The Psychology of Phishing: Why Smart People Fall for Dumb Tricks

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about how social engineering is masterful at exploiting people and how we can address human behavioral vulnerabilities. And I'm going to be talking with Simona Banerjee. Simona is the founder and director of the MindShield Institute, which conducts cyberpsychology research and develops cognitive security frameworks. Simona is also an international speaker on behalf of security and victimization. Welcome, Simona. Thank you for coming and talking with us today.

Thank you so much for having me here, Matthew. Really such a pleasure to—

Well, social engineering is such a major problem in our industry. And depending on the metrics we look at, it's between 60% and over 90% of the attacks somehow interact with the wetware, the human, and take advantage of their vulnerabilities. So why is, in your mind, social engineering such this major problem? And how are hackers really exploiting the vulnerabilities of our human mind?

You know, social engineering has been around since the history of humanity. It has just changed its forms and how the channels with which it's being delivered. You know, back in the day before the internet really existed, You had posters and flyers being put out with various information. You know, you had things carved on stone that built a certain narrative for the people within a town or a city to gain understanding and access to what was going on and the information that was going on, be it in a political scenario or, you know, in various different departments of the city, including war. And One of the best ways to control the narrative was to be very curated about how that information was being rolled out and who had access to what information. And it's kind of always been the practice of control over narrative in such a way that it exploits some very fundamental evolutionary heuristics that humans have. In order to keep them in a certain state of mind or trigger and elicit a certain behavior that otherwise could either be good, it could be used for good as well. But in the context of social engineering, as we're talking about today, is used to the benefit of threat actors and at the detriment of the person. So given the fact that over the last 30,000 years, the human brain hasn't really changed, you know, we, we, we still fall for the same fear factors. We still experience anxiety. We still have all these emotions that are the same emotions that we had when we were cavemen. It's so easy to actually manipulate that because it's not changed for so long. The only difference now is that threat actors are able to use the cyberspace and the tools that the internet has provided us to really curate and to be more targeted to not just a population but to an individual, right? And that targeting is now, you know, be it through AI, be it through just normal news or social media, it has increased in its potency. And this is the best way to commit any kind of attack, right? Because it goes under the radar. It can be done anonymously. It's the cheapest form of an attack really. And there is no real defense against it. So if I was a hacker or if I was someone who wanted to cause disruption within an enterprise or even just within a civilization, social engineering is the way I would go about it. Instead of just using other forms of tactical hacking, like technical hacking. So I don't know if that answers your question, but that is why I'm so fascinated.

You're saying that this is based on manipulation of information and this has been around since the beginning of mankind probably. And so it goes back to our, as you said, kind of caveman brain, right? The foundations of many of the base emotions and mental structures that we have. Now, our technology has evolved very quickly, but it sounds like our human brain at its base levels hasn't evolved at that same pace, right? For that same kind of breadth of communication that our technology has. And that's where that vulnerability is. No matter where we have our technology, typically there's a human somewhere in the scenes as part of a cog in the system. And if that's targeted with base, again, base emotions, base fears or doubts or opportunities, what have you, love or whatnot, we see all sorts of different attacks. That's how you're going to be able to undermine the entire system. So yeah, and you mentioned it's cheaper than anything. It's easy. And the bottom line, it works, right? I mean, it works. So these hackers, and I guess previously we would have called them criminals or fraudsters or whatever, because back in the day they were trying to steal your coin or your assets or your children or whatever it is. They've moved into cyberspace. So how can we now outmaneuver them knowing that it's going against kind of our base interests, our base functions in our brain? And yet they have this access and this breadth through the technology that we develop. How do we outmaneuver them?

You know, that's a billion-dollar question, right? If you have the answer to the question, we have sorted out a lot of things. Um, I do want to talk about what you just said about the rate at which technology has been advancing and then the rate at which the human mind or the human brain has been evolving, which the disparity has increased, right? So if you look at Friedman's research, he shows this graph with what we call like the human adaptability curve. One of the beauties as well as I guess the downsides of how humans think is that we think linearly, right? We learn linearly, we think linearly, we think in like 1 1 2, 2 1 3, That's even how we grow, like that's even how babies grow. So if you look at the, the graph that he has created, he shows human adaptability as a linear process. And then he shows how technology has been advancing just at the attribute of having double the number of microchips every 2 years, right? Which is why we have been able to see this exponential curve with the technology. So if you see the technology advancement curve, and then you see human adaptability, there is a gap that is constantly increasing, and that gap is called technological debt, right? So this concept of technological debt is really important because, you know, when we are deciding our policies, we're deciding how to design technology, this has to be at the center of it. Technological debt is the ability of humans to adapt to technology in a way that actually benefits humans. And that debt is the lack of our ability to do so. And that is what's increasing. And there are multiple, there are multiple layers that we really need to target in order to start decreasing that debt. First thing is education. Right? I mean, when we say education, we all know that there are some pretty big limitations to how our current education system is set up. But I don't know if the full throttle consequence of this disparity in our education system is really being, is really being researched in terms of how the more we wait before we actually start educating people, on these technologies, such as AI, especially emerging, like exponential technologies like AI, this disparity is going to increase. And the more this disparity increases, the harder it's going to get to catch up. So, you know, I'm not— I used to have a very existential phase looking at what the endpoint could be, where we reach a point where we can never catch up, right? So in— there's a, there's a a hypothetical moment in time on this graph of exponential technology where it becomes perpendicular, right? It goes straight up. And that is called, it's a hypothetical scenario called the singularity, the moment of singularity. And at that moment, technology just duplicates itself and it becomes so hard for us to keep up with it that all moments post that point of time become unpredictable. And once we have hit that stage of unpredictability, I don't know what's going to happen. There are one of two ways it can go, and not to be existential, but to me, I see it as either self-annihilation of our species or immortality, right?

Um, it's a little dark, but okay, sure, let's, let's put that on one end of the spectrum.

Yes, let's move back to— let's wheel it back to currently. But the thing is, you know, even though it's dark, it can be just as light. It's really just about what we do with it. We can start reducing that gap, but that gap, it has to start now. And it starts from education. It starts from how we're designing the technologies. It starts from maybe taking a step back and seeing if the space of technology development is needed. Because right now, what is driving it? It's competition, really, right? The reason that regulation and slowing things down are looked down upon in my, in my perspective is because companies are competing against companies, countries are competing against countries, and whoever has the upper hand in having the most advanced technology will win the, you know, I guess, world power or the Third World War or whatever we want to talk about it. And I think because we are approaching technology from this paradigm, everything else is being shoved away. So ethics boards are being dismissed, right? Ethical guardrails are being broken. Policies are taking forever to actually develop. People are not actually pushing for it either. There's no funding. It's so hard to get funding for ethical technology or for nonprofits that are trying to push policy. And that's because the incentives and the economic incentives to move fast and break things is just much higher. That's just the reality of what it is right now. That needs to change. And there are some ways we can, but it's gonna take a movement and a critical mass of people to actually switch that narrative.

So that's a very systemic point of view, right? Okay, it's at the government, the national, the international level. Let's kind of take it to the other end, right? Normally when I'm talking about cybersecurity, I'm, you know, I'm thinking, okay, enterprise business, employees, vendors, things of that sort. But I think you touched on something important that, you know, these cognitive and behavioral vulnerabilities in cyberspace with people, it affects not just companies, right? It affects individuals. In fact, you know, I heard you, you know, have a talk and you were discussing how it affects children and our inability to help them. Have the proper cognitive defenses puts them in a position of being an easy victim. And as parents, you know, we teach them, this is how you cross the road. Why? Because we know traffic is bad and, you know, use the crosswalk and everything else. You know, don't talk to strangers. Don't get in the van with the person that says they are looking for a puppy. Right? All those things. This seems to be a norm for a parent. And yet when we get into this cyberspace issue, it just seems like a void that parents either don't have the guidance or there's not the expectation or they don't have the tools to prepare their children to defend themselves or prepare young adults or just everyday consumers. I mean, in your mind, how pervasive is this problem? Am I just being overly paranoid because I'm a security guy? Is this real? Is this something that we need to be talking about more and addressing? What are your thoughts?

Absolutely. I don't think that this problem is overrated, 100%. In terms of how pervasive it is, you know, it differs based on which regions we are looking at. Obviously, countries where technology is slow to be adopted have less of this issue, but countries, especially first world countries, like we're seeing in Australia and North America, obviously, and even in India, this problem is increasing pretty rapidly. It's kind of like, you know, you want to teach your kid how to swim, right? So you take them to classes and then you put them into the water slowly and you have like, you first hold onto the railings and you learn to hit your legs before you actually deep dive into the deep end, right? But we are in this situation where there are, you know, different categories of parents. There are parents who understand swimming so well because they work in the cyberspace, they work in IT, they understand technology. But because they understand technology so well, might have a harder time actually breaking it down to some of its most simplest forms. To start handholding a kid from step one. So these parents might, and I'm not saying all, but these parents might just give this technology to their kids, maybe teach the kids on how to use it, but more technically on how to use these things without maybe having the time or the right methodology to help the child navigate the dangers that will come with it. And then you have the other extreme of parents who kind of just don't really use these technologies. So these parents have never swum in this pool ever, and the kids are just kind of jumping into the pool and the parents don't know how to train the kids because they don't know how to swim. The kids are just jumping in because all their other friends are in the pool. What makes we— makes us believe that the kid, the probability that this kid is going to drown is not high, right? Um, so we really need this intermediary body, and we really need to change the paradigm around how, uh, digital literacy for kids is even being looked at. So there's a, there's a cyber psychologist, her name is Jocelyn Brewer, she's in Australia, and, um, she has this concept called digital nutrition, right? And she talks about how we should be treating, we should be treating kids with the same level of robustness and training as we would treat them before they enter the driving phase, before they enter behind the wheel on a car, right? If you have a license to handle a vehicle, why would we not have a license to handle a platform that literally changes your behavior, your mindset, your emotions, your productivity, your learning, everything? So I think that paradigm shift is really needed. And another thing that we really need to shift out of is this idea that of abstinence from technology, because I see that being pushed in policy a lot. There are a lot of books that have come out that talked about taking phones away from kids. And even though that might temporarily solve a problem, it's not going to solve the bigger issue, which is eventually they're going to be on their phones and eventually you're not going to be there to protect them. In that time, if they have not really had the chance to be eased in into that, or that's not been normalized for them, it's kind of the same as drinking, right? In America, the drinking age is what, above 21, as opposed to 18, right? Now, when you increase the drinking age to 21 because you abstained You know, you've caused an abstention. It doesn't stop kids from drinking in college. Kids are still drinking in college. They're just drinking without their parents knowing.

No.

With no support system.

Definitely not.

No, definitely not. It's just the reality of things. Kids will do what kids do. They will, they use these technologies because their whole lives, their entire social world is on these technologies. Taking it away does not help. We have to train them. To use them in a mindful way. That's the only way forward. So education really needs to take responsibility for this, bringing in digital intelligence, digital citizenship, digital literacy, media literacy. I mean, media literacy is kind of different. We're talking about something a little different, but digital intelligence, which we can go into, but that really needs to be part of schooling systems almost as, as general as math, right? Like no one questions why we have math in school. It's because you're going to use these skills all through life. It's the same thing with digital intelligence. It needs to be as fundamental as math.

So you had mentioned Australia, and what do you think of the recent law that they just passed in regards to social media where they're saying that for children, children are not going to be allowed to use social media platforms until they reach a certain age? And they just enacted this. I mean, on the one hand, it now gives a certain amount of time that the parents will have as well as the school system, education system, whatever, to help train and prepare. But on the other hand, it's also basically forbidding them from using it until they reach a certain age. Where does that fit in kind of your paradigm? Is this a good model? Is this something that needs to be modified? Is this a horrible model?

What do you think?

Let me throw this question back at you. At what age?

So you want to go to Australia sometime soon and you don't want to get kicked out. Okay. Yes. Throw it back at me.

At what age would you be comfortable or have been comfortable with your kids using social media?

And again, for me, I'm paranoid. I'm paranoid. I do want them to learn early, right? And I introduce them kind of like what you were talking about nutrition. There's a certain foundation. My children know, for example, if we actually take nutrition, right? When we're deciding what to eat for dinner, they know they have to pick a protein, a carb, and a vegetable, right? They already understand. They understand why, right? The vegetables provide minerals and the protein provides, you know, the building blocks for muscle and they need— they're growing and the carbs provide energy. And so they understand it at that level. I address, at least with my children, the same thing when it comes to social media. Do I want them to automatically be on Instagram and I have no visibility of what they're doing or who they're connected to? And they're age 7? No, I don't. It's a matter of gradual introduction. And in the beginning, it's more oversight. And then as they show that they have those skills, they're not going to be manipulated in horrible, horrible ways, right? They're able to report that back. And there's a level of trust there. Then we expand it more and more and more. And again, that's just my methodology. I'm in no position to criticize other parents, right? But for me, it's that building nutrition to allow them to. And honestly, if I've got an 11-year-old that I don't think is ready and yet all their friends are on social media, They are going to get on social media. They're going to go around me. However, if there's a law and the social media platforms are also making it really difficult, they can't make it impossible, but they can make it really difficult. Maybe not all their friends are going to be on social media. Maybe there isn't that peer pressure. Maybe they have other means that have better security, oversight, controls, whatever. That may help me as a parent. In the long run. So I'm okay in, you know, in Australia saying, "Hey, 13 years old, anybody younger than 13 cannot be on social media," right?

I'm okay for that because I see the potential impact. Just like I'm okay in the government saying, "Hey, you need to be at least 18 years of age to drive a car. Oh, by the way, you have to pass a written test, you have to pass a driving test." And actually here in California, you have to have a certification that you had training with an expert. To train you and they've signed off on you, right?

Yeah, I kind of like that because I'm on the road, my children are on the road. So yeah, this not only in my mind helps the potential victims, but it also helps curb the potential bad behaviors of those kind of in the gray area, right?

They're not getting online to be malicious, but if they see that's what's going on and that's what's pool, they may be encouraged to be part of that malicious pool, right?

So I think it helps on both sides, in my opinion, but that's just me.

No, I think you bring up some really good points. And, you know, I don't disregard this policy of age restriction. I don't just like disregard it altogether. However, I do think there are some issues that it actually does not solve for, right? So for example, one, age doesn't always equal maturity, right? When we're talking about age restriction, there is, you know, usually it's a 16, 18, 21. These are the 8 or 14, 16, 18, 21. These are the age domains based on what are these ages selected? It would have to be based on some hypothesis that an 18-year-old is less susceptible to being manipulated than a 13-year-old, right? Now, if you take a step back and we think about it from a general scale, sure, a 13-year-old might be more easily manipul— you know, suggestible than an 18-year-old. But if you actually look at the data, of what makes someone susceptible to manipulation. There's so many other variables that are, that are at play, one of them being maturity. A 13-year-old or 14-year-old could be more mature because they have just experienced a life of maybe some hardship, or, you know, or been educated in a certain way that the 18-year-old has not. So when we look at— and then obviously added to that, you put in what is the environment that they're building. Okay, so maybe in Australia It's restricted. But now what if this child is a part of some international group, right? Maybe they're volunteering or they were invited for some exchange in London for, for some kind of a project. They are going to have friends in different parts of the world. We are living in a global civilization now. And they are going to eventually meet people and have their friends be online. That's where so much of even education is taking place. With Roblox and a lot of these other technologies and platforms coming up, right? So at what point do we tell a kid that, no, just because you're living in this country, you cannot use social media until this age? Because apparently there is some statistic that says at this age, suddenly your, your prefrontal cortex has developed enough, which is, by the way, not completely proved either. Uh, the prefrontal cortex actually keeps developing all the way to 25, 26, maybe even 27 years of age. So even this arbitrary 21 number is very arbitrary, right? Which is why people can enroll in the military in the States at 18 and handle guns and maybe give their life for the country, but not have a beer. It doesn't completely make sense. So I think the current policy is being pushed as maybe a little band-aid, maybe something to slow it down. But I think it's still coming from an old paradigm. Which is not solving the problem. And again, social engineering, it's not just kids it's targeting, it's young adults, it's late teens, people who are in their rebellious stage, people who, when they're trying to break out of their childhood identity, trying to rediscover themselves in the world, this is 21 to 24, 25 years of age, you know, that is when that's happening. So if they're still not being taught to be resilient from a young age and already It's almost like a mental filter that needs to be imbibed. The earlier we catch them and train them, the better it actually is because it becomes a natural part of their process when they grow up. It's very hard the older you grow to actually build in new thinking processes, right? Like your neurological circuits have developed in a certain way. We need to catch them when neuroplasticity is high, and that is age 5 and 6. That's what I mean. That's how I look at it. That's where the training needs to start. And maybe, maybe there are different tiers of access to social media. Maybe the different kinds of social media platforms, right, that don't have— it is not based on posts or does not have the same kind of algorithms. But this whole age restriction thing, controversial opinion, I think it's still— it's deflecting the responsibility of where the problem lies back on the parents and some age restriction policy, not on how the algorithm is being designed, how the platform itself is being designed, right? It's still deflecting it out away from the companies that are designing these platforms. So maybe it solves a little bit of a problem, but I actually think it's creating a false sense of security. And also, kids are rebellious. You know, just because the parents— it's like porn, right? Like, there's an age restriction to porn. No one really go— and you can just lie, and you can just use your older brother's, you know, whatever, like you use someone else's ID and get on. It doesn't stop people from using it, right? It only creates a false sense of security, and it creates more ignorance with the family because they don't know that their kids are using it, which is even more dangerous. So yeah, I feel like it's more complicated than that. Like the solution has to be far well thought out more than just an age restriction.

It doesn't solve the problem. So I'm hearing a couple of themes here. And so I'm going to take it back to the cybersecurity. Okay, how do we get our employees not to click on things and whatnot? And, you know, a couple of common themes that I'm hearing you talk about is education, right? It's that literacy, right? That awareness. And the other thing that you mentioned is the platform design, which I would also include, you know, user interfaces and things of that sort.

So from a cybercrime perspective, how do we get adults, whether they're employees or just regular adults, right? How do we get them to be better hardened, patched? I mean, what do we—

I don't even know what we call it. I know in a technical term we say if there's a vulnerability, you patch it. But, you know, with you, how do we get them to a better state than what they are now? Because now they're being victimized really, really well. How do we increase their resistance?

So there are phases to this, right? The first phase is building awareness, right? Before we can even start, we need to understand what these vulnerabilities are. So be it organizational awareness and individual awareness of, okay, what exactly are my cognitive vulnerabilities? And there are different categories of cognitive vulnerabilities, be it emotional, be it cognitive overload, distraction, be it social influence and pressure, self-esteem, financial desperation. There are, there's so many different categories. So now, first thing is sitting and figuring out, okay, what aspects of my life make me most vulnerable cognitively, right? The second phase is, okay, how do we patch that and train you against it? There are specific mental processes that can be trained for, which are exactly when they're untrained is what's tapped into and baited by psychological operations. It's what's being manipulated. For example, cognitive biases, situational awareness, focus and attention. And each of these actually, for example, focus and attention, right? You know how many people when I've interviewed them and they're, they're offenders because they clicked on phishing email simulations, right? They talk about how they know the technicalities of what a phishing email is and like that this happens. But the state of mind that they were in when they happened to click it was distraction. There was just so many things going on. They were so distracted that it was a split-second thing when they clicked on it before they realized, right? So it's the technical knowledge about something does not build the resilience. Because the whole point of social engineering is the fact that you override logical analytical thinking and you move into emotional reactivity, right? So no, no matter how much logical analytical information I have, the whole point is to override that and, and harness my emotional reactivity. So we have to target emotional reactivity. So attention and focus, situational awareness, threat perception levels, like how Often, or what is someone's idea of threat perception? How high is that? Like, how likely am I to actually be a target versus how likely am I not, right? Other like mental operations like memory, long-term memory, short-term memory, that plays a role as well as cognitive biases that we talked about it. And we also have something that's very fundamental, which is emotional regulation. Right, because fear, urgency, anxiety— these are the three things that are the emotions that drive max, most effective behavior change, especially from a manipulation standpoint, social engineering standpoint. So how do I— how am I able to detect that, oh, this is causing me a sense of fear? It brings in another aspect of this cognitive training, which is somatic intelligence. Right? Understanding and being tuned to the fact that you're feeling an emotion. It is something so simple, but it's something that people just— we are just never trained. So many of us just don't even know how to identify what emotion we are feeling at any given point of time. So we can actually train somatic intelligence to sense that, oh my God, I'm feeling the sense of anxiety and fear, and it's coming from someone like pressurizing me. As soon as I can sense that, I'm like, wait, Why am I, why am I feeling this? And that can actually build like a red flag in the brain and be like, hmm, I shouldn't be feeling this, maybe something is off, right? And that's how I have been navigating the last so many years also with like a lot of scams that I've gone through. So there's that. And then there's in terms of just base technical, obviously understanding of how these vulnerabilities are baited, right? So you can go on and start learning more. I think these are very specific topics that are actually what social engineers use to hijack people's minds and emotions. And for whatever reason, instead of training them on patching those vulnerabilities, we're patching all the other vulnerabilities that lie out there except those. And again, like, this is not rocket science really. It comes down to some very fundamental things, and we have the knowledge. It's just, it needs to be readapted and educated and scaled. I really do believe that that's the solution.

Let's talk about that. I love how you're breaking it down, and I'm trying to apply that into organizations, right? And I hear all sorts of criticisms. Oh, we have to do security training once a year. Nobody pays attention to it. Everybody hates it. You know, it doesn't change any behaviors. We still have problems. I've seen really bad behavioral training programs in organizations and they're a complete waste of time. They're absolutely, no doubt about it, a waste of time. Have not changed behaviors. Nobody even watches them, right? They just click it and go get a cup of coffee and okay, they're done. I've also seen on— Yeah, yeah. But I've also seen really good, and I've led really good behavioral modification and empowerment programs that have made a significant measurable difference in both preventing as well as detecting and responding to social engineering attacks. So there's this huge spectrum, right? And we're always limited by budget and time and the amount of impact we can have. This friction that we introduce. Can you give some examples in your history where you've seen good programs that did help improve the behavioral or cognitive defenses of an employee base? And what did they do? What were their key focus points or metrics that really contributed to make you think that, wow, this is, this is good, this is effective?

So I would say that I have actually not experienced that from a cybersecurity standpoint specifically, but building behavior change and cognitive resiliency in other aspects of life. I have experienced, um, because for a long time, you know, I was focused on the mental health industry, right? How people act in one way is how they act in all other ways, right? So if someone is succumbing to social pressure to make a certain decision, for example, um, be it the decision to get married or the decision to in, in the moment of time, they, you know, they don't want to go out because they know they need to do something, but there's social pressure, so they go out. Small everyday life things, right? Um, I've been part of coaching programs. I've also been a life coach myself, so, you know, I've, I've, I've seen that if you can take someone's, um, natural predisposition and map out for them what their current state looks like and what their future state could look like and show them that the gap to getting what they really want— because at the end of the day, no one's really happy with the cognitive vulnerabilities they have. People know that they have, they just don't know what to do about it, right? Um, so if you can map and show them that the gap is only this much, there are actual behavioral things they can do. So for example, Be it— again, this is neuroscience, this is a different paradigm— so, um, writing, right? So as soon as you feel— like, I had a thing with a, um, a rubber band where as soon as you feel like the social pressure coming and it's pushing you to do something you don't want to do, like, snap your rubber band. Just that motion can be an anchor point. The idea is to create an anchor point for people when they are experiencing something and they realize they're acting out of a pattern versus getting them out of it and then making a conscious decision instead. So the whole problem with what we are talking about with social engineering is people are acting out of a pattern, right? The intention and conscious awareness is low. They're acting unconsciously, right? The idea is to move them from that, which is also called Systems 1 thinking, If you like thinking fast and slow, to move into systems 2 thinking, which is moving to intentional action. And most people actually just need that one anchor point to snap them out of an unconscious movement or an unconscious action into a conscious state. And as soon as they're there, they change the decisions. They change it like that, right?

Yes, absolutely.

Yeah. So moving someone from the systems 1 to systems 2 using some anchor. Maybe that anchor is drink a glass of water. So for example, um, you know, this has happened in, in high stress situations when, when you are being— you're being pressurized, or like you are having a conflict with someone. Um, this is just even from a professional standpoint, something that is an anchor point that I've had people do is just pause and drink a glass, drink a full glass of water. Something as simple as that changes that person's narrative. Now they've associated a flight fight with feeling thirsty and drinking water. Once they're drinking water, it gives them— it triggers that anchor point. So now they can change and be like, you know, otherwise I would have been aggressive and been triggered and acted like this, but now I can choose to consciously deal with the situation in the ways that I want.

So it's a mental pause. Yes, give them mental pause.

Anchor point. And I think that many things like this can be used in, in mass scale within organizations to create that behavior change. And the other thing is, you know, you mentioned why current cybersecurity training is usually so bad is because there is no relevance established. Like, why should someone care about it? Even in the narrative, in the story, it's all about, oh, "Help your IT department protect your organization against cybercrime." I just joined this company. I care about how much you pay me.

That's not my job, right?

Exactly. Why should I care? And if you're starting with not establishing any relevance or any incentive for them to care, of course it's not going to be effective. So the narrative in how we are even educating, it needs to change to start aligning cybersecurity and organizational goals with personal goals, right? As soon as you— if you tell me that, hey, you've been working for 40 years of your life, you could wake up one day in the morning and your bank balance is at zero.

Why?

Because you clicked on one email. That can happen to you. And this is how we would prevent that from happening to you.

Yeah, right.

Once you train them with that, I mean, and I don't mean fearmongering, I mean actual real relevance.

Yes. It needs to be relevant. Absolutely.

Exactly. Then their actions will speak for themselves and then it will just, you know, whether it's the organizational email or their personal email, because that's the other thing. Most people do cybersecurity awareness training and they have like a stick on their, on their shoulder when they're in the office and then they go home and they forget everything and they're just back to acting out of their normal heuristic. Right? And that's where social engineers attack a lot of people on their personal devices, on their personal emails and social media. So this whole, the whole paradigm around how cybersecurity, the relevance that establishes how it makes people care about it really needs to change. And it's so funny because we are teaching them behavioral change, but it seems like it's not being designed with a lot of behavioral change principles.

We're not doing it well, you know, and that goes for everything you want to teach somebody. If you want to teach a child math, you actually have to teach them the relevance. Well, why do I need to know addition? Why do I need to know subtraction? I don't need to know that. Well, yeah, you do. And you explain why you're going to use it for the rest of your life. This is once you've established that, right? And for my kids, well, you've got to count out how many pieces of candy you're going to have for dessert. Oh, well, no, now I need to know math. Yes. Right? But if we don't establish relevance, it goes in one ear and out the other.

Right?

And the other thing that you touched on, I think that is so important that we often forget that should be a goal as part of these programs is not just an individual change, but a culture change.

Yeah.

It's not just one person you have to train, you have to train everybody and they will then self-reinforce each other.

It becomes the norm. And, you know, culture eats policy every day, right? And so if you can build that into your culture, they understand why it's relevant. They're empowered, right?

And, you know, I hate it when security is always the bad guy. You know, security in my mind shouldn't be the cop. And if you do something bad, they're going to hit you over the head with a nightstick.

No, right?

When I work with organizations, and I'll tell them, everyone's going to make a mistake. You, me, everybody is. But if you make a mistake, give me a call. I'm not going to yell at you. I'm not going to fire you. I'm not going to scream at you. You're not going to get demoted, right? I want you to call even if you think you might have made a mistake. Maybe not. I'd rather have those 20 calls and look at it and go, no, no, everything's fine. You did okay. Versus the one time something bad did happen and you didn't call because I know addressing it early on, I can contain it. I can reduce the impact and you can be part of that. Right? So building that culture of not only doing the right thing, but if you make a mistake, that's okay. Just alert people, right? Be part of the solution instead of being fearful. And if you build that culture, foundation of relevance, just as you're talking about, I think now you are on a track to train and sustain that capability because you're going to have people rotating in and out of your organization. That's the way it is. But if they come at that new hire comes in and they're seeing some of the training and they're going, "Oh, this is cybersecurity stuff." And they look at their peers and all their peers go, "Yeah, that's our job too." They're going to go, "Oh, well then it's my job too. Well, okay, I better pay attention." Okay, now there's an expectation, right? So yeah. Okay.

I do want to jump. Okay. What?

Yeah. I wanted to just add to what you said. The incentive models are what drive culture, right? Like, if someone— usually, you know what, like, when someone has experienced something traumatic, or say abuse, their first thought isn't to go to a cop, it's to go to a friend or a guide. Someone helps them and supports them, not someone who's going to be they would be reprimanded. And that reprimanding might just be because they have to go through all this paperwork and then they have to do this and they have to do that, right? Right now, the way security is seen, I think, in companies is that it's that disciplinarian with a stick.

Yeah.

As opposed to someone or a department that's there to support you and help you stay safe, right? And then in terms of even just the incentive model, the fact that you make 3 mistakes and you could be fired for that, that increases, is actually causing a negative feedback loop because A, it increases just the general anxiety around clicking on anything, which might work. It might work 100%, but it does not propel security culture. What propels security culture is the carrot approach, the incentive approach, maybe being recognized for, or, actually incentivize or even non-monetary compensation, you know, ways to, to reward someone for taking a step that protected the security of a company, be it even just reporting a phishing email, right? Like, make it exciting for people. Make them want to like find it and keep an eye out for it because it gives them something of value to do that as opposed to just being punishment. So 100%, I agree with you. I think, and there are, there are ways we can change culture and incentives. I know that's something that you've been working on, um, for, you know, for years in terms of building culture to change behavior within companies and with CISOs. So it can be done. We just need to— we— so it can be systemized and scaled, and we can just show that that is a better way of saving company millions in losses due to social engineering.

100% agree, right? And you mentioned scalability, which leads kind of to my next question, right? With GenAI and DL and ML, everything kind of flooding in and all of these tools do help scalability and do help greater reach and analysis and so forth. What do you think the impact of AI, either as a benefit to behavioral security or as a detriment to behavioral security, you know, what do you think we're going to see in the next couple of years?

It's definitely going to be both, right? AI is going to be used to highly target social engineering. And remove the human from actually even being the social engineer, because AI can just learn from our patterns so fast and it can scale the amount of phishing emails and all of that, right? Even phishing and all of that. Like, it removes the human from the threat actor equation, making it harder to actually detect who's behind a certain attack. So it's definitely going to be used in that direction. And AI can be used to also detect malicious AI. However, I do feel like the protector is always going to be slower than the threat actor just because of all the red tape and the even the access to the technology that, you know, we have to go through in order to like build something that goes through all the approvals and compliance and that they have already like iterated 5 times. Threat actors have already created items by the time something has been done like here.

Yeah.

So it's gonna be this constant race. And that's because even be it an AI doing this or a human doing this, the vector that it's attacking is the same, which is human cognition, right? The only thing that can understand human cognition at its deeper levels and can actually create change is the human. Maybe AI can be used to assist, right? So with MindShield, that's what we're looking at, right? We're looking at how we can incorporate an AI assistant or like, you know, someone like Iron Man's Jarvis kind of a thing that can highlight things for you that, hey, this is making you experience a certain emotion, or hey, this might be, you know, hooking onto this cognitive vulnerability. Cognitive vulnerability you realized you had, right? What you choose to then do with the information is your choice. I think this is another really important thing we need to like mediate when we are using AI in the picture, which is where does the control lie in the final decision, right? Like, is the AI making choices for me or is it guiding me to then make a final choice? Does the autonomy and the control lie in the hands of a human or in the hands of the AI. Maybe there's a part of it that lies in the hands of the AI. But when it comes to, again, scalability of solutions through social media or, you know, an AI deciding like, you know, you should see this comment or you should not see this comment or, you know, whatnot. I think that there is a level of dependency that we might build on these technologies to do things which might not always be beneficial because it's ridden with bias. And it can hallucinate and it does not understand the complexities and the variables that build a human being, right? I might want the negative feedback on my social media because I'm okay getting that feedback because it's helping me grow and learn and navigate as opposed to someone who it'll harm profusely. So, you know, we need to make sure that how we're designing AI maintains autonomy and control with the human. And only acts as a guide. And that is— I think it's the human at the end of the day. We have the power. It's honestly not been that difficult to switch our paradigm to learning what our vulnerabilities are and then highlighting and getting— building awareness of when it's being, um, baited. I think it takes no more than, you know, obviously based on your age, right? But like, if you catch someone young, it takes no more than 6 to 8 months of training to really change how someone acts out of emotional reactivity. So I think, you know, even in India, this is— it's a part of practice, right? So when we, um, when we do yoga, you know, or we do breathwork, or like that whole aspect of the culture, it's all based to just increase emotional response and reduce reactivity. That can be trained. That's trained in kids at a young age, very easy to do. We just need to do it. We need to care enough to do it.

Action, action.

Okay.

So, it leads to my last question then. And again, a lot of my followers and viewers, they're cybersecurity leaders or cybersecurity professionals. And this, you know, social engineering has been just the bane of our existence. It's easier to put into technical control than actually modify the behaviors and the culture and everything else. If you had to give one actionable item, right, to a cybersecurity listener right now, how should they improve or what specific step can they do to improve the cognitive defenses of their workers or even just individuals, right, in protecting themselves and their children? What one practical step practical piece of advice would you give them to act?

Yeah, I think it's two things. One, we're building an assessment to assess an individual's, someone's cognitive vulnerability. Take the assessment so you can assess either your or your family's vulnerabilities or even within the organization. It's anonymous, like from a data privacy standpoint, like we're fixing all of that, right? First, build awareness of what makes your organization vulnerable.. And then from that information, you know, there is training on exactly if you have a high vulnerability because of attention focus, maybe your workforce is way too distracted. Maybe you have way too many notifications going and 1,000 tabs open on every laptop or whatever, right? Or some emotional influence is high or social influences are obedience influences high because the culture in your company just seems to be such that no one challenges authority, right? So maybe have someone play devil's advocate for, for every meeting, right? So there's so many steps that can be taken to curb every different dimension of vulnerability. First, see what makes your organization or your employees and your workforce cognitively vulnerable. When you see that literally on a map, you can then pick and choose the different combinations of training and practices to patch those vulnerabilities. And obviously right now, you know, we're, we're learning about this. You know, cyber psychology is a new field and it's an iterative field and it's an exciting field. But we do believe a lot of the solutions here exist over here. We just need to put them in practice and then see what the results are. And chances are the results are going to be good because I know that you have also implemented a lot of behavioral changes you know, and workshops like that in your domain. And it has obviously had positive impact. So build awareness on what's going on and what the weaknesses are and then train to curb and patch those weaknesses. It's really not that— it's really not that complicated. We just need to do it.

It resonates even in the cybersecurity world, right? Because the first thing you said is do that risk assessment. This is what we do. I mean, you know, okay, though, that makes a lot of sense. Do the risk assessment, but it's not for the technical side. It's really for those behavioral aspects and potential vulnerabilities and weaknesses and things that can be taken advantage of, those mental structures. So it's a different risk assessment than we normally do. But yes, risk assessment, number one, typically what we do, and then build that training program, put in your controls at the, at the wetware level, not the software or hardware, but at the wetware level and get them in place. So that makes That makes so much sense. So, you know, thank you, Simona, for all your insights today. Very, very much appreciated you chatting with me today.

Thank you so much. Thank you so much, Matthew. And I do believe that cognitive security as a layer above technical cybersecurity is going to be the— it's going to be what revolutionizes cybersecurity for the future. I'm excited to see where it goes.

I absolutely agree. Simone Banerjee is the founder and director of the MindShield Institute. Check out the webpage for insights, resources, and practical recommendations to improve your cognitive security. The link, I'll put the link in the description. And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Simone here to dive into the most relevant and interesting cybersecurity challenges perspectives, and best practices. We'll see you next time.