System 1, System 2, and why we need both
These thoughts are my own, from sixteen years on the offensive side of security. I use AI to help edit and to find the research.
I’ve been referencing System 1 and System 2 a lot, Daniel Kahneman’s terms, so I want to take a post to talk about them. I’m not an expert on this. But the way I understand it, System 1 and System 2 are both features of the human brain, and we need both of them.
System 1
System 1 helps us make important decisions immediately. It has helped us survive in the past, and it can still help us now: when we recognize danger, we’re able to act immediately.
Kahneman describes it as thinking that is “automatic, experienced passively and usually rapidly” (Kahneman, 2012).
I also think System 1 includes trained expertise. When we’re in the habit of doing something, we’ve built those neural connections, and it becomes easy. We can often do it without much thought. So while it may have started as a survival instinct, I think it expands to other things as well, and those things make us more efficient and productive.
Kahneman says much the same: “Highly skilled responses become automatic and therefore have the characteristics of System 1 activities.” His examples are a chess master who sees the winning move and a doctor who can diagnose at a glance (Kahneman, 2012).
System 2
System 2 lets us think more deeply about things and analyze them. I think that ability to think deeply is really what makes us human.
In Kahneman’s words, it’s the kind of thinking that is “effortful, deliberate, demanding of attention.” He’s also careful to say the two systems are a way of describing how we think, not places in the brain: “System 1 and System 2 are fictitious characters; they do not exist as systems or have a distinctive home in the brain” (Kahneman, 2012).
Kahneman also calls System 2 lazy. In Thinking, Fast and Slow he names it “the lazy controller.” It doesn’t check System 1’s work very closely. In his words, that monitoring “is normally quite lax, and allows many intuitive judgments to be expressed, including some that are erroneous.” He illustrates it with a simple puzzle from his colleague Shane Frederick: a bat and a ball cost $1.10, and the bat costs $1 more than the ball. How much is the ball? Most people’s first answer is 10 cents, which is wrong. About half of the Princeton students who were asked gave that answer (Kahneman, 2003).
The rider and the elephant
One analogy I like is the rider and the elephant, from psychologist Jonathan Haidt’s book The Happiness Hypothesis (Haidt, 2006). In it, the two together are the human mind.
The elephant is going to go where it’s going to go, and there’s not much that can stop it. That’s our System 1.
System 2 is the rider on top. It takes some persuasion, some effort, and an understanding of how the elephant works, how System 1 works, for us to really gain control of it and use it to its best advantage.
Haidt makes the same point: the rider can’t control the elephant by force, so the work is learning how to guide and train it.
When my System 1 gave it a pass
I’ve told this story on a podcast. Shortly after my son created a Fiverr account, he got a request to do some work. Then they asked for his card number. He was a little confused. He had never set something up like this before, so he came to me.
I was distracted in the moment, so my System 1 was the one talking to him. It sounded normal. They need a way for payments to be made. Nothing seemed out of the ordinary. So he did what I told him and put in the information.
Then he started getting other messages that worried him, and he brought it to me again. This time I went back, looked at the original email, and immediately realized it was a phish.
When I say immediately, I think my System 2 was engaged. I was pausing and looking closely at the cues I would normally look for. I was focused, and I was able to detect it.
That’s where I’m trying to point with all this. Attackers know our System 1 is limited. They may not understand the psychology or the neuroscience behind it, but they know that if they can send something that looks mostly okay, there’s a chance it will fly under the radar, and System 1 will give it a pass.
Curious, not furious
And that’s why I have this fascination with curiosity. I really like the saying “be curious, not furious.”
Curiosity engages our System 2 thinking. System 1 can often be emotional. That’s where our amygdala gets triggered, and it’s often associated with fight, flight, or freeze, the immediate actions we take in a survival situation or an emergency.
Promoting curiosity helps us detect attacks against us more effectively. Not only does it help us in cybersecurity, but it also improves our relationships. So I think this is a life skill, not just a cybersecurity skill or tactic. It can be a mantra across everything we do.
References
- Haidt, J. (2006). The Happiness Hypothesis: Finding Modern Truth in Ancient Wisdom. Basic Books.
- Kahneman, D. (2003). Maps of bounded rationality: A perspective on intuitive judgment and choice. In T. Frängsmyr (Ed.), Les Prix Nobel 2002. Nobel Foundation. Prize lecture delivered December 8, 2002. nobelprize.org
- Kahneman, D. (2011). Thinking, Fast and Slow. Farrar, Straus and Giroux.
- Kahneman, D. (2012, Winter). Two systems in the mind. Bulletin of the American Academy of Arts and Sciences. amacad.org/news/two-systems-mind
Related: Your Body Knows Before Your Brain · The Mindful Defender
