Somatic cues in social engineering response
These thoughts are my own, from sixteen years on the offensive side of security. I use AI to help edit and to find the research.
When we are tired, when we’re distracted, when we’re in pain, when there are things going on, our brain’s attention and focus is to relieve that pain. And so if we are working, we’re not going to be able to have a hundred percent focus.
I think that’s obvious. We know that we don’t show up our best at work when we aren’t feeling well. That’s why we have sick days, that’s why we take vacation, even just to get a mental break to kind of reset so that we can show up and give a hundred percent at work.
Now this is something that cyber criminals will try to induce with the way that they target communications. They will try to induce stress.
Urgency is the mechanism
There’s a study that reviewed 340,000 emails using Robert Cialdini’s influence techniques, and they found that 43% of phishing emails had an urgency tactic involved, as opposed to five percent of legitimate emails.
The study is Pan, Yang, Cole, Wilson and Woodard (University of Florida), “Psychology of Phishing Emails: Quantifying Persuasion Principles and Simulating Detection with Large Language Models”, posted September 2025 and published in Expert Systems with Applications in 2026. It analyzed 340,912 emails from seven benchmark datasets and found that scarcity, which is Cialdini’s word for deadlines and urgency, showed up in about 43% of phishing emails and about 5% of legitimate ones, the sharpest single separator in the data. Together with requests for sensitive information it was the strongest independent predictor that an email was phishing.
So again, that urgency is a key factor in trying to induce stress and to get us to activate the system one part of our brain that acts and makes decisions quickly and in a shortcutted way based on limited information. They try to influence that system one because that is where errors are more probable. System two is where we’re thinking more deeply and carefully, and that’s harder to do when there’s urgency, when there’s fatigue, tension, etc.
The same paper tested this directly. When the researchers prompted AI models to read emails the way system two does, deliberately and analytically, instead of the way system one does, detection accuracy rose from 83.09% to 88.20%. The system one and system two framing is from Daniel Kahneman’s Thinking, Fast and Slow.
Three more studies point the same direction. Auton and Sturman (2025) gave 200 people either 7 or 15 seconds per email. With the shorter timer, their ability to tell phishing from real email fell by more than half, and they rated phishing links as safer. Jalali and colleagues (2020) surveyed hospital employees and found workload was the one thing that predicted clicking on phishing links; the attitude and knowledge measures did not. And Zhuo and colleagues (2024) put people in front of a full inbox under a deadline and measured their bodies. Under high workload they showed higher physiological arousal, spent half as long reading each email, and were more likely to click phishing that looked like part of the job.
Somatic awareness as a defensive skill
Now, how do we use somatic awareness as a defensive skill that employees can practice?
I think it’s the opposite. If we shouldn’t read emails when we’re stressed, rushed, etc., then we need to not be stressed, rushed, urgent in order to process them. Reverse whatever negative effects we’re experiencing when we’re more likely to trip up. It’s the idea that taking care of yourself when you’re tired, have a headache or whatever, that’s a good signal to get up and go take a walk outside or go talk to somebody. Switch it up and try to do something that’s going to help your body. I mean, take the day off if you need to take the day off.
There’s another study where mindfulness was not just general mindfulness or meditation, it was very domain specific.
That study is Jensen, Dinger, Wright and Thatcher (2017), “Training to Mitigate Phishing Attacks Using Mindfulness Techniques,” in the Journal of Management Information Systems. 355 people at a US university got either mindfulness-based training or conventional rule-based training, then received a simulated phishing email ten days later. The mindfulness group was better at avoiding it. Their version of mindfulness was specific to reading messages: paying attention to how you are allocating attention while you evaluate an email, staying aware of context, and holding off on judgment. A later study, Bera and Kim (2023), found the same split from the other direction: being a generally mindful person did not predict phishing detection, but being mindful specifically about how you handle email did.
So giving employees tips on how to process their email mindfully is a way that you can help them to be more aware and less susceptible. That might look like making sure that they understand the warning banners that are showing up in emails and why they’re there and what they signify and what they can indicate to them.
Help them recognize when they’re going through emails if they feel emotions rise, whether it’s fear or urgency, if there’s anything that’s off, to pay close attention to those sensations because they could be telling you something about the email. They may not, but it’s important to pay attention to them, because if they’re not saying something about the email, they may be saying something about something else that’s going on. Like maybe they have a headache and they need to take a break. Their body’s telling them they need to switch gears.
Pausing has to be safe
Things could be legitimately urgent. But it’s important to create an environment of psychological safety where employees feel empowered to take a pause, to verify through an outside channel or source that this urgency is merited.
And that is what’s going to make your employees and your companies more secure in the long run.
