Degree 4 · Unit 4.4

Cognitive security

An attack on a system targets what you own. A cognitive attack targets what you believe. The difference is that you discover the first in the logs, and the second — if you discover it at all — only after you have already taken the decision yourself, convinced that you were right and under no pressure from anyone.

What turned this kind of attack from an art into an industry was the collapse in what it costs. Manufacturing a persuasive message in the victim's own language, in their manager's voice, in their manager's way of phrasing things, built entirely on what the pair of them had published openly, used to take a team and several weeks. It now takes minutes. And once the cost of an attack collapses like that, defending yourself as an individual stops being enough; it becomes a question of how mature your organisation is.

FIG. 21 — The stages of a cognitive attack

Collection

Everything you and your organisation published openly: conferences, interviews, an org chart, a writing style, a voice.

Tailoring

The message is cut to the target's measure: their language, their professional anxiety, their relationship with whoever is being impersonated.

Pressure

Time running out, a higher authority, and secrecy: "before closing", "tell nobody until we announce".

Execution

The victim carries it out themselves, following procedure, so not one technical control catches it.

Notice that three of those four stages run entirely outside your organisation. No firewall and no monitoring system anywhere will see them happening.

The personal shield: five habits

The second channel

Any exceptional request is confirmed through a different channel that you initiate — not by replying to the message itself. This habit alone would have been enough to prevent the incident at the start of this programme.

An agreed word

A verification word with your family and your finance team, written into no digital system. Simple and old-fashioned, and it defeats a voice forgery in a second.

Slowing down under urgency

Urgency is the attacker's first tool. Make it your rule: the greater the time pressure, the more time for verification — not the reverse.

Asking after the source

In front of every consequential piece of information: who said it first? And who benefits from my believing it? Two questions that cut off most disinformation campaigns.

Reducing the public trace

What you publish of voice, image and organisational detail is the raw material of the first stage. Do not stop publishing, but know that you are feeding your own attack surface.

At the level of an organisation, habits on their own are not enough; you need measurement. That is exactly what the cognitive security maturity model provides — four dimensions, five levels and twenty items — and you will apply it in full in unit 5.5.

The UCSMM model — four dimensions

A measuring instrument that answers one question: how ready is your organisation for an attack aimed at perception rather than infrastructure?

FIG. A7 — The four-dimension radar · an example from a mid-sized organisation

1 Unaware2 Aware3 Systematic4 Measured5 Adaptive

The lopsided shape tells you more than a single number: an aware organisation with no prepared response falls faster than a less aware one that is better prepared. Each dimension has five levels: unaware, aware, systematic, measured, adaptive.

Do this

1 — On paper. Write a cognitive attack scenario against your organisation: who is impersonated, who is targeted, what is requested, and what pressure is used. Be harsh — realism here is protection.
2 — In practice. Agree a verification word today with two people: one at work and one at home.
3 — In your field. Search out everything publicly available about you: your voice, your image, your team structure. Write what could be built from this material.

Where to after this unit? You know the mechanism of the deception. The next unit is about its sharpest instrument: your face and your voice.