A note on this blog: these are thoughts from experience, not research papers. Sixteen years on the offensive side of security shaped how I see awareness training and where I think it should go. I'll point at papers and reports where they help, but the posts are mine.
Mindfulness has a reputation problem. It sounds abstract, or it gets reduced to something simplistic, something for people with their heads in the clouds. It's really the opposite. Mindfulness is the ability to be fully present, and I think it's one of the most practical security skills a person can build.
Here's what I mean. Think about checking email. Most of us have been taught a set of technical cues for spotting a phish: an unfamiliar sender, inconsistencies in the message, a banner that says this came from outside the organization. Those cues are useful. Being present while you read helps you actually recall them instead of skimming past them on autopilot. That's the first, smaller benefit.
The bigger one is this. With AI, phishing is becoming more polished and sometimes harder, if not impossible, to detect from the message itself. The technical cues are getting weaker. What isn't getting weaker is what happens inside you when you read it.
Am I feeling anxious right now? Is there a sense of urgency? Is an authority figure asking me to do something? Those internal pulls are the cues that will go a longer way as AI phishing gets better, because the attacker can polish the words but still has to make you feel something to get you to act. If you can notice the feeling, you can decide what to do with it: slow down, reach out on a separate channel, verify the request before you respond.
The same thing works outside the inbox. When someone approaches you, over the phone, on social media, or in person, and you notice an emotional intensity that doesn't fit the situation, that's information. Maybe it is normal. But romance scams, for example, prey on recent vulnerability or loss. They take advantage of people who aren't fully present because of grief or distraction, and of the lower inhibitions that come with that. The scam works because the person's attention is somewhere else.
So when I talk about mindfulness in security, I mean something specific: the ability to take a step back, notice what's going on internally, and be patient with it before acting. That's a trainable skill. And like any skill, the more you practice noticing your internal state, the more readily it comes. You start to check in with yourself without having to think about it.
That's the part I find most compelling. Practicing this doesn't only help when a threat shows up. It grounds you in the relationships that matter to you. You show up better at home, with friends, with the people you work with. It's a skill whose benefits multiply the more it's practiced, and the security payoff is just one of them.
