Definition
What is Psychological Security?
Psychological Security (PsySec) is the discipline of defending people against manipulation. It builds the beliefs, instincts, and habits that help people recognize and report social engineering, inside a culture that treats them as partners, not risks.
Why it exists
Most successful attacks start with a person, not a system. Attackers use messages designed to trigger urgency, trust, or the wish to help, and those triggers fire faster than careful reasoning. Filters and firewalls are built to catch code. They are not built to catch a convincing request.
PsySec treats this as its own discipline rather than a feature of information security. It draws on psychology, learning science, and organizational culture research to strengthen the human side of defense.
How PsySec differs from conventional awareness training
| Question | Conventional approach | PsySec approach |
|---|---|---|
| How are people framed? | The weakest link | The best defense: partners who want to do right by their organization |
| Headline metric | Click rate | Reporting rate; click rate is a diagnostic |
| Response to a click | Remedial training, sometimes discipline | Treated as data about the Program, with feedback for everyone |
| Individual measurement | A single risk score per person | Resilience and vulnerability per manipulation tactic, used to route learning, never to rank people |
| What gets trained | Rules and red flags | Recognition of manipulation tactics and the instinct to pause, verify, and report |
These are PsySec's positions. The research database collects the evidence for them, and against them.
The belief chain
PsySec holds that belief leads to emotion, emotion leads to behavior, and behavior over time becomes habit. A person who believes reporting protects their team feels pride, not anxiety, when they spot a scam, and that feeling drives the behavior that becomes automatic.
The eight principles
Principle 1
Psychographics > Demographics
Train for how people think and what they care about, not for the attributes on their HR record.
Principle 2
Culture eats compliance for breakfast
Compliance programs produce box-checking. Culture produces people who care about getting it right because their team does.
Principle 3
Feedback, Feedback, Feedback
Learning without feedback is only exposure. People need to know what worked, what didn't, and why: fast, plainly, and without judgment.
Principle 4
Security is too important to take seriously
Fear raises defenses without raising recognition. Humor disarms, sticks, and lets people notice the lesson without bracing for a verdict.
Principle 5
Stories matter, and they spread
People recognize manipulation by matching it to stories they have heard. Stories that travel person to person spread recognition faster than any portal.
Principle 6
Brains are not computers
Manipulation hits the fast, emotional systems that fire before reasoning. Training has to reach that layer, not just the rational one.
Principle 7
Don't make it easy. Build games.
The mind keeps what it had to work for. Engaging, effortful practice beats easy, forgettable training.
Principle 8
Instincts beat algorithms, every time
Trained human instinct, the sense that a request is wrong, is the best defense against social engineering, and it improves with practice.
The six manipulation tactics
Social engineering exploits a small set of psychological tactics. PsySec trains people to recognize the tactic, which still works when AI removes the typos.
Helpfulness
Triggering the impulse to help.
“I'm locked out and the meeting starts in 5 minutes. Can you forward the deck?”
Authority
Posing as a boss, executive, or institution.
“Per the CEO, please wire $40K to this account today.”
Social Proof
Implying others have already acted.
“Most of your team has already completed this. Click to finish.”
Origin
Adam Anderson coined the term Psychological Security in 2018. Zach Eikenberry developed the body of work behind it from 2019 onward, including the PsySec Manifesto (2020), which set out the first seven principles. The eighth principle was added in 2026. Both are co-founders of Hook Security, which maintains this site.