All 100 indicators / Category 7.x: Stress response
Indicator 7.4
Measures vulnerability to systematic avoidance of security decision-making during high-stress situations, creating dangerous delays that attackers exploit
Flight response avoidance manifests when security personnel systematically avoid making critical security decisions or confronting security issues during high-stress situations, instead deferring, delegating, or delaying action. This psychological pattern creates dangerous security gaps because attackers exploit the decision delays and avoidance behaviors to maintain persistence and expand their access during the crucial early phases when containment would be most effective.
Polyvagal Theory (Porges, 2011) shows flight response represents activation of the sympathetic nervous system's mobilization branch when social engagement fails. Seligman's Learned Helplessness Research (1972) demonstrates that repeated exposure to uncontrollable stressors leads to generalized avoidance behaviors. Cognitive Load Theory (Sweller, 1988) shows excessive cognitive demands lead to systematic avoidance of complex tasks as a protective mechanism against cognitive overload.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Security decisions consistently made within 4 hours during incidents, clear escalation paths with documented authority at each level, security personnel regularly attend incident meetings (>90% attendance), delegation follows documented procedures with clear handoffs, complex issues have defined resolution processes with timeframes, no observable pattern of decision delays during high-stress periods, and authority conflicts resolved through documented processes within 24 hours.
Security decisions delayed 4-24 hours during incidents, escalation paths exist but authority boundaries unclear in some scenarios, security personnel attendance at incident meetings inconsistent (70-90%), some delegation occurs without clear procedures, complex issues sometimes delayed beyond necessary analysis time, occasional patterns of slower decision-making under stress, and authority conflicts sometimes require external intervention to resolve.
Security decisions delayed >24 hours during incidents or indefinitely postponed, unclear escalation paths or authority boundaries for security decisions, frequent absence from security meetings or incident response (<70% attendance), regular informal delegation without procedures or accountability, complex issues routinely deferred or avoided rather than resolved, consistent patterns of decision avoidance during high-stress situations, and authority conflicts remain unresolved or create ongoing security gaps.
Implement decision trees and automated workflows that provide clear action steps for common security scenarios
Deploy decision support tools that reduce cognitive load during stress situations, include automatic escalation timers and pre-approved response procedures that eliminate decision paralysis, create clear action paths for different security scenario types
Create explicit authority matrices defining who can make what security decisions under various circumstances
Document clear authority levels for all security decision types, define escalation timeframes, establish alternate decision-makers to prevent bottlenecks, include emergency authorization procedures
Conduct regular incident response simulations that progressively increase complexity and stress levels
Build team tolerance for high-pressure security decisions through graduated exposure, include scenarios requiring difficult business conversations and authority confrontation, practice decision-making under increasing stress conditions
Implement tracking systems that monitor security decision latency and alert when decisions exceed established timeframes
Deploy automated monitoring of decision timelines, create dashboards showing decision patterns and bottlenecks, implement alerts when decisions exceed timeframes, enable identification of avoidance behaviors before security impact
Establish paired decision-making for high-stress security situations
Require two personnel to jointly approve action plans for complex scenarios, reduce individual anxiety about making wrong decisions while ensuring decisions still get made promptly, create buddy pairings with complementary skills and stress responses
Develop pre-authorized response procedures for common security scenarios that eliminate in-the-moment decision requirements
Create pre-approved response procedures for common security scenarios, include business impact pre-approvals and stakeholder communication templates, reduce decision friction during incident response