Emotion AI &
Defence Security Glossary
Key terms in facial Action Unit analysis, FACS methodology, deception detection, insider threat, and defence security technology. Definitions written to support procurement, technical integration, and policy review.
Published by Cavefish Ltd · Cardiff, Wales · Last updated April 2026
30 terms · A – V
A numbered facial muscle movement defined in the Facial Action Coding System (FACS). Each AU corresponds to a specific muscle or muscle group. For example, AU1 is the inner brow raise; AU4 is the brow lowerer; AU12 is the lip corner puller. EchoDepth analyses 44 FACS-compliant Action Units per frame in real time, mapping their combinations to emotional states in VAD space.
A security measure in which a computer network or system is physically isolated from unsecured networks and the public internet. EchoDepth supports fully air-gapped on-premise deployment via Docker containers with zero external data transmission, no telemetry, and no outbound network calls — making it suitable for SCIF and other classified environments.
The activation dimension of the VAD emotional model, measuring the intensity of an emotional state on a scale from calm and low-energy to excited, agitated, or highly activated. High arousal combined with negative valence is associated with states such as fear, anger, and stress — key signals in deception detection and operator readiness assessment.
The individual emotional and behavioural profile established by EchoDepth over time for each monitored person. Baselines are built per-individual from historical session data, enabling anomaly detection that is calibrated to the person rather than a population average. Behavioural deviations from baseline trigger anomaly scoring in SIEM and alerting workflows.
Technology that characterises an individual by their behavioural patterns — emotional, physiological, or movement-based — rather than fixed physical characteristics such as fingerprints or iris patterns. EchoDepth operates within the facial behavioural biometrics category, characterising the emotional and cognitive state of a known individual rather than verifying their identity.
The total mental effort required to process information and perform a task at a given moment. EchoDepth detects elevated cognitive load via AU combinations associated with brow tension (AU4, AU7), eyelid strain (AU46), and reduced micro-expression frequency. Excessive cognitive load is a precursor to operator error and a key metric in Human Reliability Assessment.
The structured evaluation of whether a person's statements are truthful, using physiological or behavioural indicators. EchoDepth provides a FACS-grounded, camera-only credibility assessment capability as an alternative to polygraph — producing timestamped per-question stress, suppression, and deception indicator output with confidence weightings.
The identification of involuntary physiological and behavioural indicators correlated with deliberate misrepresentation. EchoDepth uses 44 FACS Action Units to surface suppression, stress, and deception markers per question, producing timestamped structured JSON output for intelligence and legal review. It does not claim to detect lies; it surfaces involuntary physiological correlates.
The third dimension of the VAD emotional model, measuring perceived control, power, or influence in a situation. Low dominance is associated with submissiveness or vulnerability; high dominance with confidence and control. The dominance dimension adds important context to valence and arousal readings, distinguishing fear (low valence, high arousal, low dominance) from anger (low valence, high arousal, high dominance).
Defence and Security Accelerator Technology. A UK Government programme supporting the development and adoption of novel defence and security technologies. EchoDepth produces DSAT-compatible audit records, structured to meet MoD and UK Government technology documentation and assurance standards.
EchoDepth's real-time processing engine, responsible for frame-level AU extraction, VAD mapping, and anomaly scoring. EchoCore achieves approximately 700ms end-to-end latency from video frame input to structured JSON output, suitable for live interview sessions and real-time operator alerting.
The automated identification of emotional states from facial expressions, voice, text, or physiological signals. EchoDepth implements camera-based facial emotion recognition using 44 FACS-compliant Action Units, operating without wearables, physical sensors, or specialist hardware beyond a standard RGB camera.
A comprehensive taxonomy of facial muscle movements developed by Paul Ekman and Wallace Friesen in 1978, refined through four decades of peer-reviewed research. FACS defines numbered Action Units corresponding to specific muscle activations. Because FACS is grounded in anatomy rather than subjective emotion labels, it is the most scientifically defensible foundation for emotion recognition AI, and the basis of EchoDepth's entire processing pipeline.
Continuous detection of cognitive or physical fatigue via AU patterns associated with drooping eyelids (AU46), reduced blink rate, lowered arousal, and decreased micro-expression frequency. EchoDepth applies fatigue monitoring to UAS (drone) pilots, SOC analysts, control room operators, and intelligence reviewers — providing pre-mission readiness scores and live alerting when fatigue thresholds are breached.
Governance, Risk, and Compliance. A category of enterprise platform managing organisational governance frameworks, risk assessment, and regulatory compliance. EchoDepth integrates with GRC platforms via REST API, feeding emotional engagement and anomaly data into compliance workflows and audit records.
A core methodology in NATO and MoD frameworks for evaluating the probability of human error and fitness to perform safety-critical tasks. Traditional HRA is conducted at a point in time using structured interviews and task analysis. EchoDepth extends HRA into the real-time domain, providing continuous, objective emotional readiness and cognitive load scoring without requiring self-disclosure from the subject.
A security risk originating from within an organisation — typically a current or former employee, contractor, or partner with authorised access to systems, facilities, or data. The Ponemon Institute estimates the average cost of an insider incident at £3.2 million. EchoDepth surfaces emotional behavioural anomalies — elevated stress, suppression patterns, arousal spikes — that precede insider incidents before they manifest as digital events.
The delay between an input event and a system's corresponding output. EchoDepth achieves approximately 700ms end-to-end latency from video frame capture to structured emotional state output — sufficient for live interview credibility assessment and real-time operator readiness alerting without perceptible delay.
A platform used to deliver, track, and manage training programmes. EchoDepth integrates with LMS platforms to provide real-time engagement and comprehension scoring during mandatory training sessions, producing objective evidence of whether training content is being retained rather than merely attended.
A brief, involuntary facial expression lasting between 1/25 and 1/5 of a second, often representing suppressed or concealed emotions. Micro-expressions involve genuine muscle activation despite the subject's attempt at a neutral or controlled expression. They are a key signal layer in EchoDepth's deception detection capability, identified via rapid AU activation and neutralisation sequences.
National Cyber Security Centre. The UK Government body providing guidance and support on cyber security threats. EchoDepth is aligned with NCSC security principles for biometric data handling, access control, and audit logging.
A deployment approach requiring no physical attachment of sensors or devices to the subject being monitored. EchoDepth is non-contact — it requires only a standard RGB camera at minimum 720p resolution. Existing CCTV, interview room cameras, or laptop webcams qualify. No infrared, no thermal imaging, no wearable sensors.
A deployment model in which software runs on hardware located within an organisation's own facilities rather than in a cloud environment. EchoDepth deploys fully on-premise via Docker containers, with no cloud dependency, no telemetry, and no outbound network calls. UK data residency is the default for all on-premise deployments.
The pre-mission or real-time assessment of whether a person is cognitively and emotionally fit to perform a task safely and effectively. EchoDepth provides objective, camera-based operator readiness scoring for UAS (drone) pilots, SOC analysts, control room operators, and intelligence reviewers — using fatigue, cognitive load, and arousal AU indicators.
A device that measures peripheral physiological indicators — respiratory rate, skin conductance (galvanic skin response), and blood pressure — as indirect proxies for anxiety during questioning. The US National Academy of Sciences concluded in 2003 that polygraph lacks scientific validity for security screening, with false negative rates as high as 47% in controlled studies. EchoDepth provides a FACS-grounded, camera-only alternative. See: Credibility Assessment.
EchoDepth's deepfake detection module. Analyses AU temporal coherence to identify synthetically generated video. Genuine facial expressions show characteristic temporal patterns in AU activation — onset, apex, and offset sequences. Synthetic video generated by diffusion models and GAN architectures produces detectable deviations in these temporal patterns, enabling POKERFACE to flag manipulated footage.
The replacement of directly identifying information with artificial identifiers (pseudonyms), such that the data can no longer be attributed to a specific individual without additional information. EchoDepth applies pseudonymisation to biometric data by default, as required under UK GDPR for biometric data processed in security contexts. Role-based access controls govern who can re-identify pseudonymised records.
Representational State Transfer Application Programming Interface. A standardised approach to exposing system functionality over HTTP. EchoDepth exposes a REST API for integration with SIEM, LMS, C2, and other platforms — delivering structured JSON emotional state output with ISO 8601 timestamps, per-AU breakdowns, and confidence weightings compatible with standard SIEM alert schemas.
A secure room or area certified to process classified intelligence in isolation from external networks and the general public. SCIFs are subject to strict physical and electronic security requirements. EchoDepth is fully SCIF-compatible: it deploys on-premise via Docker with zero outbound network calls, no cloud dependency, no telemetry, and no external API calls — making it suitable for classified facility deployment.
A platform that aggregates and correlates security event data from across an organisation's infrastructure — logs, network traffic, endpoint alerts — to identify threats and support incident response. EchoDepth integrates with SIEM platforms including Splunk, Microsoft Sentinel, and IBM QRadar via REST API and WebSocket, feeding the human-layer emotional signal into existing security infrastructure.
A category of security platform that automates the collection of security data and responses to low-level security events. EchoDepth integrates with SOAR platforms, enabling automated triage workflows to be triggered by emotional anomaly alerts — for example, flagging an operator for secondary review when EchoDepth detects a significant deviation from their established baseline.
The deliberate or involuntary inhibition of emotional expression. Suppression produces characteristic AU patterns — partial muscle activation followed by rapid neutralisation — detectable as a deception and stress indicator. EchoDepth identifies suppression via temporal AU sequencing, distinguishing it from genuine neutral expressions where muscle activation does not occur.
A category of security tool that monitors digital behaviour patterns — file access anomalies, off-hours logins, lateral movement — to detect insider threats and compromised accounts. UEBA monitors the digital layer; EchoDepth monitors the human emotional state that precedes it. The two systems are complementary: EchoDepth integrates directly into SIEM and UEBA platforms via REST API, providing the pre-digital human-layer signal.
The UK version of the General Data Protection Regulation, governing the processing of personal data including biometric data. Biometric data used for identification or emotional analysis is classified as special category data under UK GDPR. EchoDepth processes biometric data with pseudonymisation by default, role-based access controls, full audit logging, and all data processed within UK borders.
A three-dimensional framework for representing emotional states developed by Mehrabian and Russell (1977). Valence describes positivity/negativity; Arousal describes activation intensity; Dominance describes perceived control. EchoDepth maps combinations of 44 FACS Action Units to VAD space, producing quantified, structured emotional output per frame rather than a simple discrete emotion label.
The positivity or negativity dimension of the VAD emotional model, ranging from very negative (distress, anger, disgust) to very positive (joy, contentment, excitement). Negative valence combined with high arousal is characteristic of fear and stress states — key indicators in operator readiness, insider threat, and deception detection contexts.
A communication protocol enabling real-time, bidirectional data transfer over a persistent connection. EchoDepth supports WebSocket output for live integration with operator dashboards, alerting systems, and SIEM platforms — delivering emotional state updates at approximately 700ms latency without the overhead of repeated HTTP requests.
See how these capabilities apply to your environment
Technical briefings available for defence procurement, CISO, and intelligence teams. NDA available. Air-gapped demo on request.