All 100 indicators / Category 3.x: Social influence
Indicator 3.2
Measures vulnerability to attackers who exploit commitment/consistency principle to escalate from small initial requests to major security compromises
When organizations make small initial security exceptions or commitments, cognitive dissonance creates psychological pressure to maintain consistency with prior decisions, enabling attackers to progressively escalate access, privileges, or policy violations through foot-in-door techniques and sunk cost exploitation.
Cialdini's commitment/consistency principle (2007) - humans have deep desire to appear consistent with prior actions. Festinger's cognitive dissonance theory (1957) - psychological discomfort when reversing previous commitments. Staw's escalation of commitment research (1976) - sunk cost fallacy drives continued investment in failing courses. Sharot fMRI studies (2010) show reward pathway activation when maintaining consistency, creating neurological pressure against reversal.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Automated exception sunset policies with mandatory review cycles. Security investments evaluated independently regardless of sunk costs. Vendor access boundaries enforced with escalation pattern detection. Decision revision protocols explicitly protect course corrections. Regular audits identify and terminate escalating exception sequences.
Some exception review processes exist but inconsistent enforcement. Security decisions occasionally reference prior commitments. Vendor access monitored but escalation patterns not systematically detected. Limited ability to reverse previous security decisions. Informal awareness of sunk cost bias.
Strong cultural pressure to maintain consistency with prior security decisions. Sunk cost fallacy drives continued investment in ineffective security tools. Vendor access creep normalized as 'relationship deepening'. No systematic review of escalating exceptions. Security decisions defended based on prior commitments rather than current threat landscape.
Technical controls that automatically expire security exceptions on predetermined schedules, requiring independent re-justification for renewal
Deploy exception lifecycle management platform with automated expiration workflows (30/60/90 day cycles based on risk). Exceptions auto-revoke unless re-justified independently of prior approval. Integration with access control, firewall, PAM, and policy enforcement systems. Alert stakeholders 7 days before expiration with re-justification requirements.
Systematic tracking and enforcement of vendor access scope boundaries with automated detection of escalation patterns
Define explicit access boundaries for each vendor relationship in vendor management system. Implement automated scope monitoring that flags expansion requests. Calculate ESI for vendor access sequences. Require independent risk evaluation for scope expansion ignoring prior access grants. Monthly vendor access boundary audit reports.
Independent effectiveness evaluation framework that explicitly counteracts sunk cost fallacy in security tool and initiative decisions
Quarterly security investment effectiveness review with explicit sunk cost bias awareness training for decision-makers. Independent evaluation criteria that exclude prior investment from continuation decisions. Documented decision revision protocols protecting employees who recommend discontinuation. ROI analysis based on current effectiveness, not cumulative investment.
Separate review teams that evaluate escalating access requests without knowledge of prior approval history to eliminate consistency pressure
Establish independent review committee for high-risk access requests that operates without visibility into prior exception history for same requester. Blind review process removes consistency pressure. Committee training on foot-in-door techniques and escalation exploitation. Quarterly rotation of review team members.
Automated calculation of Escalation Sequence Index (ESI) with alerting when commitment escalation patterns exceed thresholds
Deploy ESI calculation engine that analyzes exception requests, access grants, and policy violations for escalation sequences. Alert security teams when ESI > 0.2 AND Sequence_Length > 3. Pattern visualization dashboard showing commitment escalation chains. Integration with SIEM for correlation with other attack indicators. Monthly ESI reporting to security leadership.
Explicit organizational policies and psychological safety frameworks that protect and encourage course corrections when new information emerges
Formal decision revision protocol that celebrates adaptive security decision-making. Training programs on commitment escalation traps, sunk cost fallacy, and cognitive dissonance in security. Explicit protection policies for employees who reverse previous commitments based on new threat intelligence or audit findings. Leadership communication emphasizing that course corrections demonstrate strength, not weakness. Recognition programs for exemplary decision reversals.