All 100 indicators / Category 3.x: Social influence
Indicator 3.5
Measures vulnerability to decision-making errors triggered by artificial scarcity, limited-time offers, and resource pressure that bypass rational security judgment
When humans perceive scarcity—whether of time, resources, or opportunities—cognitive capacity diminishes by the equivalent of 13 IQ points (Mani et al., 2013). This tunneling effect causes individuals to focus narrowly on the scarce resource while neglecting security considerations, creating exploitable pre-cognitive vulnerabilities through limited-time phishing, fake opportunity scams, and deadline-driven bypass requests.
Cialdini's Scarcity Principle (2007): Items become more attractive when availability decreases. Shah & Shafir (2012): Scarcity creates attentional tunneling and reduces executive function. Mani et al. (2013): Financial scarcity reduces cognitive capacity by 13-14 IQ points. Kahneman & Tversky (1979): Loss aversion causes losses to be weighted 2.5x more than equivalent gains. Neurologically, scarcity activates anterior cingulate cortex (error detection/urgency), reduces prefrontal cortex activity (rational planning), and triggers amygdala activation (fight-or-flight responses).
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Mandatory cooling-off periods enforced for urgent requests. Emergency access tracking with automated review. Pressure-based training teaches recognition of artificial scarcity tactics. Temporal discounting mitigations prevent deadline-driven bypasses.
Some deadline protections exist but inconsistently applied. Basic awareness of scarcity tactics but no mandatory pauses. Limited tracking of urgency-driven decisions.
No protections against deadline pressure or artificial scarcity. Culture prioritizes speed over security. Employees routinely bypass procedures under time pressure. No tracking of urgency-driven security decisions.
Implement technical controls enforcing waiting periods for high-risk decisions regardless of claimed urgency
Override requires dual approval with documented business justification and security review.
Comprehensive training program on psychological scarcity exploitation and cognitive tunneling
Teach employees to recognize: artificial urgency markers, loss-framing language, limited-availability claims, deadline manipulation. Practice scenarios with scarcity pressure. Explain cognitive science: -13 IQ point effect, 2.5x loss aversion, hyperbolic discounting.
Structured process for validating urgency claims before expedited processing
All urgent requests must answer: (1) What specific harm occurs if action delayed 24 hours? (2) Who can independently verify this urgency? (3) Has urgency been validated through separate channel? Document and track urgency validation accuracy.
Comprehensive logging and pattern analysis of urgency-justified security decisions
Log all urgency claims with: claimed deadline, business justification, approver, actual outcome. Monthly analysis: urgency claim accuracy, pattern detection for artificial scarcity, feedback loop to identify scarcity-based attacks.
Specialized protocols for requests using loss aversion tactics
Email gateway and communication analysis flagging loss-framed urgent messages ('or you will lose', 'account will be locked', 'access expires'). Flagged messages receive additional verification requirements. Employee training on 2.5x loss aversion multiplier.
Maintain security decision quality during high-pressure periods
Pre-identify high-pressure periods (quarter-end, tax deadlines, project launches). Deploy additional security support during these periods. Automated reminders of security requirements. Enhanced monitoring for deadline-driven bypasses.
Counteract tendency to devalue delayed security benefits
Reframe security verification as immediate protection rather than future benefit. Make verification process visible and rewarding (gamification, recognition). Reduce friction in verification workflows so delay is minimal.
Structured evaluation process for 'exclusive' or 'limited-time' business opportunities
All competitive opportunity claims requiring immediate action/information sharing must undergo: (1) Source verification through known contacts, (2) Business value assessment by stakeholders, (3) Security review for information requests. Track opportunity verification outcomes.