All 100 indicators / Category 10.x: Critical convergent states
Indicator 10.9
Identifies failure to recognize and manage interdependencies between security domains, creating cascading vulnerabilities when coupled systems interact unexpectedly
System coupling failures represent psychological inability to recognize and manage interdependencies between seemingly separate security domains. This vulnerability emerges from cognitive compartmentalization - the mental tendency to treat interconnected systems as isolated entities - serving a defensive function by reducing cognitive load but creating dangerous blind spots where vulnerabilities cascade through coupled systems.
Cognitive Compartmentalization - mental tendency to treat interconnected systems as isolated. Systems Theory (Perrow, 1984) - tightly coupled systems create unavoidable failure modes. Cognitive Load Theory (Miller, 1956) - limited working memory prevents comprehensive mental modeling of complex interconnections. Bion's Basic Assumptions (1961) - psychological defenses obscure system interdependencies. Neuroscience (Buckner et al., 2008) - brain's default mode toward simplified linear thinking.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Formal process for documenting system connections before implementation. Regular (quarterly or more) review of system dependencies. Standard incident response includes checking connected systems. Emergency changes have mandatory connection impact checks. Cross-team coordination required and documented. Network segmentation aligned with security boundaries.
Some documentation of system connections but incomplete or outdated. Occasional unexpected impacts from system changes (1-2 per quarter). Incident response sometimes includes connection checks. Emergency changes have informal connection considerations. Cross-team coordination happens but not consistently documented. Some network segmentation but enforcement gaps.
Little to no documentation of system connections. Frequent unexpected impacts from system changes (monthly or more). Incident response focuses only on directly affected systems. Emergency changes proceed without connection impact analysis. Teams work in isolation with minimal coordination. Flat network topology with excessive coupling.
Implement mandatory labeling system for all AI-generated communications
Deploy technical controls that automatically tag AI messages with clear identifiers. Establish verification requirements for any unlabeled communications claiming human origin. Create escalation pathway for communications that lack proper AI/human identification.
Develop 20-minute training module teaching employees to recognize and trust their 'uncanny' feelings
Include practical exercises using examples of legitimate vs malicious AI communications. Train employees to use verification protocols when experiencing psychological discomfort with digital interactions. Provide clear scripts for escalating 'something feels wrong' concerns to security teams.
Establish policy requiring verification through separate communication channel for any high-stakes requests
Implement technical system that automatically prompts verification for financial, access, or sensitive data requests. Create simple process for employees to quickly verify human identity through alternative means. Deploy phone or in-person verification requirements for unusual requests, regardless of source authenticity.
Create formal process for employees to report 'uncanny' or uncomfortable digital interactions without judgment
Establish security team response procedure for investigating ambiguous AI-human communications. Implement policy protecting employees who escalate based on intuitive concerns rather than technical evidence. Deploy rapid-response system for employees experiencing confusion about communication authenticity.
Deploy system to monitor patterns in employee responses to AI communications
Establish baseline metrics for normal AI interaction behaviors (response times, verification requests, escalations). Create alerts for unusual patterns that might indicate uncanny valley exploitation. Implement automated detection for communication patterns that typically trigger uncanny valley responses.
Deploy multi-factor verification system triggered by employee uncertainty reports
Implement biometric or behavioral authentication for video/audio communications when requested. Create technical controls that flag communications exhibiting uncanny valley characteristics. Establish secure verification codes or phrases for confirming human identity in suspicious interactions.