All 100 indicators / Category 6.x: Group dynamics
Indicator 6.2
Measures tendency for groups to make riskier security decisions than individuals would make alone, driven by diffused responsibility and social pressure to appear bold
Risky shift phenomena occurs when groups consistently make riskier decisions than individuals would make alone, driven by diffused responsibility and social pressure to appear bold or innovative. In cybersecurity contexts, this creates vulnerability when security committees, incident response teams, or cross-functional groups systematically underestimate risks or approve dangerous shortcuts that individual team members would reject. Organizations with heavy committee-based decision making show measurably higher rates of security incidents stemming from overly aggressive risk acceptance.
Stoner (1961) original discovery showing groups consistently chose riskier decisions than individuals. Myers & Lamm (1976) meta-analysis confirming effect across 316 studies with average effect size d=0.7. fMRI studies show reduced anterior cingulate cortex (risk monitoring) activation during group decisions with increased ventral striatum (reward seeking) activation when group members express risk tolerance.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Most security decisions made individually or with clear individual accountability; individual risk assessments consistently collected before group decisions; group decisions rarely exceed initial individual risk tolerance; strong culture of raising security concerns in groups.
Mixed individual/group decision-making with some accountability gaps; individual input sometimes collected; occasional instances of groups accepting higher risk than initially planned; security concerns raised but sometimes overruled by group consensus.
Predominantly committee/group-based security decision making; groups discuss risks collectively without individual input; regular pattern of groups escalating to riskier positions during meetings; group dynamics discourage raising security concerns.
Implement mandatory individual risk assessment completion before group security decision meetings
Each participant documents risk assessment, concerns, and recommendations 24 hours before meeting. Meeting facilitators review individual assessments and ensure all concerns are addressed during discussion. Create template for standardized individual risk documentation.
Assign rotating risk advocate roles to present worst-case scenarios and challenge group consensus
Create formal protocols protecting risk advocates from group pressure. Rotate role quarterly. Require documented responses to all risk concerns before finalizing decisions. Provide training on effective risk advocacy techniques.
Mandate 48-hour cooling-off periods for high-risk group decisions before implementation
Define risk thresholds triggering mandatory delays. During cooling-off period, any team member can request additional review. Create escalation process for decisions exceeding risk thresholds requiring external validation.
Deploy systematic tracking of group security decisions with outcome comparison
Create database tracking predicted vs. actual outcomes for all group decisions. Generate quarterly reviews comparing risk assessment accuracy. Implement dashboards showing patterns and success rates. Use data to calibrate future group decision processes.
Require specific individual accountability assignments for each component of group decisions
Create documentation showing individual responsibility for each implementation aspect and monitoring component. Implement performance metrics tracking individual contributions to group decision outcomes. Ensure accountability follows through implementation.
Establish tiered emergency decision protocols maintaining risk assessment rigor under pressure
Create pre-approved emergency response playbooks preventing ad-hoc risk acceptance. Define tiered protocols based on incident severity. Implement mandatory post-incident review of all emergency group decisions with formal risk assessment of actions taken.