Disclaimer: The views and opinions expressed in this article belong solely to the author and do not necessarily reflect those of ISC2.
She’s racing to finish a deadline when an email comes in that looks like it’s from someone in leadership. An invoice has already been approved, it just needs to be paid, today. She has maybe two seconds before her hands are already moving toward the reply button.
Those two seconds decide everything. Not the spoofed domain. Not the slightly off signature. Not any of the technical tells that would jump out at her on a slow Tuesday with nothing else on her plate. The exploit isn’t in the message. It’s in the moment.
I’ve spent years building our security awareness program. If there’s one thing this work has taught me, it’s that we’ve been fighting the wrong battle. We teach people to spot bad grammar and mismatched logos. Then we act surprised when a well-timed message walks right past every lesson we’ve given them. Urgency is the single most reliable lever an attacker can pull. I want to talk about why.
The Psychology Underneath
Human decision-making runs on two systems. Most of us know this intuitively, even if we’ve never put a name to it. One is fast and automatic, running on instinct and pattern-matching. The other is slow and effortful, doing the careful weighing we associate with good judgment. Urgency forces a decision into the fast lane, whether the situation calls for it or not.
That fast-response system evolved to handle physical threats. A sound in the brush. A car swerving toward you. A hand reaching for something sharp. It bypasses deliberation because deliberation gets you killed when a threat is immediate and physical. Inbox threats trigger the same circuitry. Your inbox never had the chance to evolve alongside it. There’s no ancestral version of “urgent invoice attached” for your brain to have learned caution around. It borrows a survival response built for a different kind of danger and points it at a login prompt.
Add stress and the picture gets worse. Under pressure, attention doesn’t broaden. It narrows. People fix on the most salient detail in front of them. In a well-built social engineering attempt, that’s exactly the detail the attacker wants them to fixate on: the deadline, the authority figure’s name, the threat of what happens if they don’t act. The sender address, the odd phrasing, the request that doesn’t sound like this person. All of it falls outside that narrowed field of view.
This is why “just be more careful” fails as security advice. I’ve watched it fail in real time. Telling someone to slow down assumes they’re already operating in the slow, deliberate system. Urgency’s entire job is to prevent that system from engaging in the first place. You can’t advise your way out of a mechanism built to bypass advice. I learned this early in my career, watching phishing simulation results barely move after months of “spot the red flags” training. Then we added one required pause before certain actions, and the numbers moved in weeks.
There’s a version of this problem that shows up in incident debriefs too. When someone clicks a bad link under time pressure, the instinct is often to ask what they should have noticed. That question assumes the failure happened in the noticing. Most of the time it didn’t. The failure happened upstream, in the moment the fast system took over, and the slow system never got called in. Ask people to notice harder and you’ll keep getting the same results. Noticing was never the part that broke.
Where Urgency Shows Up Beyond Phishing
Once you start looking for this pattern, it stops looking like a phishing problem and starts looking like a human risk problem. At my organization, we regularly see messages posing as someone in leadership, saying an invoice has already been approved and just needs to be paid. These don’t just target finance. They land in anyone’s inbox, because the attacker only needs one person to act. We’ve seen the same play run over Microsoft Teams and by text message straight to a personal phone. Our people catch nearly all of them. Pausing to verify is normal here and reporting takes less effort than acting on the request would. Fake IT tickets run the same play, framed as an account that locks in an hour unless someone acts. Fraudulent wire and payment requests almost always come with a clock attached, for the same reason the invoice example works; urgency plus authority plus isolation from a second opinion is a durable formula.
It isn’t confined to attacks either. Deadline-driven business culture manufactures the same conditions on an ordinary Tuesday, no attacker involved. The throughline matters more than any single tactic. Phishing, executive impersonation and fraudulent wire requests aren’t three separate problems needing three separate training modules. They’re one cognitive shortcut wearing different costumes.
The Uncomfortable Part
Here’s something that took me longer to admit than I’d like. Organizations manufacture the exact same urgency reflex we’re training people to resist. Mandatory compliance deadlines. Incident response that runs on visible panic instead of practiced calm. Countdown language in our own communications, because urgency gets people to click “complete training” faster than a polite reminder does.
I’ve sent those emails. Subject lines with exclamation points, built to create the same pressure response I spend the rest of my time teaching people to distrust. It works, in the narrow sense that completion rates go up. But every time we reach for that tool, we reinforce the reflex we’re supposedly trying to dismantle. You can’t spend eleven months training someone to distrust urgent messages, then spend the twelfth month sending one, then expect them to know the difference. From where the employee sits, urgent is urgent. We don’t get to keep the tool for ourselves and take it away from everyone else.
What Helps
Urgency can’t be eliminated and I don’t think that’s the right goal anyway. What’s worked, in my experience, is building friction back into the moments where urgency tries to remove it.
Verification without accusation matters more than most programs give it credit for. If the only option available to a suspicious employee is “you might be under attack,” people will talk themselves out of using it. Nobody wants to accuse someone in leadership of being a scammer over a request that might turn out to be real. Frame verification as routine instead, something everyone does for every unusual request regardless of who sent it. That removes the social cost of asking.
Explicit permission to pause is the piece I think gets underweighted the most. People need to hear, directly and more than once, that stopping to check is expected, even if it means missing a deadline. I’ve seen the difference it makes when leadership says that out loud instead of assuming it’s implied.
Reporting needs to be faster than compliance. If flagging a suspicious message takes more clicks than just dealing with it would, you’ve built a system that punishes the behavior you’re trying to encourage.
Leadership modeling calm response carries more weight than any training module. When something goes wrong and the people at the top stay level instead of visibly panicking, that sets the tone for everyone watching. People are always watching.
I’d also push every program to measure pause behavior, not just click rates. Click rates tell you who failed. They don’t tell you who stopped, checked and then got it right, which is the behavior you’re trying to build. A metric like “reports before action” won’t slot into a dashboard as cleanly as a click-rate percentage does. Build it anyway. A program that only counts failures will always look like it’s losing ground, even in the months it’s working exactly as intended.
Reframing the Goal
The goal was never to eliminate urgency from the workplace. That’s not realistic. Honestly, some urgency is legitimate. The goal is building the muscle to recognize it and insert a single beat of hesitation before acting on it. That beat is small. It’s also the entire difference between a click and a catch.
I don’t want the people I train to memorize a list of red flags. I want to hand them back a moment of control, right at the point where an attacker is counting on them not having one.
Jennifer Blacker, CISSP, has six years of experience in international engineering and consulting firm cybersecurity operations and compliance. She has held business and management roles, with responsibility for security awareness programs, CMMC compliance and vendor risk communications. Her cybersecurity work spans phishing simulations, policy development, and global employee training campaigns.
.png?h=420&iar=0&w=420)