, 24 Dec 2025 12:50:54 -0500
Subject: [PATCH] Define analyst user model

---
 terminology/USER_MODEL.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 terminology/USER_MODEL.md

diff --git a/terminology/USER_MODEL.md b/terminology/USER_MODEL.md
new file mode 100644
index 0000000..b96e139
--- /dev/null
+++ b/terminology/USER_MODEL.md
@@ -0,0 +1,12 @@
+Primary user: Cyber analyst
+
+Assumptions:
+- Technically competent
+- Time-constrained
+- Prefers density over whitespace
+- Values consistency over novelty
+
+Mental model:
+- Scan → filter → prioritize → act
+- Severity drives attention
+- Confidence drives trust