All 100 indicators / Category 8.x: Unconscious process
Indicator 8.10
Measures vulnerability to fantasy-based thinking in digital environments where users suspend critical evaluation and make security decisions based on emotional responses rather than reality testing
Digital environments function as transitional spaces—neither fully real nor fully imaginary—activating unconscious psychological processes that mirror dream states. Users apply dream-like cognitive processes (primary process thinking) where logical causality suspends, symbolic thinking dominates, and reality constraints relax. This manifests as immediate acceptance of impossible digital scenarios, anthropomorphization of AI systems, and security decisions based on 'how things feel' rather than analytical threat assessment.
Winnicott's (1971) transitional space theory shows digital environments suspend normal reality testing. fMRI studies reveal virtual environments activate similar brain regions to REM sleep—reduced prefrontal cortex (reality testing) and increased limbic activity (emotional processing). Freud's (1900) primary process thinking manifests as condensation (merging identities), displacement (transferring trust), and symbolic thinking over analytical reasoning.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Mandatory multi-channel verification for unusual digital requests. Regular training on digital deception with current examples. Clear policies separating entertainment and business digital contexts. Documented incident response for suspicious digital communications. No authentication bypasses due to digital urgency in past 90 days. Users demonstrate reality testing skills in digital environments.
Some verification procedures exist but inconsistently enforced. Basic awareness training on digital threats but not regularly updated. Occasional confusion between personal and business digital activities. Mixed success identifying suspicious digital content. Rare authentication bypasses with some controls in place. Variable reality testing in digital contexts.
Employees routinely accept unusual digital requests without verification. No specific training on deepfakes, AI manipulation, or digital deception. Business and entertainment digital activities occur on same systems without boundaries. Recent incidents of employees deceived by obviously manipulated content. Regular bypassing of security measures due to digital 'urgency' or 'trust feelings.' Dream-like acceptance of impossible digital scenarios.
Implement mandatory verification through at least two different communication channels for any unusual digital requests
System automatically flags requests requiring verification and prevents action until completed. Phone + email, text + in-person, or other channel combinations required for sensitive operations. Documented verification checklist for common scenarios.
Monthly 15-minute sessions showing recent deepfakes, AI-generated content, and social engineering examples
Include 'spot the fake' exercises using actual attempted attacks on similar organizations. Industry-specific examples updated monthly. Practice maintaining critical thinking in immersive digital environments.
Technical controls preventing business applications from running alongside entertainment software
Separate user profiles, network segments, and authentication requirements for business versus personal digital activities on corporate devices. Clear visual indicators of security context.
Real-time verification system for virtual meetings displaying authenticated participant status and security levels
Mandatory identity confirmation for sensitive discussions. Visual indicators of connection security and participant verification status. Recording controls and presence verification.
Automated monitoring of all employee interactions with AI systems, chatbots, and virtual assistants
Alerts for extended conversations, sensitive information sharing, or policy violations. Mandatory review process for flagged interactions. Clear guidelines on appropriate AI system usage.
One-click reporting system for questionable digital content with immediate security team escalation
Automated preservation of evidence and rapid organization-wide alerts for emerging threat patterns. Feedback loop to reporters showing investigation results and recognition for reporting.