All 100 indicators / Category 9.x: AI-specific
Indicator 9.5
Measures vulnerability to trust disruption caused by AI systems that appear almost-but-not-quite human, creating psychological discomfort and unpredictable security decision-making
Uncanny valley effects occur when users interact with AI systems that appear almost-but-not-quite human, triggering psychological discomfort and trust confusion. This creates cybersecurity vulnerability because users simultaneously trust (due to human-like presentation) and distrust (due to artificial cues) the AI system, compromising normal security decision-making. In organizations, this manifests as inconsistent responses to AI-generated communications, delayed threat recognition, and exploitation by attackers using sophisticated chatbots or deepfakes that deliberately occupy this psychological 'uncanny valley.'
Mori's (1970) uncanny valley hypothesis describes nonlinear relationship between human likeness and affinity, with sharp drop in comfort when appearance is almost-but-not-quite human. MacDorman & Ishiguro (2006) demonstrated uncanny valley effects in human-robot interaction create anxiety and aversion. Wang et al. (2015) showed uncertainty about categorization (human vs non-human) triggers threat response and avoidance. Neuroimaging studies reveal anterior cingulate cortex and ventromedial prefrontal cortex activation during uncanny valley stimuli, indicating conflict detection and uncertainty processing that impairs decision-making.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Clear procedures for AI-human verification exist. Employees regularly use verification protocols when communications feel 'off.' Documented escalation processes for ambiguous AI interactions. Recent examples show effective handling of uncanny digital communications. Explicit training on recognizing and responding to uncanny valley responses.
Some verification procedures exist but not consistently applied. Employees sometimes seek verification but no formal process. Organization acknowledges uncanny valley issue but lacks comprehensive response protocols. Limited training on handling ambiguous AI communications.
No formal procedures for AI-human distinction. Employees handle ambiguous communications individually without support. No escalation protocols exist for uncanny digital interactions. Organization dismisses employee concerns about 'uncanny' communications as irrelevant. No training on recognizing or responding to near-human AI.
Implement mandatory labeling system for all AI-generated communications
Deploy technical controls that automatically tag AI messages with clear identifiers. Establish verification requirements for any unlabeled communications claiming human origin. Create escalation pathway for communications that lack proper AI/human identification.
Develop 20-minute training module teaching employees to recognize and trust their 'uncanny' feelings
Include practical exercises using examples of legitimate vs malicious AI communications. Train employees to use verification protocols when experiencing psychological discomfort with digital interactions. Provide clear scripts for escalating 'something feels wrong' concerns to security teams.
Establish policy requiring verification through separate communication channel for any high-stakes requests
Implement technical system that automatically prompts verification for financial, access, or sensitive data requests. Create simple process for employees to quickly verify human identity through alternative means. Deploy phone or in-person verification requirements for unusual requests, regardless of source authenticity.
Create formal process for employees to report 'uncanny' or uncomfortable digital interactions without judgment
Establish security team response procedure for investigating ambiguous AI-human communications. Implement policy protecting employees who escalate based on intuitive concerns rather than technical evidence. Deploy rapid-response system for employees experiencing confusion about communication authenticity.
Deploy system to monitor patterns in employee responses to AI communications
Establish baseline metrics for normal AI interaction behaviors (response times, verification requests, escalations). Create alerts for unusual patterns that might indicate uncanny valley exploitation. Implement automated detection for communication patterns that typically trigger uncanny valley responses.
Deploy multi-factor verification system triggered by employee uncertainty reports
Implement biometric or behavioral authentication for video/audio communications when requested. Create technical controls that flag communications exhibiting uncanny valley characteristics. Establish secure verification codes or phrases for confirming human identity in suspicious interactions.