All 100 indicators / Category 10.x: Critical convergent states
Indicator 10.10
Identifies organizational security states exhibiting path-dependent memory effects where current security posture depends on historical sequence of events rather than current threats
Hysteresis security gaps represent critical system-level vulnerability where organizational security states exhibit path-dependent memory effects - current security posture depends not only on present conditions but on historical sequence of security events and responses. This manifests as organizational 'stickiness' where security behaviors, policies, and threat perceptions remain anchored to past states despite changed circumstances.
Historical State Dependency - organizations develop security postures reflecting past threat landscapes rather than current realities. Institutional Memory Loops (Weick, 1995) - previous security decisions become templates for future actions regardless of environmental changes. Cognitive Path Dependence - decision-makers unconsciously weight historical security experiences more heavily than current threat intelligence. Sunk Cost Fallacy - emotional attachment to historical security investments prevents adaptation.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Security policies reviewed quarterly with documented threat landscape analysis. Formal process for deprecating outdated security tools and practices. Threat models updated semi-annually analyzing emerging patterns. Security investment decisions include formal current threat intelligence analysis (>50% weight). Incident response procedures updated within 30 days of new attack types. Security training addresses current threats (>40% recent content). Security architecture has documented change management tied to business evolution.
Security policies reviewed annually with some current threat consideration. Informal process for managing legacy security tools. Threat models updated annually with limited emerging threat analysis. Security decisions balance current threats with historical investments (25-50% current weight). Incident response updates within 60-90 days of new attacks. Security training includes some current threats (20-40% recent). Security architecture changes occur reactively.
Security policies reviewed less than annually or only for compliance. No formal process for retiring outdated security tools. Threat models unchanged for >18 months or focus on historical patterns. Security decisions based on maintaining existing investments (<25% current threat weight). Incident response procedures unchanged despite new attack types. Security training primarily addresses historical threats (<20% current). Security architecture maintained in historical configurations despite business changes.
Implement mandatory labeling system for all AI-generated communications
Deploy technical controls that automatically tag AI messages with clear identifiers. Establish verification requirements for any unlabeled communications claiming human origin. Create escalation pathway for communications that lack proper AI/human identification.
Develop 20-minute training module teaching employees to recognize and trust their 'uncanny' feelings
Include practical exercises using examples of legitimate vs malicious AI communications. Train employees to use verification protocols when experiencing psychological discomfort with digital interactions. Provide clear scripts for escalating 'something feels wrong' concerns to security teams.
Establish policy requiring verification through separate communication channel for any high-stakes requests
Implement technical system that automatically prompts verification for financial, access, or sensitive data requests. Create simple process for employees to quickly verify human identity through alternative means. Deploy phone or in-person verification requirements for unusual requests, regardless of source authenticity.
Create formal process for employees to report 'uncanny' or uncomfortable digital interactions without judgment
Establish security team response procedure for investigating ambiguous AI-human communications. Implement policy protecting employees who escalate based on intuitive concerns rather than technical evidence. Deploy rapid-response system for employees experiencing confusion about communication authenticity.
Deploy system to monitor patterns in employee responses to AI communications
Establish baseline metrics for normal AI interaction behaviors (response times, verification requests, escalations). Create alerts for unusual patterns that might indicate uncanny valley exploitation. Implement automated detection for communication patterns that typically trigger uncanny valley responses.
Deploy multi-factor verification system triggered by employee uncertainty reports
Implement biometric or behavioral authentication for video/audio communications when requested. Create technical controls that flag communications exhibiting uncanny valley characteristics. Establish secure verification codes or phrases for confirming human identity in suspicious interactions.